TechDispatch #1/2024 - Neurodata

PDF version available at the bottom of the page.

Neurodata

1. What are neurodata?

The brain, together with the spinal cord, constitute the central nervous system, which plays a crucial role in regulating and coordinating various bodily functions including human cognitive capabilities. The intricate and peculiar activity of the brain has always been a field of study considered particularly interesting.

Throughout the years, several different techniques have been proposed to interpret, or interact with, the functions of the human brain.

Brain imaging techniques were originally developed, and still mostly applied, in the context of clinical medicine and neuroscientific research. Transcranial Magnetic Stimulation (TMS) has proved effective for migraine treatment[1], Deep Brain Stimulation (DBS) is increasingly used as a treatment for essential tremor, Parkinson’s disease, dystonia, and obsessive-compulsive disorder and the most recent Brain Computer Interfaces (BCIs) are able to restore senses such as sight[2] or hearing[3].

However, in recent years, there is a worrying trend towards a technically possible, though ethically and legally questionable use of some neurotechnologies within a constantly evolving market of services. For example, several multinational companies use neuromarketing research services to measure human brain reaction to ads or products. In addition, a number of neuromarketing companies apply neuroimaging techniques to study, analyse and predict consumer behaviour[4]^,[5]. Neurotechnologies[1] have also been used in portable devices for a number of daily activities including education, gaming and entertainment (e.g. wireless helmets connected to smartphones and personal computers)[6]. The use of artificial intelligence (‘AI’) systems may also make technically possible exploitation of neurodata for purposes such as law enforcement, screening of migrants and asylum seekers, as well as by private entities for instance for workplace or commercial surveillance. In this context, it is important to underline that that certain uses of neurodata pose unacceptable risks to fundamental rights and are likely unlawful under EU law. Section 3 of this TechDispach will highlight a number of the risks at stake.

There are many research initiatives around the world that demonstrate the growing interest in the potential of neurotechnology. In the US, the so-called BRAIN Initiative[2], a partnership with the common goal of accelerating the development of innovative neurotechnologies, is driving the Brain Activity Map Project (MAP Project)[7]. The MAP Project researches the dynamic interrelationships of specific cell types or brain regions with a focus on circuits and their dysfunction which is the basis of symptoms and disability in many neurological, mental and substance use disorders. In Asia, the China Brain Project[8] aims at researching the properties of individual nerve cells and how they communicate at synapses to produce cognitive functions such as awareness, information management, memory and reasoning, improving the diagnosis and preventing brain diseases and driving brain-inspired information technology and artificial intelligence projects prioritising brain-inspired AI over other approaches. In Europe, the Human Brain Project (HBP)[9] is a European Union founded project to synthetically reproduce human brain abilities and advance research in the field of medicine and neuroscience. To this end, the project is building EBRAINS, a research infrastructure that will provide open access to advanced digital tools, datasets and services to facilitate brain research.

Definitions and basic concepts

Neurotechnology has been defined in 2007 in the Nature Biotechnology journal as "any development that allows to monitor or modify brain function”[10]. Later in 2019 the OECD resumed this definition by identifying as neurotechnologies all “devices and procedures that are used to access, investigate, assess, manipulate, and emulate the structure and function of neural systems”[11]. The field of neurotechnology can be divided into different subfields depending on the construction and the interaction with the nervous system.

From a construction point of view, neurotechnologies can be;

• Non-invasive. This subfield encompasses technologies where human-brain interfaces are placed outside the body (e.g. glasses, visors or headbands) and do not require any implantation.

From an interaction point of view, neurotechnologies can;

• Record brain activity. These are neurotechnologies that record the activity of the brain such as electroencephalograms (EEGs)[13] or provide an image of the brain through a Functional Magnetic Resonance Imaging (fMRI).
• Manipulate brain activity. These neurotechnologies are able to modulate brain activity with short-term (neurostimulation) or long-term (neuromodulator) effects.

In addition, they can be:

• Local. The interaction takes place through sensors in direct contact with the user's body, so individuals are aware of the existence of the sensors.
• Remote. Interaction occurs through sensors that are not in direct contact with the user's body but are located in the distance, so the user may not be aware of their existence[14]^,[15].

