Introduction

Much has happened since we released our first Tech horizons report in December of 2022. 12 months ago, few could have foreseen the sheer speed and breadth of developments that would take the artificial intelligence space by storm, nor the spillover effects these advancements would have on other areas of innovation. Technologies do not develop in isolation, but are shaped by constantly evolving economic, political, technological and societal forces. Responding to the speed and complexity of this constant change in the technology realm is a well-known challenge for regulators, policymakers, and indeed, innovators too. 

By identifying the privacy and data protection implications of new technologies before they are widely used, we are better placed to proactively set out our regulatory responses and enable innovators to consider these challenges already in the design-phase of development.     

The first edition of the Tech horizons report covered four emerging technologies in depth: the Internet of Things, immersive technologies, health-tech applications and decentralised finance (DeFi). We will consider eight further technologies in this second edition that we believe may see significant adoption in the next two to seven years:

• Genomics: The sequencing of the human genome to improve understanding of a broad range of traits, mostly used in healthcare. There is further potential for these insights to be used in fields such as employment, sports and education. 
• Immersive virtual worlds: Highly immersive virtual environments, also known as the metaverse, in which users can interact with each other and make use of digital services, such as e-commerce and gaming.  
• Neurotechnologies: Consumer, enterprise and healthcare devices and procedures, both invasive and non-invasive, that directly record and process neuro-data to gather information, control interfaces or devices, or modulate neural activity. 
• Quantum computing: By taking advantage of phenomena at the atomic scale, quantum computing may in future be able to resolve highly complex computational problems that current computers cannot, but may also present serious risks to existing encryption. 
• Commercial use of drones: Unmanned aerial vehicles (UAVs) used in commercial settings, for example in delivery and e-commerce, monitoring, and crowd control.  
• Personalised AI: The customisation of large language models, based on individual users’ search patterns and personal preferences and characteristics, to create more tailored user experiences and better-targeted outputs. 
• Next-generation search: Next generation search engines incorporating new technologies, such as embedded AI capabilities, as well as voice-based, image-based and ambient elements.
• Central bank digital currencies (CBDCs): A new form of central bank-issued digital money, which would complement physical cash and other payment mechanisms in facilitating everyday payment needs.

Each chapter briefly: 

• explains the technology behind each topic as well as its emerging use cases; 
• sets out the current state of play surrounding its adoption and development; and 
• discusses possible future privacy and data protection risks these developments may present. 

These chapters represent our early view on often highly uncertain, evolving technology areas. You should not consider the data protection and privacy issues we’ve explored, and the recommendations we’ve set out in this report, as formal guidance. They do not necessarily reflect our current or future policy positions. 

Our work on emerging technology 

Our emerging technology team was established in late 2021, with the goal of bolstering our capacity to proactively respond to emerging and future innovation. This is our second edition of our annual flagship Tech horizons report. We have also released dedicated foresight reports on biometrics and neurotechnologies, which delve deeper into the future regulatory considerations surrounding these two key technologies. We also work with our partners in the Digital Regulation Cooperation Forum (DRCF) to prepare reports on web 3.0, quantum and immersive technologies. 

We take our work on emerging technology and foresight seriously. By mapping out of possible future developments, we can better set our strategic priorities today. Insights derived from publications such as this also allow us to support innovators to address emerging data protection risks and opportunities early. All four technologies we identified in the first edition of the Tech horizons report are now the focus of a call for applications into our Regulatory Sandbox. The innovation landscape is vast; it can therefore be challenging to separate the signal from the noise. By practising foresight, we are better able to determine which areas of technological innovation require our attention. Equally, we can decide which ones may not yet have reached sufficient levels of maturity to warrant our immediate action. 

Technology selection

The selection and evaluation process behind the eight technologies we’ve explored in this report was guided by a robust, year-long horizon scanning and foresight cycle. This cycle consisted of four consecutive phases:

• Phase 1: Horizon scanning
  This initial horizon scanning phase primarily focused on identifying a long list of emerging technologies for us to consider for inclusion in the report. This process relied on a so-called “scan-of-scans” approach, in which we collated and contrasted technologies and emerging trends explored in recent foresight and technology publications. Our scan considered a large number of high-quality sources from a wide range of countries and stakeholder communities to ensure a diversity of perspectives (including civil society, academia, the private sector, government, think tanks, media, consultancies and peer regulators). This exercise identified more than 90 possible technologies. 

• Phase 2: Prioritisation
  In the second phase, we narrowed down this long list of technologies to the final eight priority topics. This shortlisting exercise involved a rigorous evaluation and stress-testing process, by which we scored potential technologies on the basis of several qualitative and quantitative indicators.   

These indicators aimed to surface: 

• • The magnitude and novelty of the possible privacy risks associated with an emerging technology (with an emphasis on harms disproportionately affecting those groups most at risk of harm, and the potential processing of special category information).
    
  • The expected maturity and market penetration of an emerging technology over the next two to seven years.
    
  • The degree and pace of innovation driving an emerging technology’s development (with a preference for technologies that have undergone significant change over the past 18 months across a range of sectors).  
• Phase 3: Evaluation
  During the third phase, we explored each of the eight priority topics in more depth, and stress-tested conclusions about possible future privacy and data protection considerations with external experts. 

• Phase 4: Scenario-building
  The fourth and final phase explored the possible trajectories our priority technologies may follow in the years ahead. We developed scenarios which aimed to shed further light on the privacy and data protection implications these different possible futures may bring. We carried out different scenario-building exercises to not just map the most direct emerging impacts and use cases of a technology, but also the more speculative second-order impacts they may generate (“don’t predict the car, but the traffic jam”). Each of the eight chapters includes an example box describing what people’s day-to-day interactions with a new technology might look like in the future.