Legislation Regulating Brain-Wave Monitoring May Become Trend

Data privacy, long a focus of state lawmakers across the country, is poised to enter a new space: your brain.

Elon Musk has been making headlines for years now with his company Neuralink, which seeks to someday combine human consciousness with artificial intelligence but in the meantime is looking into implanting computer chips into human brains to treat neurological disorders like Parkinson’s.

This technology, invasive by nature, is protected under strict privacy provisions within the Health Insurance Portability and Accountability Act or HIPPA.

But brain-wave monitoring isn’t limited to just implanted devices anymore.

An April 2024 study by The NeuroRights Foundation, a nonprofit organization dedicated to protecting people from the misuse of consumer neurotechnology devices, found that there are at least 30 products capable of recording or altering your nervous system currently available to consumers, and many of those devices are wearable.

The NRF also found that “29 of the 30 companies (96.67%)” that make these neurotechnology devices “appear to have access to the consumer’s neural data and provide no meaningful limitations to this access.”

In other words, you can now purchase a Fitbit-like device that could give someone access to your biological and neural data, allowing them to literally read your mind.

In August, CNBC predicted “A wave of biological privacy laws may be coming” to protect this new form of personal data.

Colorado First State to Pass Bill Protecting Neural Data

Colorado may have started that trend this year by passing a first-of-its-kind bill expanding the Colorado Privacy Act to include biological and neural data.

HB 1058, sponsored by two pairs of Republicans and Democrats, Reps. Cathy Kipp (D) and Matt Soper (R) and Sens. Mark Baisley (R) and Kevin Priola (D), was signed by Colorado’s Democratic governor, Jared Polis, in mid-April.

“It is a very forward-looking bill,” lawyer Zoe Argento, a shareholder and co-chair of Littler Mendelson’s Privacy and Data Security Practice Group, told Law Week Colorado. “Though I think we’ll see more along these lines, Colorado is being very cutting-edge here in passing this legislation.”

California lawmakers also passed a pair of bills that would include neural data under the California Consumer Privacy Act’s definition of "sensitive personal information," sending the bills on to Gov. Gavin Newsom (D) for consideration. The measures are AB 1008, introduced in 2023 by Rebecca Bauer-Kahan (D), and SB 1223, introduced by Sen. Josh Becker (D) this year.

“The neurotechnology industry has exploded globally over the last several years, and regulations need to continue to keep pace so that consumers have necessary protections that prevent the misuse of their sensitive personal information,” Becker said in a May press release about his bill.

Start of ‘Neural Data’ Privacy Legislative Trend?

Two states have introduced legislation this year that would expand their consumer data privacy laws to cover “neural data,” which they define as information generated by measuring the activity of someone’s central or peripheral nervous system. One of those states, Colorado, enacted its measure (HB 1058). The other state, California, has passed a pair of measures (AB 1008 and SB 1223), sending them to Gov. Gavin Newsom (D) for consideration.

More Neural Data Bills Could Come as Neurotechnology Grows

The Colorado and California bills are the only ones referring to “neural data” currently in State Net’s legislative tracking database. But a trio of lawyers writing for the New York Law Journal in May predicted that more proposals would be on the way.

The attorneys, Frances Green, Paul DeMuro and Eleanor Chung, of the national law firm Epstein Becker Green specifically predicted that new legislation would be introduced in Minnesota, where a bill (HB 1904) that would have protected brain data was introduced last year but which failed.

“Minnesota, which could have been a trailblazer in 2023, will undoubtedly revisit the topic in the future,” the attorneys wrote. “While such protections are novel in the United States, Chile amended its constitution in 2021, declaring that the law shall ‘especially protect brain activity, as well as the information from it.’ According to the Future of Privacy Forum, Mexico seeks to follow Chile’s lead, and Brazil may not be far behind.”

With other countries taking notice of this burgeoning technology and seeing a need to regulate it, you can bet state lawmakers here will come to a similar conclusion as well.

Famed filmmaker Werner Herzog released a documentary in 2022 called Theatre of Thought in which he explored the ethical implications of neurotechnology with neurobiologist Rafael Yuste.

In a September 2022 review of the film in The Hollywood Reporter, critic Sheri Linden wrote that Theatre of Thought reveals that “When computers can extract information directly from the brain or feed commands straight into it, privacy, autonomy and the very sense of self are at stake.”

When you put it that way, CNBC’s prediction of a wave of legislation regulating this technology seems inevitable.

—By SNCJ Correspondent BRIAN JOSEPH

Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.