Concerning the form of data collection, we can distinguish between:

• Passive collection. The user does not have to carry out explicitly any activity for data collection to occur.
• Active collection. Neurotechnologies gather data while users are carrying out specific activities such as thinking explicitly about something, evoking images, answering questions, performing specific physical tasks or facing specifically designed stimuli.

Neurorights are still an emerging and evolving concept. In 2017, professors Marcello Ienca and Roberto Andorno published an article in which, after assessing the implications of emerging neurotechnology applications in the context of the human rights framework, suggested that existing human rights may not be sufficient to respond to these emerging issues and proposed four new rights, so called neurorights[16]. Other scholars, such as the neurobiologist Rafael Yuste, have been working in the same direction  formulating other neurorights.

These neurorights have been proposed so far:

1. Cognitive liberty. The freedom of a person to decide whether their brain activity and mental processes can be recorded and/or modulated or not.
2. Mental privacy. The freedom and capacity of a person to conceal their mental information and to prevent non-consented intrusion into their cognitive domain.
3. Mental integrity. The prohibition of non-consensual and harmful modulation of a person’s neural activity (e.g. malicious brain hacking).
4. Psychological continuity. The right to preserve one’s personal identity and continuity of one’s mental life from non-consensual external alteration by third parties. E.g. a person that was cured for Parkinson disease but the brain stimulation made him addicted to Johnny Cash music[17].
5. Fair access: The ability to ensure that the benefits of improvements to sensory and mental capacity through neurotechnology are distributed justly in the population.[18]

Other scholars consider that the development of current rights, the promotion of legislative reforms and specific international conventions, could be a better and more effective solution to the concerns raised by neurotechnologies.[19]^{, [20], [21]}

Neurodata can be generally defined as the information gathered from the brain and/or from the nervous system. In this TechDispatch, we also consider as neurodata inferences based directly on this data such as emotional cues or preferences.

Neurodata are generally collected from identified individuals. Sometimes the concerned individuals identify themselves (e.g. entertainment related use cases) while some other times is those managing the sensors are the ones identifying the concerned individual (health related use cases). Even if the concerned individual is not identified during the collection of neurodata, they would remain identifiable as there is consistent evidence signalling that neurodata allow to uniquely identify individuals. Consequently, human beings’ neurodata is personal data.

A very relevant aspect of brain waves, and maybe of other forms of neurodata, is that are unique to each individual. This uniqueness has been used in several research studies to build brain wave based authentication systems^[22],[23]. However, brain wave uniqueness also allows distinguishing individuals[24],[25] for other purposes such as profiling.

The recent UNESCO International Bioethics Committee Report on Neurotechnology, that takes up the definition proposed by the OECD, highlights that neurodata allows the identification of an individual[26].

Many international organisations highlight the importance of the right to privacy within neurodata processing. The Council of the European Union, in the León Declaration on European neurotechnology, committed to strengthen the development of human-centric and rights-oriented Neurotechnologies in the EU.[27] The Inter-American Juridical Committee of the OAS (CJI)[28] recognises in their Declaration of the Interamerican Juridical Committee on Neuroscience, Neurotechnologies and Human Rights that privacy rights imply protection against interference in the most intimate sphere of individuals, and cover a number of factors related to the dignity of the individual.

According to the OECD Recommendation on Responsible Innovation in Neurotechnology, brain data is “data related to the functioning or structure of the human brain of an identified or identifiable individual that includes unique information about their physiology, health or mental states”[29].

The Chilean government is currently working on two bills concerning neurodata and neurorights. A bill to amend the Chilean constitution and a bill on neuroprotection and regulating the research, development and advancement in neurotechnologies. While the second bill is still under discussion, the first one was approved in 2021[30]. The aim is not to discourage research but to “protect brain activity, as well as the information from it”[31].

2. Processing of neurodata

Having regard to the processing of ‘Neurodata’ as defined in this TechDispatch, due account will be taken of: (i) the type of data processed; (ii) or the processing purpose.

