Welcome to readin – the best world tech news chanel.

Colorado bill aims to protect consumers' brain data| GuyWhoKnowsThings


Consumers have become accustomed to the prospect of their personal data, such as email addresses, social contacts, browsing history and genetic ancestry, being collected and often resold by the apps and digital services they use.

With the advent of consumer neurotechnologies, the data being collected is becoming increasingly intimate. A headband serves as a personal meditation trainer by monitoring the user's brain activity. Another claims to help treat anxiety and symptoms of depression. Another reads and interprets brain signals. as the user scrolls through dating apps, presumably to provide better matches. (“'Listen to your heart' is not enough,” the manufacturer says on its website.)

The companies behind these technologies have access to records of users' brain activity: the electrical signals that underlie our thoughts, feelings and intentions.

On Wednesday, Governor Jared Polis of Colorado signed a bill that, for the first time in the United States, attempts to ensure that such data remains truly private. The new law, which passed 61-1 in the Colorado House and 34-0 in the Senate, expands the definition of “sensitive data” in the state's current personal privacy law to include biological data and ” “neural data” generated by the brain, spinal cord, and network of nerves that transmit messages throughout the body.

“Everything we are is in our minds,” said Jared Genser, general counsel and co-founder of the Neurorights Foundation, a scientific group that advocated for the bill's passage. “What we think and feel, and the ability to decode it from the human brain, could not be more intrusive or personal to us.”

“We are very excited to have a bill enacted that will protect people's biological and neurological data,” said Rep. Cathy Kipp, D-Colorado, who introduced the bill.

Sen. Mark Baisley, R-Colorado, who sponsored the bill in the upper chamber, said: “I feel great that Colorado is leading the way in addressing this issue and properly protecting people's uniqueness in their privacy. “I am very happy with this signing.”

The law targets brain technologies at the consumer level. Unlike sensitive patient data obtained from medical devices in clinical settings, which is protected by federal health law, the data surrounding consumer neurotechnologies is largely unregulated, Genser said. That loophole means companies can collect large amounts of highly sensitive brain data, sometimes for an unknown number of years, and share or sell the information to third parties.

Supporters of the bill expressed concern that neural data could be used to decode a person's thoughts and feelings or to learn sensitive data about an individual's mental health, such as whether someone has epilepsy.

“We've never seen anything with this power before: to identify, encode people and skew them based on their brain waves and other neural information,” said Sean Pauzauskie, a member of the board of directors of the Colorado Medical Society, who first brought attention to the subject to Mrs. Kipp. Mr. Pauzauskie was recently hired by the Neurorights Foundation as medical director.

The new law extends to biological and neural data the same protections granted under the Colorado Privacy Law to fingerprints, facial images and other sensitive biometric data.

Among other protections, consumers have the right to access, delete and correct their data, as well as opt out of selling or using the data for targeted advertising. Companies, in turn, face strict regulations on how they handle such data and must disclose the types of data they collect and their plans for it.

“People should be able to control where that information goes, that personally identifiable and maybe even personally predictive information,” Baisley said.

Experts say the neurotech industry is poised to expand as big tech companies like Meta, Apple and Snapchat get involved.

“It's moving quickly, but it's about to grow exponentially,” said Nita Farahany, a law and philosophy professor at Duke.

From 2019 to 2020, investments in neurotech companies increased about 60 percent globally, and in 2021 amounted to about $30 billion, according to a market analysis. The industry gained attention in January, when Elon Musk announced in X that for the first time a brain-computer interface manufactured by Neuralink, one of its companies, had been implanted in a person. Musk has since said that the patient had fully recovered and could now control a mouse solely with his thoughts and play chess online.

While disturbingly dystopian, some brain technologies have led to groundbreaking treatments. In 2022, a completely paralyzed man was able to communicate using a computer simply imagining his eyes moving. And last year, scientists were able translate the brain activity of a paralyzed woman and transmit her speech and facial expressions through an avatar on a computer screen.

“The things people can do with this technology are fantastic,” Kipp said. “But we just think there should be some guardrails for people who don't intend to have their thoughts read and their biological data used.”

That's already happening, according to a 100-page report released Wednesday by the Neurorights Foundation. The report analyzed 30 consumer neurotechnology companies to see how their privacy policies and user agreements squared with international privacy standards. It found that all but one of the companies restricted access to a person's neural data significantly and that nearly two-thirds could, under certain circumstances, share data with third parties. Two companies hinted that they had already sold this data.

“The need to protect neural data is not a problem of tomorrow, it is a problem of today,” said Genser, one of the report's authors.

Colorado's new bill won resounding bipartisan support but faced fierce outside opposition, Baisley said, especially from private universities.

Testifying before a Senate committee, John Seward, research compliance officer at the University of Denver, a private research university, noted that public universities were exempt from the Colorado Privacy Act of 2021. The new law makes Private institutions will be disadvantaged, Mr. Seward testified, because they will have limited capacity to train students who use “the tools of the trade of neural diagnostics and research” solely for research and teaching purposes.

“The playing field is not equal,” Seward testified.

Colorado's bill is the first of its kind to become law in the United States, but Minnesota and California are pushing similar legislation. On Tuesday, the California Senate Judiciary Committee unanimously approved a bill that defines neural data as “sensitive personal information.” Several countries, including Chile, Brazil, Spain, Mexico, and Uruguay, have already enshrined brain-related data protections in their state or national constitutions or have taken steps to do so.

“In the long term,” Genser said, “we would like to see global standards developed,” for example by expanding existing international human rights treaties to protect neural data.

In the United States, proponents of Colorado's new law hope it will set a precedent for other states and even generate momentum for federal legislation. But the law has limitations, experts said, and could apply only to consumer neurotechnology companies that collect neural data specifically to determine a person's identity, as the new law specifies. Most of these companies collect neural data for other reasons, such as to infer what a person might be thinking or feeling, Farahany said.

“You're not going to worry about this Colorado bill if you're one of those companies right now, because none of them use them for identification purposes,” he added.

But Genser said the Colorado Privacy Law protects any data that qualifies as personal. Since consumers must provide their names to purchase a product and agree to the company's privacy policies, this use falls under the category of personal data, he said.

“Given that consumer neural data was previously not protected at all under the Colorado Privacy Act,” Genser wrote in an email, “now having sensitive personal information labeled with protections equivalent to biometric data is a big step forward.” . “

In a parallel Colorado bill, the American Civil Liberties Union, and other human rights organizations are pushing for stricter policies around the collection, retention, storage, and use of all biometric data, whether for identification purposes or not. If the bill passes, its legal implications would apply to neural data.

Big tech companies played a role in shaping the new law, arguing that it was too broad and risked harming their ability to collect data not strictly related to brain activity.

TechNet, a policy network representing companies such as Apple, Meta and Open AI, successfully lobbied to include language that would focus the law on regulating brain data used to identify people. But the group failed to eliminate language governing data generated by “an individual's body or bodily functions.”

“We felt like this could encompass a number of things that all of our members do,” said Ruthie Barko, TechNet's executive director for Colorado and the central United States.


Share this article:
you may also like
Next magazine you need
most popular

what you need to know

in your inbox every morning