By: Grace Drost
Microchips in the brain and mind-reading devices sound like something straight out of a science fiction film. However, science fiction is increasingly sounding like reality. Neuralink, a device designed to give paralyzed patients the ability to control digital devices through their thoughts, has successfully been implanted in a second patient. Another team of scientists has successfully used neural data from a paralyzed participant to convey speech and facial expressions through an avatar. Last September, Apple filed a patent for future AirPods that can scan brain activity. The neurotechnology market is projected to reach $15.28 billion this year, reflecting a 13.5% growth rate from last year. Although it is exciting to see where this technology takes us, concerns about regulating this invasive new technology remain.
Unlike medical devices, which must comply with federal health laws, consumer neurotechnology devices remain largely unregulated. These devices attempt to address cognitive issues and include products like apps to meditate, improve focus and treat mental health conditions like depression. The products monitor and record brain data, analyzing everything in your mind, including thoughts and feelings. Without regulation, companies can collect highly sensitive brain data, share or sell the data to third parties, and keep this data for as long as they please. A report released in April by the NeuroRights Foundation examined policy documents from thirty companies. Excluding one company, they all “took possession” of the neural data collected. More than half then sold this data to unknown third parties.
Some states have taken action, including California and Colorado. A few weeks ago, Governor Gavin Newsom of California signed a new law that aims to protect people’s brain data from being misused by neurotechnology companies. The new law amends California’s current law, known as the California Consumer Privacy Act. The amendment includes “neural data” under “personal sensitive information”, which was already regulated under the act. Now the same level of protections will be applied to neural data that were already applied to other biometric information such as facial images, DNA, and fingerprints. This means users can now request, delete, correct, and limit what neural data companies collect on them and opt out from companies selling or sharing their data.
California is the second state to pass a law regulating neural data. A few months prior, Colorado became the first state to ensure this protection by expanding the definition of “sensitive data” to include “neural data”. Although passing with a 61-to-1 vote in the Colorado House and a 34-to-0 vote in the Senate, the law faced external opposition. Private universities were concerned with how this might limit their ability to train students in neural diagnostics and research. Public universities are exempt from the Colorado Privacy Act of 2021, but private universities do not share that same exemption. Big tech companies also played a role by arguing the law was overly broad and could harm data collection that is not strictly related to brain activity. Due to this, TechNet, who represents companies like Apple and Meta, was able to push lawmakers to include language that focuses the law on brain data that identifies individuals.
In majority of the country, brain data is vulnerable. This is of course even more concerning when considering that the target demographics of a lot of these neurotech devices are individuals with physical disabilities or mental health concerns. Already vulnerable individuals could be exploited by companies they believe are helping them, while their data could be shared with anyone willing to pay the price. Considering California is a leading technology hub, hopefully its passage of neural data protection laws will influence the rest of the United States. Although there is resistance from major actors, like universities and tech companies, a balance of innovation and ethics is necessary to protect consumers. Individuals should not have their right to privacy compromised but at the same time, these technological developments could lead to significant enhancement of human capabilities.
Overall, regulation of neural data is on the rise, with recent laws in California and Colorado setting a promising example for other states to follow. This technology is complex, and many individuals may not fully understand the implications of consenting to its use, especially when it comes to their privacy. Stronger legal safeguards are essential to ensure that innovation can thrive while still protecting consumers from potential exploitation.
Student Bio: Grace Drost is a third-year evening law student at Suffolk University Law School. She is a staff member for the Journal of High Technology Law. Grace received a Bachelor of Science degree in Biology from Boston College in 2021.
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHTL or Suffolk University Law School.
