Why it matters: California has taken a significant stride in protecting consumer privacy by expanding the California Consumer Privacy Act (CCPA) to include neural data as sensitive personal information. This move aims to safeguard individuals’ most intimate information – their brain activity – in an era of rapidly advancing neurotechnology.
A win for consumer rights: The new law, signed by Governor Gavin Newsom on September 28, 2024, grants Californians unprecedented control over their neural data.
- Consumers can now request to know what neural data is collected, delete it, correct it, and limit its collection, according to NYT.
- Companies are prohibited from selling or sharing neural data without consent.
Senator Josh Becker, who championed the bill, emphasized its importance: “I’m very excited,” said Sen. Josh Becker. “It’s important that we be upfront about protecting the privacy of neural data — a very important set of data that belongs to people.”
Filling a regulatory gap: Unlike medical devices, consumer neurotechnology products were largely unregulated before this law.
- The legislation extends CCPA protections to data generated by both central and peripheral nervous systems, according to Govtech.
- This addresses concerns about the increasing capabilities of consumer brain-computer interfaces and similar technologies.
Industry impact and concerns: The law affects both startups and tech giants developing brain-data collection devices.
- TechNet, representing companies like Meta and Apple, initially raised concerns about the broad scope of the bill.
- The final draft clarified that information inferred from non-neural data would not be covered, addressing some industry worries.
Privacy experts applaud, but call for more: While many see the law as a crucial step forward, some argue it doesn’t go far enough. Heise points out that it is rather vague.
- Marcello Ienca, an ethicist at the Technical University of Munich, noted: “While it introduces important safeguards, significant ambiguities leave room for loopholes that could undermine privacy protections, especially regarding inferences from neural data.”
The challenge of defining “neural data”: The law’s definition of neural data as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information” has sparked debate.
- Critics argue this definition may not adequately protect against inferences drawn from raw neural data.
- There are calls to regulate the algorithms that drive these inferences, not just the data collection itself.
Looking ahead: California’s law sets a precedent that could influence national and international legislation on mental privacy.
- The Neurorights Foundation is already engaging with lawmakers in other states to enact similar protections.
- As neurotechnology advances, the need for comprehensive, clear legislation becomes increasingly urgent.
While California’s new law represents a significant victory for consumer privacy rights, it also highlights the complex challenges of regulating emerging technologies. As neurotechnology continues to evolve, legislators, industry leaders, and privacy advocates must work together to ensure that our most personal data – our thoughts and emotions – remain protected in the digital age.
