EDPS and AEPD Insights into Challenges of Neurodata Processing for Privacy and Data Protection

On 27 June 2024, the Spanish Data Protection Agency (AEPD) and the European Data Protection Supervisor (EDPS) released a joint report analyzing the challenges of neurodata processing for fundamental rights and freedoms. Neurodata, defined as information gathered from the brain and nervous system, includes data related to brain activity, structure, function, and other neural signals. This report offers an in-depth examination of neurodata, evaluating its impact on privacy and personal data protection and discussing various practical use cases.

Neurodata and Its Applications

Recent advances in neurotechnology have led to numerous devices that monitor brain activity for various purposes, including medical treatment, marketing, education, and entertainment. Neurodata can be collected invasively, requiring surgical implantation, or non-invasively through external interfaces like headbands. The collection methods can be passive, not requiring explicit actions, or active, involving specific tasks.

Risks to Fundamental Rights

The report underscores the significant risks neurodata poses to fundamental rights, particularly privacy, mental integrity, and human dignity. It provides examples of how neurodata processing in education, gaming, and other sectors can lead to intrusive and potentially unlawful practices under EU law. The combination of neurodata with artificial intelligence (AI) amplifies these risks, enabling detailed insights into individuals’ thoughts and emotions.

Data Protection Principles

Neurodata often falls under special categories of personal data, such as biometric or health data, which require stringent protection measures. The report highlights the importance of proportionality, data minimization, accuracy, transparency, and fairness in neurodata processing. Controllers must ensure that the purpose justifies the invasive nature of neurodata processing and comply with all relevant data protection principles.

Neurorights

The concept of neurorights, proposed to address emerging issues in neurotechnology, includes rights such as cognitive liberty, mental privacy, mental integrity, psychological continuity, and fair access. The report suggests that existing human rights frameworks may not suffice to protect individuals against the unique challenges posed by neurodata.

Recommendations

The report concludes with recommendations for regulators and organizations processing neurodata. It emphasizes the need for comprehensive impact assessments, robust safeguards, and consideration of neurorights to ensure the ethical and lawful use of neurotechnology. Additionally, it calls for increased awareness and regulation to prevent misuse and protect individuals’ fundamental rights.

👉 Find the  document here.