" 'Albert' doesn't target me — Nicholas does. " }} "Journaling in the open. You can steal my thoughts or you may read them here."
~ Dr. Eldon Byrd, Chief Medical Officer, U.S. Navy, 2001
NRF PRESS RELEASE | 17 APRIL — Neurorights Foundation Launches Landmark Report on Consumer Neurotechnology and Global Privacy Standards }}
THE NEURORIGHTS FOUNDATION RELEASES LANDMARK REPORT ON THE PRIVACY PRACTICES OF CONSUMER NEUROTECHNOLOGY COMPANIES, ILLUSTRATING THE URGENT NEED TO PROTECT NEURAL DATA GATHERED OUTSIDE OF HEALTH CARE SETTINGS
Colorado will later today become first jurisdiction in the United States to define and protect neural data as sensitive.
Yesterday, the California Senate Judiciary Committee adopted California's proposed neurorights bill on a vote of 11-0.
Washington, D.C. – The Neurorights Foundation, an NGO that works to promote innovation, protect human rights, and ensure the ethical development of neurotechnology, has just released a landmark report examining the privacy practices of consumer neurotechnology companies. The 100-page report launched just hours before Colorado Governor Jared Polis will sign the first neuroprotection bill in American history into law.
Neurotechnology refers to devices capable of recording or altering the activity of the nervous system, including the brain, spinal cord, and the peripheral nerves. Traditionally used within medical and research settings, neurotechnology devices are increasingly marketed to consumers. While this brings exciting promise of innovation and technological advancement, it also brings great risk given that consumer neurotechnologies are almost entirely unregulated. Unlike medical neurotechnology devices whose data is regulated as sensitive health data, consumer products operate without regulation, even though they use medical-grade technologies to access the exact same kinds of data.
Later today, Governor Polis will sign HB24-1058 into law, expanding the definition of “sensitive data” within the Colorado Privacy Act to encompass “biological data,” including neural data gathered from consumer neurotechnology devices. This will make Colorado the first place in the world to legally define and protect neural data as sensitive, and one of the only places in the world with hard law regulation of consumer neurotechnologies. The bill was authored by Rep. Cathy Kipp (Democrat) and co-sponsored by Rep. Matt Soper (Republican) in the Colorado House of Representatives. The House Judiciary Committee held a hearing on the bill, which it then adopted unanimously, and it passed the full House on a vote of 61-1. The bill was co-sponsored in the Colorado Senate by Senators Mark Baisley (Republican) and Kevin Priola (Democrat). The Senate Business, Labor, and Technology Committee held a hearing on the bill, which it also adopted unanimously, and it passed the full Senate unanimously as well.
The Office of Colorado Attorney General Philip J. Weiser testified in favor of the bill in both the House and Senate. The Colorado Medical Society provided expert professional validation prior to the legislative process and strategic resources throughout. The Neurorights Foundation is proud to have collaborated closely with the Government of Colorado on this historic effort, providing expert advice and testimony to the House and Senate, informed by the findings of this new report.
Just yesterday, California State Senator Josh Becker’s SB 1223 was discussed in a hearing of the Senate Judiciary Committee and then adopted on a vote of 11-0, putting California on the path to extending protections of the California Consumer Privacy Act to cover neural data.
Entitled Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies, the Neurorights Foundation's report presents an initial assessment of privacy practices in the consumer neurotechnology space, analyzing the privacy policies and user agreements of 30 neurotechnology companies with products that can be purchased online. It benchmarks data practices against half a dozen global data protection standards to compare the handling of neural data with established global standards for handling other types of sensitive and personally identifiable data. The report finds major deficiencies and large gaps between actual data practices and global standards.
Rafael Yuste, Chair of the Neurorights Foundation and Director of the Neurotechnology Center at Columbia University, commented “Neurotechnologies will provide an unprecedented understanding of the human brain, open up the possibility of not just diagnosing brain diseases but curing them, unlock extraordinary economic development, and even power a new wave of self-improvement for our species.”
Jared Genser, General Counsel to the Neurorights Foundation and Managing Director of Perseus Strategies, added: “To realize the potential of neurotechnologies, our brains, including our rights to protect our mental privacy, agency, and identity must also be protected and kept sacrosanct. While people may believe that abuses of neurotechnologies are limited to dystopian Hollywood futures envisioned by movies and TV shows like Minority Report, The Matrix, or Black Mirror, the risks are no longer science fiction but actual science.”
Stephen Damianos, Director of Technology and Human Rights at Perseus Strategies, added that the report is “A necessary and urgent contribution to public knowledge, consumer protection, and the ethical development of neurotechnologies.”
And Sean Pauzauskie, Medical Director of the Neurorights Foundation and a hospital neurologist in the University of Colorado system, noted that “Neurotechnologies will provide unprecedented promise for patients with the most disabling disorders in all of medicine, as well as those simply looking to improve their lives. Ensuring that only such promise is realized is of the utmost importance.”
The risk and urgency mentioned above result from the fact that neural data is capable of revealing enormously sensitive information, including information about mental health, physical health, and cognitive processing. In the coming years, the sensitivity of neural data will only deepen as investments from the private sector, governments, and other initiatives expand. This will result in improvements to the technical capabilities of neurotechnology, affording increased resolution of brain scans and larger datasets of brain data being collected, while generative artificial intelligence will accelerate the ability to accurately decode these scans. Meanwhile, implantable neurotechnologies can already accurately translate thought into text and decode emotions, and wearable devices are beginning to have some of these capabilities as well. Indeed, with the application of generative AI, early decoding of internal language and mental imagery has recently been achieved using non-invasive neurotechnology. These developments have significant implications for mental privacy, highlighting the pressing importance of understanding the privacy practices and user protections provided by consumer neurotechnology companies.
The report focuses on five thematic areas of concern in relation to consumer neurotechnology devices: Access to Information, Data Collection and Storage, Data Sharing, User Rights, and Data Safety and Security. Across each, significant deficiencies emerge, which is concerning given that 29 of the 30 companies appear to have access to the consumer’s neural data and provide no meaningful limitations to this access. Even more worrisome, a majority of the companies also authorize themselves to share the neural data with unspecified third parties, while the extent to which companies can or cannot sell data is unclear. The analysis reveals that consumers do not have adequate information about data practices, privacy, or their rights as users, and there is enormous ambiguity regarding whether companies consider neural data a form of personal data. Data collection and storage practices are similarly ambiguous, leaving consumers largely uninformed when it comes to information about data minimization and retention. The report further demonstrates that user rights, such as withdrawing consent to data processing and requesting data deletion, are not uniformly extended. Finally, the report finds that the data safety and security provisions of consumer neurotechnology companies are ill-equipped to safeguard neural data.
Taken together, these conclusions highlight substantial gaps between the privacy practices of consumer neurotechnology companies and global privacy standards. The purpose of this analysis is not to pass judgment on companies, but rather to help a wide range of stakeholders understand the kinds of further measures that are necessary to responsibly grow the consumer neurotechnology market. Ultimately, this will benefit not only companies and investors who are committed to the ethical development of neurotechnology, but also consumers.
As neurotechnology devices proliferate beyond medical settings outside the strict requirements for medical devices and health privacy, it is critical that consumers comprehend exactly how companies can use their neural data and what rights they have over that usage. Without this information, consumers cannot make meaningfully informed choices about their privacy.
Following the publication of this report, the Neurorights Foundation plans to develop a set of model policy documents that can provide a template for companies that want to adhere to global best practices.
For further information, please contact Jared Genser (jgenser@perseus-strategies.com) or Stephen Damianos (sdamianos@perseus-strategies.com).
###