If we look at the types of data, there are:

• Data regarding the structure of the brain. Brain tissue comprises cells and the gaps between these cells. Different techniques enable the measurement of anatomical and physiological aspects from these elements to understand cells' structure, their physical relationships or their low-level functioning.
• Data regarding the function and activity of the brain. Different techniques enable the collection of neuronal signals produced by the main parts of the brain (cerebrum, cerebellum, brainstem, etc.) via neurorecording or neuroimaging. This data collection can be performed by checking brain’s blood flow since active regions require more oxygenated blood or brain’s electrical activity.
• Data related to the peripheral system. This type of data is gathered using electrodes within Peripheral Nerve Interface (PNI) devices designed to collect bioelectric information concerning anatomy, function and activity. These devices can be located in the nerve trunk, positioned on or near the surface of the nerve trunk or within the nerve.

A different approach would be categorizing the processing based on the type of processing purpose:

Category 1. Data processing focused on gathering neurodata that provide direct knowledge or predictions about the person’s physical health or fitness, problem-solving, reasoning, decision-making, comprehension, memory retrieval, perception, language, emotions, etc. Predictions are included in this data processing category because neurodata may be “decipherable” to some extent and enable interpretation or inference. For example, the data subjects can imagine their own handwriting and the brain signals can be decoded and translated into accurate texting. Some initiatives use neurodata aim to infer users’ emotions. In general, Artificial Intelligence is being used as a tool for discovering patterns to decode the brain activity.

The extreme scenarios in this category are those considered by the emerging field of neuroanalysis, including “brain fingerprinting” (detection of the existence of specific information) and lie detection. This term can be used to describe the detection of the existence of specific information by measuring brainwaves or the unique identification of individuals[32]. The brain reacts to external stimuli; therefore, it is possible to understand if the person recognises something through a specific wave that is generated by the acknowledgment of recognition revealing an aha moment[33]. This use can be adopted also for lie detection[34]. As noted in the EDPB EDPS Joint Opinion on the AI Act, the scientific validity of the lie detector is not proven.[35] Many scholars indeed argue in this sense.[36] The scientific validity of emotion recognition AI is also not proven.[37] As further described section 3, such uses of neurodata may pose unacceptable risks for fundamental rights.

Application domains of this data processing category are:

• Healthcare. Neurodata processing can be used to research the functioning of the brain and the neural system. For example, to understand different cognitive processes[38] or the pathologies that affect it[39]. But also for the detection[40], diagnosis[41], prediction[42], or decision about treatment or intervention[43] of different neural or mental conditions, disorders and diseases.
• Education. Neurodata processing can help improve students' performance and learning outcomes, considering internal aspects (abilities, barriers, preferences) and external elements (classroom conditions, teaching methodology, teaching planning). For example, to make decisions based on evidence that optimizes the results obtained in educational processes[44]^,[45].
• Entertainment. This domain is similar to the previous one, but instead of optimizing learning results, it seeks to maximize users' enjoyment of leisure and entertainment products by understanding how they use them, how they perceive them, how they are impacted by them or how different design aspects affect their perceptions[46]^,[47]^,[48].
• Economics and marketing. This domain is similar to the previous two. But in this case, neurodata are processed to reduce uncertainty[49]^,[50]^,[51] trying to understand and predict consumer behaviour (motivations, preferences) and decision-making[52]^,[53].
• Workplace. Neurodata processing can be used to track employees, to help understand and improve their performance or during recruitment and promotion processes[54].
• Safety and surveillance. This domain implies carefully monitoring the data subject to prevent accidents or crimes. For example, neurodata processing can be used to monitor drivers or pilots[55]^,[56] to prevent accidents caused by drowsiness, lack of attention, etc.

Category 2. Data processing focused on gathering neurodata that enables the control of an application or device. In this case we can find reading operations as in the first category but in addition, and thanks to the data collected, an additional operation that involves the control of an external artefact.

Application domains taking advantage of this data processing category are:

• Orthopaedic or prosthetic aids, medical implants, or assisted living. Neurodata processing can be used to help people with different conditions and diseases in their everyday life[57]^,[58]^,[59]^,[60].
• Gaming, virtual reality and metaverse. Neurodata processing can be used to control videogames and other types of software[61].
• Robotics. Neurodata processing can be used to control some machinery, precision device or application with free hands[62].
• Defence. This domain involves controlling weapon systems, explosive disposal robots, vehicles or drones[63].

