How ‘Neural Data’ May Shape an Evolving Data Privacy Landscape

Neural data, which involves brainwaves tracked by devices and data from the nervous system, may be a new hot topic for privacy regulation. The American Medical Association recently backed strict protections for neural data and recommends laws to safeguard its privacy and security while opposing overly broad definitions. Some states like Colorado and California have passed laws that align with these principles. Despite this, some privacy practitioners are divided on the topic. Finnegan partner and leader of the privacy practice Lynn Parker Dupree spoke with The AmLaw Litigation Daily and provided her optimistic viewpoint.

Litigation Daily: What existing state laws around neural privacy are on the books? How and when did this legislation start taking shape, and what put neural data on lawmakers' radar? 

Lynn: All of them define neural data slightly differently. So, for example, you might see the definition of neural data include any information generated by measuring the activity of a consumer's central or peripheral nervous system and specifically excluding non-neural information.

What California does is define neural data as sensitive data and give it those protections only when it's being used for the purposes of inferring characteristics about someone. But Connecticut takes a different approach, where the definition of sensitive data also includes neural data, but neural data is going to be defined by information that's generated from the activity of an individual's central nervous system only, and it does not include the peripheral nervous system.

California did it by amending the definition of sensitive data to include neural data, and then defining what neural data means. And all the states have taken that approach, where they have amended an existing law. What Montana modified was their state Genetic Information Privacy Act, but–much in the same way–amended the law to include neural data and then defined it. So no laws specifically have been drafted that are standalone neural data laws. The states are taking the approach of finding an existing law and then modifying it to include the term so it'll be covered in the broader protections.

Litigation Daily: What are the potential risks associated with neural data exposure?

Lynn: I think the people who are at most risk from neural data exposure are those who provide their neural data outside of health and clinical settings. So when you go to a hospital or to an established healthcare provider, HIPAA laws govern those entities. And HIPAA applies in the protection of data in those contexts. But when you are using some kind of medical device provider outside of the healthcare context, before these laws, there were virtually little to no protections.

I don’t mean to say that because HIPAA exists that there are no risks, but what I'm saying is that under HIPAA, individuals have to be given informed consent about the fact that their data is going to be collected and the purposes that it's going to be used for. So there's already a framework for governing the notice to individuals about their data collection and what it might be used for currently in the consumer context, where you're not in a healthcare environment, prior to those laws. There was no real affirmative duty to do those things. And now these laws are helping bridge that gap and make sure that the same perceptions that exist in the HIPAA context would also exist in the consumer context.

And I think lawmakers have recognized that we have a gap. Forty years ago, we would have never imagined that you could do advanced genetic testing or advanced neurological data collection at your home. And now that is a reality. And I think because those laws were written for specific settings, lawmakers are using these amendments to close that gap and protect the data, no matter where it's collected.

And I think another thing that we also recognize is that while you might be able to collect and use neural data for specific purposes today with the advancement of technology, who knows what may be possible with neural data. I think we've already seen examples of mapping brainwaves to recreate a song. Maybe you can, in the future, map brainwaves and uncover thoughts. Obviously, that's the future, and we never know. But I think these laws take the proactive step of saying, “This could unlock very intimate data about individuals. And so we need to take those proactive steps to protect people.”

Litigation Daily: Do you expect more states to jump on the bandwagon of codifying neural data protections?

Lynn: I do expect more states to implement similar laws. I think we can draw from the pattern we saw with state privacy laws where states watched the leading implementers of privacy laws and then learned from what worked well and what didn't work well. And we've already even seen that in states like Montana that watched what happened in California and Colorado, and made some tweaks and some adjustments based on what they saw in the initial implementation. And so I think what we'll see is more states watching how these amendments go, watching how they're enforced. And then over time, we'll see more states engage in amendments because, as I said, I think there's an understanding that, obviously, technology can outpace the law, but there is a responsibility to try to keep up with it.

Litigation Daily: Why is this issue important now? 

Lynn: We have seen the advent of new technologies that are really able to harness the power of neural data. I mean, even the American Medical Association has made statements about the importance of protecting neural data. And I think it's just the natural and next step with the advancement of analytic technologies, artificial intelligence and the way that these technologies are able to recognize patterns, including patterns in neural data.

Litigation Daily: Is there any possibility of regulation at the federal level, given–for example–the Trump administration's deregulatory stance on tech, particularly AI?

Lynn: I also would expect that the bulk of the work would happen at the state level and don't foresee any regulation at the federal level. Similarly, with privacy, while there have been, I think, many attempts at a federal privacy law, none of those attempts have been successful to date. And in the absence of a federal privacy law, many states have acted. I think that we can expect to see that same trend continue for neural data.

I think privacy laws at the federal level have stalled out for two reasons. One, preemption, and two, private right of action. And certainly, I don't think the deregulatory position creates a more welcoming environment for a federal privacy law, but I think that those two issues have existed across administrations.

Litigation Daily: How could this issue power the next wave of plaintiffs' litigation?

Lynn: I imagine that plaintiff's attorneys will be paying a lot of attention to how neural data is used and whether or not companies are providing the proper notice. It relates to sensitive data and the ability to limit that use of data in certain circumstances. So I think we'll have to see, because the laws and the rules vary state by state, what types of activities trigger attention in a particular jurisdiction.

Certainly, it could be monetized and I think it will be monetized. I think some of the risks include, again, having neural data provide insights into personal things about an individual that they necessarily don't mean to disclose. Again, what can you infer from neural data? Can you infer overall health status? Can you infer thoughts, emotions, feelings–whether or not that's possible today, could it be possible in the future? And how might that be used in relationship to an individual? So I think those are the kinds of risks, because your neural data is very much foundational to who you are.

Read “How ‘Neural Data’ May Shape an Evolving Data Privacy Landscape”