Addressing Ethical Implications of Brain Data Privacy in Medical Devices for Neural Decoding

Ivette Rodriguez Nieves, Contributing Member 2024-2025
Intellectual Property and Computer Law Journal

I. Introduction

For decades, scientists have been researching how the brain works.[1] Within their research they have aimed to understand many of the brain’s illnesses, how to cure and mitigate them, the brain’s thinking process and the relationship of function with the human body.[2] However, some scientists have found that the brain can be manipulated in various ways and have grown fearful of how a person’s data may be used.[3] Some of these scientists have grouped together to request the legislature to enact laws that protect a person’s brain through privacy laws.[4] In September 2024, California amended the California Consumer Privacy Act of 2018 to include a section dedicated to the protection of mental privacy.[5] The mental activity included is defined as “neural activity.”[6] This means that companies–mostly neurotechnology businesses–are not allowed to sell or share a person’s data regarding their brain activity.[7] But why and how are companies using neural data?[8] Is there a growing ethical concern that is putting a person’s neural activity at risk?[9]

Part II will introduce the California Amendment, the neurotechnology industry, and Elon Musk’s Neuralink. Part III will discuss what the law will do and its implications for neurotechnology companies. Finally, Part IV will conclude by providing an opinion on future challenges.

II. Background

California Law

The California Consumer Privacy Act of 2018 (CCPA), as amended, applies to companies that operate for-profit and generate at least $25 million in gross income.[10] The CCPA grants consumers the right to limit the use of their sensitive personal information to which is necessary to perform the service.[11] Back in 2020, the law defined sensitive personal information as any processing of biometric information with the purpose of identifying a customer.[12] Now the definition includes neural data.[13] Neural data was defined to include only information that is generated by measuring the activity of a consumer’s central or peripheral nervous system and is not inferred from nonneural information.[14]

Neurotechnology and Brain-Computer Interfaces (BCI)

Neurotechnology is any technology created with the mission to understand how the brain works.[15] Mostly, it tries to understand mental and neurological illnesses and body movement.[16] These types of technologies include visualizing the process in which the brain operates, the control the brain has over the human body and repairing or improving its function.[17]

One of the main ways that neurotechnology is able to track all of this information is by recording the person’s neural activity data. It uses neural interfaces to read or write information into one of the body’s nervous systems.

BCIs are devices that create direct communication pathways between the brain and a computer.[18] These devices are surgically placed under the scalp or implanted within the brain tissue.[19] The aim of this technology is to be able to perceive what the brain is thinking and purporting to achieve within the specified activity, like talking, moving or seeing.[20]

Neuralink

In 2016, Elon Musk founded a neurotechnology company, named Neuralink, with the mission to create a general brain interface to restore autonomy to those with unmet medical needs today and unlock human potential tomorrow.[21] Currently the company’s focus is directed to persons with quadriplegia.[22] Quadriplegia is a paralysis affecting the control of the movement of a person’s body, specifically starting from the neck down and a symptom of a spinal cord injury.[23] With this medical device, Neuralink aims to provide people with these symptoms the ability to control their personal computers and devices with their thoughts.[24] It does so by a brain chip interface implanted within the skull.[25] Currently, Neuralink is in the Human Trial Phase and is currently recruiting participants to better understand the process and ensure its safety and effectiveness to legally be placed in the market as a medical device.[26]

III. Discussion

California is the second state to pass a law regarding neural data privacy.[27]The first state was Colorado, which passed its law back in April 2024.[28] These laws arise from the risk of losing privacy and freedom of thought.[29] Reports have come out that suggest that companies who have collected brain data may have sold this type of information.[30]

The concern doesn’t stop there.[31] Some people are concerned about the manipulation of the brain’s neural capacity.[32] Columbia University neuroscientist, Rafael Yuste, discovered he could manipulate the visual perception of mice by activating specific neurons in their brains.[33] Furthermore, his research demonstrated that the mice’s brains responded as if the images had actually happened or were real.[34]

Thus, this computerized technology is a double edged sword.[35] Many neuroscientists are advocating for a policy that would benefit citizens because they know the extent and capabilities these computers can be used for.[36] Moreover, they are concerned with how badly things can go if brain data is manipulated.[37] Some articles reference George Orwell’s novel, 1984, citing the fear of living in a dystopian world.[38] While others highlight the precious private thoughts, ideas and freedom the brain can hold.[39]

These articles also suggest there is a right to cognitive liberty, mental privacy, integrity and psychological continuity.[40] First, cognitive liberty refers to the refusal to participate in neurotechnology programs and treatment.[41] It emphasizes that a person should not be obliged to participate in BCIs and can freely decline without facing any type of reprimand.[42] Second, mental privacy is more directed at what the recent legislatures have implemented into state law.[43] It concerns whether a person is in complete agreement of sharing its personal data publicly.[44] Third, mental integrity is linked to not being reprimanded by BCIs.[45] Fourth, psychological continuity means being protected against the psyche’s conduct being abysmally altered.[46] This can occur by being subliminally subjected to certain preferences thus changing or diverting your psyche.[47]

Nolan Arbaugh was the first to receive Neuralink’s brain-computer.[48] Nolan had an accident on a lake that left him quadriplegic.[49] Currently, with the help of the computer implanted into his brain, he has been able to play online chess by using his mind to effectively control the website’s cursor.[50] Additionally he has been learning languages, writing, and reading.[51] Because of this technology, Nolan has been able to regain some freedom in doing everyday tasks. Although Nolan expresses the various benefits he has experienced, a vital consideration is that the risk of harmful use of these devices exists, thus the need for laws to cover these risks is exponential.[52]

Right now, there is no indication of any other states–other than Minnesota–that are looking to incorporate legal protection for brain data. Having states enact or amend laws to include protection of privacy is the first step. The goal of neuroscientists and other interested parties is to have a federal law enacted to protect such brain data.[53] One factor that brings hope to neuroscientists and interested parties is that California is one of Big Tech’s hub for development.[54] This factor might be significant in how other states react in adopting a similar view towards brain data privacy by wanting to follow up on how a leading tech state addresses novel issues.

