The Information Commissioner’s Office has put out their annual Tech Horizon’s report delving into the eight technologies they believe may significantly impact societies, economics, and information rates in the short- and long-term.

In its first iteration published in 2022, the ICO covered four emerging technologies in depth, which included the Internet of Things, immersive technologies, health-tech applications, and decentralised finance (DeFi).

Since then, a plethora of new and nascent technologies have muscled their way into the collective conscience, leading the ICO to expand their list to include eight technologies.

1. Genomics

Defined as the sequencing of the human genome to improve our understanding of a broad range of traits, the ICO expects that this will have a dramatic effect on healthcare in the near future.

There is also further potential for insights gained from genomics to be used in fields, such as employment, sports and education.

The ICO highlighted some of the data protection concerns brought up by the prospect of increased genomics and genetic testing.

In particular, the ICO delved into polygenic risk scoring, which uses genetic markers to indicate an individual’s genetic risk for diseases or traits.

The ICO predicts issues with third party privacy, such as the privacy of relatives related to data subjects who may share these genetic markers, and the anonymisation and security of this sensitive information.

2. Immersive Virtual Worlds

Highly immersive virtual environments, also known as the metaverse, allow users to interact with each other and make use of digital services, such as e-commerce and gaming.

The ICO has highlighted several potential issues surrounding these virtual worlds and data protection, including the large amount of sensitive data these metaverses collect.

Further, as children are active users of these spaces, organisations much proactively put in safeguards to protect children and their data online.

Interoperability may also provide a challenge to companies to enable a seamless experience between different worlds, which brings in different security concerns as well as the need to establish common technical standards.

3. Neurotechnologies 

Neurotechnologies include devices and procedures that record and process neuro-data to gather information, control interfaces, or devices, or modulate neural activity.

The novelty of the information this data collection method offers a brand new realm of opportunities as well as data protection concerns. The information directly from people’s brainwaves makes the data inherently highly sensitive.

Even the UK’s GDPR does not formally provide a definition of neural information, meaning that organisations processing it should take special heed when doing so.

Consent and transparency issues are also inherent as neural information is subconsciously generated, and it can modulate brain patterns and alter behaviour. These two issues are not well understood, so privacy must be integral when using this technology.

Neurodiscrimination can perpetuate due to systematic bias against minority and marginalised communities as well, as previously highlighted by the ICO.

4. Quantum Computing

By taking advantage of phenomena at the atomic scale, quantum computing may in future be able to resolve highly complex computational problems that current computers cannot, but may also present serious risks to existing encryption.

Without appropriate safeguards, quantum computing can undermine the encryption that protects most of today’s digital communications and information in transit.

Postquantum cryptography provides its own set of data protection concerns as these highly complex systems may require special attention to keep data secure, as the complexity of IT system and cryptographic infrastructure differs between organisations.

5. Commercial Use of Drones

Unmanned aerial vehicles are increasingly used in commercial settings for deliver, e-commerce, monitoring, and crowd control.

The latter two bring up overarching issues around surveillance and mass data collection.

As drones can often be discreet, the public may be unaware that they are being captured in pictures or videos. As facial recognition technology progresses, the threat of personal data collection on a mass scale is a becoming a more pressing issue.

Transparency requirements and privacy information may therefore prove challenging due to the inherent nature of drones.

Drone ID programmes may offer one solution, but still may put the onus on data subjects to avoid having their personal data captured and collected by a drone.

6. Personalised AI

Large language models (LLMs) are being personalised based on individual users’ search patterns and personal preferences and characteristics, to create more tailored user experiences and better-targeted outputs.

These advancements introduce several privacy and data protection issues, many of which are shared with general generative AI models.

Recommended reading

• Data Privacy Week: Skills Gap, Budget Constraints Mar Privacy
• Data Protection Reforms Must Not Put UK and EU Data Flow at Risk
• Data Privacy Day: Where are We and How Did We Get Here?

But the inclusion of more personal information means that more sensitive data may be collected and processed by these AI systems. These systems, which are already trained on larger databases, may process special category data, which needs extra protections.

Further, this personalised information can be targeted in model inversion attacks which try to extract the information and exploit its outputs, potentially leaking the information.

7. Next-Generation Search 

Next generation search engines continue to incorporate new technologies, such as embedded AI capabilities, as well as voice-based, image-based, and ambient elements.

These systems would likely collect vast quantities of personal information to tailor search engines to specific users. Developers will still need to conform to the principle of data minimisation, limiting the information they collect to what is necessary.

The systems must also be transparent about the amount of data they collect as well as the rights of data subjects, like the right to be informed and the right of access.

Hallucination continues to be an issue for all AI models, that search engines must take careful consideration as they may create misleading personal information.

8. Central Bank Digital Currencies (CBDCs)

A new form of central bank-issued digital money, CBCCs could complement physical cash and other payment mechanisms in facilitating everyday payment needs.

As with any new form of currency, these bring along many issues surrounding financial data security and privacy.

Law enforcement will need to process information for fraud, data must be separated as to mitigate the risk of re-identification, and the sharing of personal information needs to be minimised.