Category 3. Data processing focused on gathering neurodata that enables the subject's stimulation or modulation, achieving closed-loop neurofeedback. Meaning that signals from the brain (outputs) are used to generate new signals that are fed back to the brain again (as inputs). According to the research in this domain, neurofeedback may assist data subjects to control their brain waves, whether they are aware of it or not.

Application domains in this data processing category are:

• Psychology. Neurodata processing is used to change how the brain responds to certain stimuli as a method for therapy by monitoring brain activity and providing feedback, usually through visual or audio cues[64]. For example, to treat ADHD (Attention Deficit Hyperactivity Disorder), anxiety, depression, epilepsy, autism spectrum disorder, insomnia or drug addiction.

• Neuroenhancement. Neurodata processing can be used to improve cognitive and affective capabilities in healthy people. For example, obtaining benefits beyond the normal functioning of an average brain[65].

   

3. Neurodata processing use cases

In this section, three use cases are presented and analysed, each of them as an example of each of the neurodata processing categories presented in the previous section. The analysis will be made based on the following structure (see figure 1):

Figure 1. General structure to understand neurodata processing.

1. Collection of raw neurodata by sensors.
   Storage of raw neurodata in storage/computing infrastructure, a single one or a hierarchy of them. Typically, the closer to the sensors (local or edge infrastructure[4]), the more available bandwidth, lower latencies and greater control over the data. But also, less storage and computing capacity, which is why remote or cloud infrastructure is often used at some point in data processing.

[4] Edge infrastructure does not belong to users/data subjects but it is near them, physically close to the location where data are collected.

(optional) Filtering or pre-processing may be applied to the raw data between steps 1 and 2 or after step 2.
 

1. Processing itself which differs according to the purpose you wish to achieve:
   1. Category 1:
      1. If the use case is based on knowledge obtained directly from neurodata, this knowledge is built and formatted, usually to make some detection or decision or obtain some recommendation or advice.
      2. If the use case is based on predictions or inferences, neurodata are processed to obtain these results. Currently, neurodata are very often the input of Artificial Intelligence models previously trained to be able to perform the desired inferences.
   2. Category 2: Neurodata is processed to be interpreted or deciphered. Data coming, for example, from the motor cortex, the region of the brain involved in the planning, control, and execution of voluntary movements, are translated into instructions for the external artefact being controlled. Again, neurodata are very often the input of machine learning or AI models previously trained to be able to perform this translation.
   3. Category 3: Neurodata is processed to decide the neurofeedback protocol required for the “training” of each patient or person.

Processing activities can be executed on the same servers where data were stored in the previous step or on a different infrastructure.

1. Results obtained in the previous step are then used for different purposes:
   1. Category 1: Knowledge or predictions are displayed or visualized as individual or collective metrics, reports, etc. through dashboards, interfaces or messaging applications.
   2. Category 2: Instructions are communicated or sent to the controlled external artefacts.
   3. Category 3: Training parameters are shared with the data subjects as visual or audio cues or direct brain stimulation or modulation.
2. Storage of obtained results to keep historical charts and records, statistics, logs, etc. Results can be stored on the same servers where raw data were initially stored or on a different infrastructure.

Once the general structure of the use cases has been introduced, we can move on to analyse three specific cases. The use cases presented in this section are fictitious but representative of the type of applications seen today; citations are provided for similar cases.

Use case 1

Brief description	Portable and lightweight electromagnetic sensors provides the opportunity to monitor concentration or attention in educational environments, both face-to-face and online[66],[67],[68].
Application domain	Education.
Data subject	Students.
Type of information	Function and activity (electromagnetic).
Type of sensors and collection	Non-invasive, passive or active collection, local.
Type of neurodata processing	Category 1: Data processing focused on gathering neurodata that provides knowledge or predictions about the medical or cognitive state of the data subject.
Processing purpose	Concentration and attention tracking.

 

In step 1, headsets distributed among the students are used during face-to-face learning to gather students’ raw neurodata. The data collection is both passive, which does not involve performing any specific task, and active, which concerns performing specific cognitive tasks (e.g. reading, solving problems etc.). This collection is carried out at specific times. For example, upon arrival, before recess, before lunch, etc. Context variables, such as time, subject, temperature, humidity range, CO2 concentration or illumination range are also measured.

