Inside the Mind's Eye: An International Perspective on Data Privacy Law in the Age of Brain-Machine Interfaces

Abstract

Brain machine interface (BMI) technologies extract brain activity and translate that activity into commands that control external devices. BMIs have been used by patients with physical disabilities to allow for thought-controlled use of computers, prosthetic limbs, and robotic arms. In the commercial context, recreational BMIs are joining the "internet of things" through applications in video gaming and beyond. BMI systems collect and interpret large amounts of data obtained directly from the brain. This "brain data' contains highly intimate information about individual level intentions, cognition, and states of health and disease. Public and private sector entities will have access and control over brain data, raising concerns over personal data privacy and protection. This paper examines personal data privacy regimes in relation to brain data across three jurisdictions: Canada, the United States, and the European Union. In relation to the governance of personal data in the private sector, the United States adopts a self-regulatory mechanism, while the European Union assumes a rights-based approach, with Canada's position being intermediate to the two extremes. All three jurisdictions seem to fall short when considering brain data privacy. The narrow coverage of the United States privacy legislation will exclude most brain data, while aspects of the EU's rights-based framework will overcompensate and hamper fruitful implementations of BMI technology. Canada's middle-ground approach seems to leave certain gaps in protection for brain data. Pertaining to government agencies, all three jurisdictions set a low threshold, providing for unfettered governmental access in the name of law enforcement and national security interests. The paper concludes with policy recommendations that recognize the need for stronger personal data privacy protection in the age of BMIs, while balancing the need to foster continued innovation in the BMI technology space. Note: In press at: Albany Law Journal of Science and Technology.

Keywords: Data Privacy, Privacy Law, Brain-Machine Interface, Brain-Computer Interface, Neural Implants, International Law, Canada, United States, Europe, Canadian Law, American Law, European Law, Informational Privacy, Personal Information, Health, Brain Data, Internet of Things, PIPEDA, GDPR HIPAA, HITECH