Article 59: Further Processing of Personal Data for Developing Certain AI Systems in the Public Interest in the AI Regulatory Sandbox

Article 59 addresses a specific tension: AI systems often need large volumes of representative data to function well, but GDPR's purpose-limitation principle restricts reusing personal data for new purposes. Article 59 provides a narrow exception within sandboxes.

The exception is available only when all of the following conditions are met:

1. Public interest — the AI system is developed for a purpose of substantial public interest (e.g., public safety, environmental protection, public health, road safety). 2. Necessity — the personal data are necessary for the development and the same result cannot be achieved with synthetic, anonymised, or other non-personal data. 3. Safeguards — effective technical and organisational measures are in place, including at minimum pseudonymisation and encryption where feasible. 4. Data deletion — the personal data and any intermediate outputs are deleted when sandbox participation ends or the personal data reaches its retention period, whichever comes first. 5. Processing logs — the sandbox participant must keep logs of data processing activities for the duration of participation. 6. DPA approval — the relevant data protection authority must approve the processing before it begins.

This is not a blanket override of GDPR. All other GDPR obligations (data subject rights, security measures, accountability) continue to apply in full.

Article 59 operates without prejudice to the GDPR and the Law Enforcement Directive (EU) 2016/680. It provides a supplementary legal basis for further processing in a very specific context — it does not create a general \"research exemption\" or reduce GDPR compliance obligations.

Key interactions:

• Purpose limitation (GDPR Art. 5(1)(b)) — Article 59 allows further processing for a different but defined purpose (developing public-interest AI in a sandbox), provided the conditions are met.
• Data minimisation (GDPR Art. 5(1)(c)) — the requirement that synthetic or anonymised data must be used if possible reinforces minimisation.
• Data subject rights — remain applicable throughout sandbox participation.
• DPA oversight — the approval requirement gives DPAs a gatekeeping role, ensuring case-by-case assessment.

• Article 57 — establishes the sandbox framework within which Article 59 operates.
• Article 58 — the agreed plan must incorporate Article 59 data-processing arrangements where invoked.
• Article 60 — real-world testing outside sandboxes has its own consent and data rules; Article 59 is sandbox-specific.
• Article 10 — data governance requirements for high-risk AI systems (Article 59 processing should align with Article 10 quality standards).
• Article 113 — application timeline.