In step 2, these raw neurodata are stored in a local server at the school, where filtering and pre-processing operations are performed. For example, data from useless electrodes are removed, all data are re-referenced, bad epochs are erased, etc. After these operations are performed, some of the resultant data, aggregated and anonymized, are sent to a cloud service.

In steps 3 and 4:

1. Each teacher has access to a dashboard on the class computer with easy-to-understand and real-time individual concentration and attention metrics and trends for each student. In this way, teachers can adapt their methodologies (materials, approaches, use of technology), track the impact of personal interactions (teacher-to-student, student-to-student), propose rest periods or even naps or detect learning difficulties and disorders.
2. The service offered from the cloud provides the school administrators advice about schedule and classroom conditions regarding temperature, humidity, lighting, ventilation, etc. These indications are obtained by introducing the measured context variables and the global performance metrics received periodically (group attention, perception, execution, and working memory metrics) to an AI model.

Finally, in step 5, obtained results are stored, locally and in the cloud, to keep historical charts and records.

Use case 2

Brief description	Portable and lightweight electromagnetic sensors such as headsets can be used as game controllers[69],[70] converting the electrical activity of the brain into signals that control specific aspects of a videogame.
Application domain	Gaming and Virtual Reality.
Data subject	Gamers.
Type of data	Function and activity (electromagnetic).
Type of sensors	Non-invasive, active collection, local.
Type of neurodata processing	Category 2: Data processing focused on gathering neurodata that enables the control of an application or device.
Purpose	Videogame playing with the thought instead of with hands.

 

In step 1, the headsets collect gamers’ neurodata. This collection is active since the gamer must imagine a physical movement necessary to play the game: pressing a button on the keyboard, moving the mouse, using the gamepad, etc.

In step 2, these raw neurodata are stored in a local server, filtered, and pre-processed.

In step 3, an AI model previously trained to recognize the repeatable brain activity associated with the different physical movements is used to translate pre-processed brain signals into specific activities within the game. This method is often called “motor imagery” and allows the gamer to control a character with thought, for example, evoking the physical movements necessary to move the character, use a weapon, etc. by decoding neurodata into actions. It is essential to understand that neurodata are decoded into game-controller action; the player needs to think about actions performed with a keyboard, a mouse, or a pad, not about the action the character should take. They think about pressing the right button on the console controller, not about the character moving to the right, for example.

In step 4, the generated instructions are sent to the video game to produce the desired effects on the character and to be able to control it without using the hands.

Finally, in step 5, only some logs are stored in the system regarding these instructions sent to the game (the communications performed between the system and the game).

Use case 3

Brief description	Neurofeedback devices can be used at home for managing chronic pain by modifying specific brain activity[71].
Application domain	Psychology.
Data subject	Patients with chronic pain.
Type of data	Function and activity (electromagnetic).
Type of sensors	Non-invasive, active collection, local.
Type of neurodata processing	Category 3: Data processing focused on gathering neurodata that enables the modulation, control or manipulation of the subject, achieving closed-loop neurofeedback.
Purpose	Chronic pain management.

 

In step 1, the headsets collect the patients' neurodata, all suffering from chronic pain. This collection is active since neurofeedback sessions are designed very specifically. For example, these sessions often begin with baseline recordings, gathering data from a brain's resting state (closed eyes, open eyes looking at a fixed point, pre-trained breathing patterns, etc.). In addition to neurodata, other variables such as current pain level, mood or the quality of the last night's sleep are also measured through questionnaires.

In step 2, these raw neurodata are stored in a remote server where they are filtered to remove artefacts produced by electrode motions or eye blinks, for example.

In step 3, an AI model running on this server produces personalized visual or audio cues based on all data gathered in step 1.

In step 4, the generated cues are sent to simple games running on the patient's tablets or mobile devices, depending on their preferences. In this way, patients view a gamified representation of their brain signals. By controlling the game they control these signals, changing them to reduce the pain level and the associated symptoms. This type of neurofeedback game is simple and monotonous, offering low stimulus to patients as an overstimulation could hinder the neuromodulation. The game is designed only to interact with specific brain processes; enjoyment is not an objective; the aim is to make it possible for patients to have their own neuromodulation.

