Nomadsoul1 | Istock | Getty Images
The question “What is a thought?” it is no longer strictly philosophical. Like anything else measurable, our thoughts are subject to increasingly technical responses, with data captured by brainwave tracking. This discovery also means that data is commoditizable, and captured brain data is already being bought and sold by companies in the wearable technology space, with little protection for users.
In response, Colorado recently passed a first-in-the-nation privacy act aimed at protecting these rights. The act falls under the existing “Colorado Consumer Protection Act,” which aims to protect “the privacy of individuals’ personal data by placing certain requirements on entities that process personal data. [and] includes additional protections for sensitive data.”
Key language in the Colorado act is the expansion of the term “sensitive data” to include “biological data”—including multiple biological, genetic, biochemical, physiological, and neural properties.
Elon Musk’s Neuralink is the most famous example of how technology is getting to grips with the human mind, though it’s not alone in the space, with Paradromics emerging as a close competitor, along with devices that have restored speech to victims of stroke and have helped amputees to move. prosthetic limbs with minds of their own. All of these products are medical devices that require implantation and are protected under the strict privacy requirements of HIPAA. Colorado’s law is focused on the rapidly growing field of consumer technology, and devices that do not require medical procedures, have no analog protections, and can be purchased and used without any medical supervision.
There are dozens of companies making products that are wearable technologies that capture brain waves (aka neural data). On Amazon alone, there are pages of products, from sleep masks designed to optimize deep sleep or promote lucid dreaming, to headbands that promise to promote focus and biofeedback headphones that will take your meditation session to another level. These products, by design and necessity, capture neural data through the use of tiny electrodes that produce readings of brain activity, with some delivering electrical impulses to influence brain activity.
The laws in place to handle all that brain data are virtually non-existent.
“We’ve entered the world of science fiction here,” said Colorado bill lead sponsor Representative Cathy Kipp. “As with any advancement in science, there must be guardrails.”
‘ChatGPT-moment’ for consumer brain technology
A recent study by the NeuroRights Foundation found that of the thirty companies examined that are producing wearable technology capable of capturing brain waves, twenty-nine “provide no meaningful restrictions on this access.”
“This revolution in consumer neurotechnology is focused on increasing the ability to capture and interpret brain waves,” said Dr. Sean Pauzauskie, medical director at the NeuroRights Foundation. Devices that use electroencephalography, a technology readily available to consumers, is “a multibillion-dollar market that’s going to double over the next five or so years,” he said. “Over the next two to five years it’s not implausible that neurotechnology could see a ChatGPT moment.”
How much data can be collected depends on several factors, but technology is advancing rapidly and could lead to an exponential increase in applications, with technology increasingly incorporating AI. Apple has already filed patents for the brain-sensing AirPods.
“Brain data is too important to be left unregulated. It reflects the inner workings of our mind,” said Rafael Yusuf, professor of biological sciences and director, NeuroTechnology Center, Columbia University, and chairman of the NeuroRights Foundation. and a leading figure in the ethics organization neutotech Morningside Group. “The brain is not just another organ of the body,” he added. “We need to engage private actors to ensure they adopt a responsible innovation framework, as the brain is the home of our minds.”
Pauzauskie said the value for companies comes in interpreting or decoding brain signals collected by wearable technologies. As a hypothetical example, he said, “if you were wearing headphones with brain sensors, not only would Nike know that you searched for running shoes from your browsing history, but now it could know how engaged you were while browsing.” .
A wave of bio-privacy legislation may be needed
The concern targeted by the Colorado law could lead to a wave of similar legislation, with increased attention to the mix of rapidly advancing technologies and the commodification of user data. In the past, consumer rights and protection have lagged behind innovation.
“The best and most recent technology/privacy analogies might be the Internet and the consumer genetic revolutions, which largely went unchecked,” Pauzauskie said.
A similar arc may follow unchecked advances in the collection and commodification of consumer brain data. Hacking, corporate profit motives, ever-changing privacy agreements for users and narrow or no laws covering data are all major risks, Pauzauskie said. Under the Colorado Privacy Act, brain data is extended the same privacy rights as fingerprints.
According to Professor Farinaz Koushanfar and Associate Professor Duygu Kuzum of the Department of Electrical and Computer Engineering at UC San Diego, it is still too early to understand the limitations of the technology as well as the depths of potentially intrusive data collection.
Tracking neural data could mean tracking a wide range of cognitive processes and functions, including thoughts, intentions and memories, they wrote in an emailed joint statement. At one extreme, neural data tracking could mean direct access to medical information.
The wide range of possibilities is in itself a problem. “There are still many unknowns in this field and this is worrying”, they wrote.
If these laws become widespread, companies may have no choice but to revise their current organizational structure, according to Koushanfar and Kuzum. There may be a need for the creation of new compliance officers and the implementation of methods such as risk assessment, third-party auditing and anonymization as mechanisms for establishing requirements for the entities involved.
On the consumer side, the Colorado law and any subsequent efforts represent important steps toward better educating users, as well as giving them the tools they need to control and exercise their rights if they are violated.
“Privacy Law [in Colorado] “Regarding neurotechnology may be a rare exception, where rights and regulations preempt any widespread misuse or abuse of consumer data,” Pauzauskie said.