IV. Conclusion

Like any computer, BCIs could be prone to hacking. What would happen next? Well, its inconclusive to say. However, there is a high probability some hackers may try to implant a fake memory or altered reality that could severely harm the person with the BCI. Additionally, there is more concern with companies using brain data for their personal use. While it is great that people who lost or never possessed the ability to control certain body parts have a potential new medical device, there is still room for misuse. Particularly with Neuralink, it raises concern to the amount of data the company and BCI has access to. If the BCI has 100% access to a person’s thoughts who knows what ideas they might uncover and use for personal gain.

As previously discussed, the end goal is to have a federal law that covers neural data and its implications regarding use be enacted. Having this type of legal protection federally would provide more specificity and allow for a nationwide standard of regulation. Thus, the law would not only protect the data, but it would also regulate it. For example, one of the regulations could be to implement a procedure that allows for the system to de-identify personal data through a data processor. Additionally, another benefit to the companies would be providing a guideline on rules and procedures they must follow to ensure data safety. This way, companies will be enabled to address specific issues such as data hacking, biometrics and effectiveness.

For now, however, it is unclear which way the legal landscape will be heading with only two states addressing this issue to date. But as time progresses, it will be more likely that states will adopt their own measures to ensure the privacy of neural data. It also remains unseen how courts will rule in these types of cases since there have not been any cases brought in the United States yet.

[1] Mathew Hutson, California Protects Brain Data, but the Law Doesn’t Go Far Enough, MIT Tech. Rev. (Oct. 4, 2024), https://www.technologyreview.com/2024/10/04/1104972/law-california-protects-brain-data-doesnt-go-far-enough/ [https://perma.cc/7CYK-L3Z8].

[2] Id.

[3] Sigal Samuel, Your brain’s privacy is at risk. The US just took its first bug step toward protecting it., Vox, (Apr. 18, 2024), https://www.vox.com/future-perfect/24078512/brain-tech-privacy-rights-neurorights-colorado-yuste [https://perma.cc/9ZRE-MCXP].

[4] Hutson, supra note 1.

[5] Id.

[6] S.B. 1223, 2023-2024 Reg. Sess. (Cal. 2023).

[7] Hutson, supra note 1.

[8] Id.

[9] Id.

[10] Isha Marathe, California Becomes 2^nd State to Give Brain Waves Data Privacy Protections, With mixed Reaction, ALM|Law (Oct. 1, 2024), https://www.law.com/legaltechnews/2024/10/01/california-becomes-2nd-state-to-give-brain-waves-data-privacy-protections-with-mixed-reaction/ [https://perma.cc/D7GQ-89DN].

[11] S.B. 1223, 2023-2024 Reg. Sess. (Cal. 2023).

[12] Id.

[13] Id

[14] Id.

[15] Id.

[16] Neurotechnology, how to reveal the secrets of the human brain?, Iberdrola, https://www.iberdrola.com/innovation/neurotechnology#:~:text=WHAT%20IS%20NEUROTECHNOLOGY,repair%20or%20improve%20its%20functions [https://perma.cc/H9NH-PQ3W].

[17] Samuel, supra note 3.

[18] Brooke Becher, Brain Computer Interfaces (BCI), Explained, BuiltIn, (Jul. 24, 2024), https://builtin.com/hardware/brain-computer-interface-bci [https://perma.cc/XZH4-WAF5].

[19] Id.

[20] Neurotechnologies: The Next technology Frontier, Ieee, https://brain.ieee.org/topics/neurotechnologies-the-next-technology-frontier/ [https://perma.cc/J2RN-QPB4].

[21] Our Mission, Neuralink,https://neuralink.com/#mission [https://perma.cc/5TXY-9PAX].

[22] Id.

[23] Spinal Cord Injury, Mayo Clinic, https://www.mayoclinic.org/diseases-conditions/spinal-cord-injury/symptoms-causes/syc-20377890 [https://perma.cc/AQS4-LQJX].

[24] Our Mission, supra note 21.

[25] Musk’s neuralink gets FDA breakthrough device tag for “Blindsight” implant, Reuters,(Sept. 18, 2024),https://www.reuters.com/business/healthcare-pharmaceuticals/musks-neuralink-receives-fdas-breakthrough-device-tag-brain-implant-2024-09-17/ [https://perma.cc/UNP7-79ZE].

[26] Neuralink’s First-in-Human Clinical Trial is open for Recruitment, Neuralink, (Sept. 19, 2023)https://neuralink.com/blog/first-clinical-trial-open-for-recruitment/ [https://perma.cc/VK69-UHVQ].

[27] Marathe, supra note 10.

[28] Id.

[29] Sigal Samuel, Your brain may not be private much longer, Vox, (Mar. 17, 2023), https://www.vox.com/future-perfect/2023/3/17/23638325/neurotechnology-ethics-neurofeedback-brain-stimulation-nita-farahany [https://perma.cc/RHZ5-QMAW].

[30] Samuel, supra note 3.

[31] Id.

[32] Id.

[33] Id.

[34] Id.

[35] Samuel, supra note 29.

[36] Id.

[37] Id.

[38] Id.