Finally, in step 5, data concerning training sessions is uploaded to the server to monitor patients' evolution with different historical charts and statistics.  Very similar developments can be found in the case of patients with depression, anxiety, and post-traumatic stress using direct current brain low-intensity, pulse-based, transcranial electrical stimulation[72].

4. Data protection challenges when processing neurodata

4.1. Threats to individuals’ rights and freedoms

As described, neurotechnologies promise to give deep insights into people’s brain activity and reveal the most intimate personal thoughts and feelings, including those that do not translate into actions and consequently cannot be measured or inferred by data collected through other technologies. The use of artificial intelligence could hugely increase the level of insight from neural data, as coupled with other contextual data. Furthermore, neuromodulation and brain implants pave the way to the possibility of influencing and rewriting the brain activity and people’s rational and emotional identities.

As such, neurotechnologies represent an unprecedented intrusion, perhaps even the ultimate step, into individuals’ private sphere. Neurotechnologies can also interfere with other fundamental rights and freedoms beyond the rights to privacy and data protection.

In addition to privacy and data protection (Article 7 and 8 of the Charter of Fundamental Rights of the EU), fundamental rights such as human dignity (Article 1 of the Charter) and physical and mental integrity (Article 3 of the Charter) are jeopardised by certain uses of neurodata.  For example, in contexts such as law enforcement, the use of neurodata for lie detection purposes or for the prevention of criminal offences (‘predictive police’) would put into question the right to presumption of innocence and to a fair trial.

The use of certain highly intrusive AI systems would be against EU fundamental values, not meet the requirements of necessity and proportionality, or be in direct conflict with essential values of the EU and affect human dignity[73],[74]. For example, the EDPB and the EDPS, considered that the use of AI to infer emotions of a natural person is highly undesirable and should be prohibited, except for certain well-specified use-cases, namely for health or research purposes (e.g., patients where emotion recognition is important) with appropriate safeguards in place[75]. The EDPB and the EDPS also recommend explicit prohibition of the use of AI systems intended to be used by law enforcement authorities as polygraphs and similar tools whose scientific validity is not proven.

The recently adopted AI Act[76] expressly prohibits among others: manipulative AI and AI exploiting the vulnerabilities of a person or of a group of persons[5]; the placing on the market and putting into service of emotion recognition systems at school and at the workplace[6], as well as AI system profiling individuals and groups of persons from biometrics according to protected categories (e.g. sexual or political orientation)[7].

4.2. Data protection requirements and principles

a. Special categories of data

As a preliminary matter, it should be noted that neurodata often constitute special categories of personal data within the meaning of EU data protection law (e.g., as biometric data or as data concerning health). Processing of special categories of data is in principle prohibited, subject only to limited exceptions and conditions. Where permissible, neurodata processing must still comply with all other data protection requirements and principles, such as the requirements of proportionality, accuracy, transparency and fairness.

b. Proportionality and data minimisation

Proportionality requires controllers to strike a balance between the means used and the intended aim^[77]. According to the data minimisation principle^[78], only adequate and relevant personal data for the purposes of the processing is collected and processed.

The advent of neurotechnologies challenges the proportionality principle. Specifically, neurotechnologies are based on (entail the) effortlessly collection of massive amounts of data^[79]. Due to the many functions of the brain and its intense activity 24/7, neurotechnology-related devices or services have the potential to collect many neurodata and with those, neurotechnologies are able to infer individuals’ physical health or fitness and mental state (e.g. problem-solving, reasoning, decision-making, comprehension, memory retrieval, perception, language, emotions)^[80]. It is therefore a very intrusive, if not the most intrusive processing, encroaching upon the very mental privacy and possibly mental integrity of the person concerned. Brain fingerprinting introduces other elements of intrusiveness. This is due to the possibility of inferring information related to the data subjects’ experiences without them explicitly communicating it or to the possibility of profiling data subjects based on brainwave patterns.

