Your brain privacy is not guaranteed—for now
Colorado just took the first big step toward protecting your brain’s privacy.
The state passed legislation to keep neurotech companies from selling neural data. California and Minnesota are considering similar bills.
Neurorights are already enshrined in Chile. Latin America is leading the way in this area, with Mexico, Brazil, and Uruguay considering similar constitutional amendments.
Neurotech is having a moment—from the endless headlines about Elon Musk’s Neuralink to announcements about consumer-grade wearables, like a headband for period pain.
But privacy experts and ethicists are sounding the alarm: What’s happening with all the neural data these products collect?
Wait, since when is my brain not private?
Don’t worry, this isn’t Orwell’s 1984. You won’t be prosecuted for thoughtcrime anytime soon (as far as we know).
But we don’t blame you for perhaps having a visceral reaction to the idea of your brain not being entirely private. After all, our minds are one of the most intimate things about our existence as individuals.
In honoring that expectation of privacy, ethics researchers have begun investigating how and when consumer neurotech companies share your data—per their privacy policies.
Neurotechnology ethics nonprofit NeuroRights Foundation published a new report reporting their findings on the privacy practices and policies of consumer neurotechnology products. The findings suggest many of these companies can share and even sell neural data to third parties (beyond users’ providers).
Of course, these findings are only based on an initial evaluation of 30 consumer neurotechs, making them inherently limited and not necessarily generalizable. These companies were selected for the report because they have publicly-available products that can be purchased online. This means their privacy policy documents are easily accessible and benchmarked against global data protection standards.
However, that doesn’t keep the vagueness exhibited in this sample of privacy policies from being troubling to neurorights proponents.
The future of neurotech and neurorights
On one hand, data-sharing can be a solid business and care decision. Making data from consumer neurotech available to providers is a great way to increase the ways providers can do remote patient monitoring.
On the other hand, findings like these can erode trust in technology that has the potential to do a lot of good. Comparisons are already cropping up between consumer neurotech and the embattled data harvesting practices of 23andMe.
Legal guardrails for privacy practices will thus be good for users’ rights and for increasing trust in consumer neurotech. But individual states and countries passing legislation is likely not enough. Even the United Nations has begun expressing interest in this area of human rights in the past few years.
What would national or even global neurorights policy look like?
A group of neuroscience experts and ethicists called the Morningside Group (after Columbia University’s Morningside Heights campus) came up with a proposal in a Nature paper a few years ago, suggesting five neurotechnology human rights:
- Mental privacy
- Personal identity
- Free will
- Fair access to mental augmentation
- Protection from bias
Amending interpretations of existing human rights law to include these tenets of neuro-privacy on the international and local level is already happening. That’s the path that Colorado took—recognizing neural data as sensitive health data protected under the HIPAA privacy law.
As with medical AI, regulation of a new and buzzy technology is no easy feat. But with patients’ health and privacy at stake, there’s no more urgent task for ethicists and policymakers. We’re excited to see consumer neurotech continue to thrive as it has more solid privacy standards to rely on.