Amendments to the LGPD has been introduced in the Brazil Chamber of Deputies to conceptualise neural data and regulate its protection. If passed, it will go into effect on the date of its publication.
Neural data would be added to the list of data that is currently protected as “sensitive personal data”. You can see more about sensitive data in privacy laws here. The LGPD currently lists sensitive data as the following:
- Racial and ethnic origin
- Religious conviction
- Political opinion
- Membership of a trade union or of a religious, philosophical or political organization
- Data concerning health or sex life
- Genetic data
- Biometric data
What is Neural Data?
Neural data is information obtained directly or indirectly from the activity of the central nervous system and accessed by brain-computer interfaces, or any other technology, invasive or not. A brain-computer interface is a system, electronic, optical, or magnetic, which collects information from the central nervous system and transmits it to a computer. Alternatively, it can be to replace, restore, supplement, or enhance the activity of the central nervous system in its interactions with its internal or external environment.
Over the last few years, we have seen a rise in non-pharmacological devices which enable a direct or indirect connection with the nervous system. These devices and methods have been called neurotechnology. With the advancement of non-invasive neurotechnologies there have been calls for a stricter regulatory foundation for these methods. Abel Wajnerman Paz says, “Philosophy could contribute to building an ethical relationship with them before they become an integral part of our societies, when substantial amendments will be plausibly difficult to implement.”
Neural Data and LGPD
The amendments to LGPD propose protections for neural data including for scientific and research purposes. Processing of neural data will only occur when the data subject, or their legal guardian, consents. Even in clinical circumstances or cases where the interface has the capacity to process data with an unconscious data subject.
Any neural data obtained without the data subject’s consent can only be used for:
- Studies carried out by research organizations, with guaranteed anonymization of sensitive personal data
- Protection of the life or physical safety of the data subject or a third party
- Health protection, exclusively in a procedure carried out by health professionals, health services or health authorities.
When requesting consent for these processes the following must be indicated:
- Possible physical, cognitive, and emotional effects of its application
- The contraindications as well as the norms on privacy and the information security measures adopted.
There will be prohibitions on the use of any brain-computer interface or method which may cause damage to the individual identity of the data subject and harm the data subject’s autonomy or psychological integrity. Also, communication or shared use between controllers of neural data, with the aim of obtaining economic advantage.
