Emerging technologies such as connected transport, quantum sensing, healthcare diagnostics, and synthetic AI-driven content are creating huge gaps in data protection and privacy that could quickly outpace the ability of regulators and enterprises to contain them.

It’s a possibility that emerges from the UK Information Commissioner’s Office’s (ICO’s) latest Tech Horizons report 2025, which examines how these four sectors could be about to make today’s understanding of the data security challenge look quaint.

As anyone recently buying a new car will notice, the in-vehicle experience is now influenced as much by the onboard digital systems as by anything happening in its engine, transmission, or battery power plant.

Owners can talk to their cars, access systems using facial recognition, ask software to compose business memos and texts, and remotely turn on home central heating systems, all while plotting the best route to a destination through traffic. The car, meanwhile, can use sensors to monitor the owner for fatigue and driving style, uploading this data to central systems and multiple apps.

But this is only the start. Pretty soon, vehicles will continuously communicate with one another, the road infrastructure around them, and even with the smartphones carried by pedestrians. This represents a massive expansion in data and data communication that will hand a huge job to organizations trying to stay within current UK data protection and consent regulations, said the ICO.

“The proliferation of sensors in connected vehicles increases the risk of collecting excessive information beyond what is required for the stated purpose.,” the ICO said. “In particular, sensors may collect data in a continuous and automatic way with limited or no ability for the user to effectively opt out of collection.”

Unfair processing and fake data

And it’s not only vehicles. Another rapidly evolving area is quantum sensors, a term that covers types of medical sensing devices used to measure tiny changes in magnetic fields, gravity, and temperature.

In future, these could generate large amounts of data on a patient’s health in real time, which will need to be secured:

“People may not understand what information is being collected and why. If capabilities are misused or information is inadequately protected, there are concerns about risks of unfair processing (and even neuro-discrimination),” said the ICO.

The report also looks at the effect of AI-generated content, an issue that is already causing trouble. Although entirely synthetic, the data used to train these systems is based on personal or biometric data, the obvious example of which is deepfakes.

It’s a class of data protection problem which, until recently, would have sounded surreal: defending individuals from exploitation by entirely or largely fake PII.

Data protection by design

The ICO sees this as three problems. First, emerging technologies will generate vastly more data, which will translate into a larger workload for anyone trying to secure it.

Second, they will generate new types of data, for example, “from brain patterns to driving fatigue.” Protecting this will require tech companies to build in data protection by design before a system is released.

Finally, and most significantly, this data will be shared across multiple entities, leading to a lack of transparency about who is responsible for it at different stages.

Although some of these issues relate to consumers, many enterprises that interact with or process this data could be caught up in the same issues.

“As this report shows, the increasing number of innovators developing and interacting with new technologies creates complex networks. This makes it harder for people to understand who is processing their information and how they can exercise their information rights,” said the ICO.

For enterprises, navigating this won’t simply be about staying on the right side of data protection regulations, but understanding which rules to pay attention to, said Andrew Churchill, a director at the CSBR, a non-profit that seeks to influence public policy.

“Given that most UK organisations will handle EU citizen data, and almost all will use US IT within their supply chains, different regulatory regimes will force organizations around the world to juggle the contradictions between different jurisdictional positions,” said Churchill.

For example, a company’s tier one supplier might be in the UK, but has a French supplier, which in turn has a supplier that is German. But, he said, “the French interpretation of the EU’s NIS2 Directive might be different from the German one, which might be different from the UK one under the Data (Use and Access) Bill.”

This risks creating a huge amount of regulatory complexity for enterprise data protection officers, in ways that might reduce the effectiveness of data compliance, he noted. “Too often the public policy debate doesn’t consider the ramifications of what we could be sleepwalking into.”