While discussions about data privacy tend to center around password logins, social security numbers, or bank information, thanks to advances in biotechnology, these conversations may soon include brain wave data.
On August 9, 2023, the Chilean Supreme Court (SCC) issued a unanimous ruling ordering U.S. biotechnology company Emotiv to delete all of the data it had collected about former senator Guido Girardi using its brain scanning device. The decision is the first to address any privacy rights around brain activity, a 2021 constitutional provision Girardi proposed, giving this type of data “enshrined rights.”
Chile is one of many Latin American countries that are now shifting to adding legislation that protects any data collection about brain activity, setting a precedent for the future of neurotechnology development.
The History of Girardi v. Emotiv
In 2022, Giardi purchased an Emotiv Insight, a brain-scanning device designed to collect brain data to interpret emotions and supposedly enact mental commands. However, Giardi quickly found that access to his brain data was locked behind a paywall, and he had to become a “Pro” member to see his results. Using a free license, Girardi found his brain data was stored without his access and potentially vulnerable to reidentification, hacking, or unauthorized reuse.
Shocked and angered, Giardi legally appealed for his data to be deleted from Emotiv’s storage systems, citing clear privacy concerns.
Girardi’s appeal was partially accepted by the Santiago Court of Appeals and subsequently escalated to the SCC. His demands included modifying Emotiv’s privacy policies, halting the sale of Insight in Chile until these modifications were made, and immediately deleting his brain data.
The SCC ruled in favor of deleting Girardi’s data and mandated that the Insight device undergo strict assessments by Chilean authorities before future commercialization.
“Scientific and technological development will be at the service of people and will be carried out with respect for life and physical and mental integrity,” read language that was added to section 19 of the Chilean constitution, which protects brain data. “ The law will regulate the requirements, conditions and restrictions for its use in people, having to protect especially the brain activity, as well as the information coming from it.”
Expanding Privacy Rights to Brain Activity
While many companies, from fitness apps to diet trackers to online telehealth businesses, collect personal user data, users often click “I agree” to the terms and conditions put out by these companies. Users may not realize what they agree to, as around 91% of people agree to terms and conditions without fully reading them. This can create serious issues for users as they may not realize their data is being shared with third parties without their consent.
Thankfully, most health apps within the U.S. are subject to the Health Insurance Portability and Accountability Act (HIPAA) laws, which protect core aspects of an individual’s health data from third parties. Health apps that handle private data must comply with HIPAA’s privacy and security regulations to be available to consumers.
That being said, there are always loopholes in the system, and often, people may not realize they’re giving others access to personal information that should remain private. While core components of an individual’s personal information (such as date of birth) often remain private, kept confidential by each app with access, these privacy regulations do not currently cover brain activity.
With the ruling of Girardi v. Emotiv, it could be that countries in North and South America may enact a new wave of privacy laws as concerns about data access and leakage continue.
Other Latin American Countries are Stepping Up
Later in August, after the Chilean lawsuit, the Mexican Chamber of Deputies proposed a new constitutional reform to enact laws securing mental privacy.
“The proposal establishes that the privacy and integrity of people, when it comes to mental activity, cannot be violated,” Arturo Sánchez, a Mexican engineer who helped write the proposed reform, recently said.
Legislators in Brazil have also been presented with a similar bill that would guarantee full transparency around the algorithms used to analyze and process brain activity.
Should either of these two potential bills pass, Mexico, Brazil, and Chile will set a world precedent in legally protecting data about an individual’s brain and its activity.
Kenna Hughes-Castleberry is the Science Communicator at JILA (a world-leading physics research institute) and a science writer at The Debrief. Follow and connect with her on X or contact her via email at kenna@thedebrief.org