For instance, processing neurodata in the context of education and entertainment could result in the processing of neurodata that could allow inferring other information on the individual, notably on their health condition, including ‘mental health’. This risk is less evident in neurodata processing related to healthcare and psychology where a full brain mapping might be essential for a more accurate diagnose.

Those considering to process neurodata should always take into account the intrusiveness^[81] of the processing of such data and carefully assess if the purpose sought fully justifies this extremely invasive and sensitive data processing, affecting the most intimate aspect of the life of an individual. As a rule, the EDPS considers that the processing of data such as ‘brain fingerprinting’ should only occur for healthcare purpose, accompanied by all data protection conditions and safeguards. It would be alarming for any controller, other than a provider of healthcare, to use neurodata to detect or infer an individual’s health information (in particular very sensitive information that is possibly not yet known to that individual themselves, e.g. about psychological disorders or a neurogenerative disease).

c. Data accuracy

According to the GDPR personal data should be “accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay”.

One of the concerns with regards to data accuracy in neurodata processing is brain plasticity. The brain is characterised by an impressive plasticity^[82], meaning that its structure changes over time. There are studies stating every decade after 40 years old the volume of the brain changes by around 5%^[83].

Data subjects within the age range of 5 to 30 are considered to be within the period of greatest change and plasticity of the brain^[84]. These age ranges largely overlap with the ones targeted by systems processing neurodata for learning and gaming^[85]. Brain plasticity can also affect the structure of the brain in case of children’s abandonment in the early stage of their life^[86]. These changes in the brain might become relevant in neurodata processing related to healthcare or psychology.

The reliability of the inferences based on neurodata is alsosubject of debate and scrutiny within the scientific community. Some researchers have raised concerns about how neurodata are collected, assessed and interpreted. Two of these concerns are related to the use of inadequate or incorrect statistical methods[87], leading to false positives, and a growing concern about the replicability of neuroscientific findings[88].The uncertainties associated with certain data collection methods must also be taken into account, for example those based on sensors that incorporate very innovative technologies[89] such as those that allow remote neurodata collection.

Even when lab test results point to accuracies that would satisfy the requirements of a given real world use case, it is necessary to consider that “studies in laboratory conditions always have limitations in their general applicability and accuracy; they are probabilistic, decoding brain activity through the use of sophisticated, statistical algorithms that are not always accurate.” [90]

While neurotechnologies are still developing in all fields, data controllers should consider the intrinsic accuracy limitations of neurodata processing. Ensuring the accuracy of neurodata is vital not only for scientific validity but also for mitigating ethical concerns related to potential misunderstandings or misuses of the information collected from the brain.

This also has a close relationship with the principle of necessity, that implies “the need for a combined, fact-based assessment of the effectiveness of the measure for the objective pursued and of whether it is less intrusive compared to other options for achieving the same goal”⁸⁷. When assessing the effectiveness, neurodata processing should be essential to achieve the pursued purpose, addressing the problem more adequately than other alternatives. But convincingly supporting this fact may be a significant challenge in many use cases given the limitations in accuracy already mentioned.

d. Transparency

Under the GDPR, personal data processing should be transparent. This means that data controllers should explain the data processing, including the data collected, and possible consequences for the data subjects in the clearest and concise way possible.

When neurotechnologies are involved in the processing of personal data, individuals have no direct control over the information disclosed due to the intrinsic and involuntary nature of neurodata and might not fully understand the potential implications of such data processing^[91].

In processing activities involving underage data subjects, transparency might be even harder to achieve.  If explaining neurodata processing to adults who are not experts in the neural field might reveal to be complex, then explaining it to children or younger people could be even more difficult given the necessity to simplify whilst still providing an accurate description of the processing. This could easily happen in education or entertainment application domains.

e. Fairness

According to the GDPR, personal data should be processed in ways that people would reasonably expect and not be used in ways that have unjustified adverse effects on them including discrimination or the violation of other fundamental rights and freedoms.

With the adoption of neurotechnologies and the processing of neurodata new risks of discrimination may emerge. Discrimination can occur, for example, through the adoption of devices that are not assessed on a wide variety of people^[92]. This can lead to biased and incomplete data sets. For example, female and male brain present different structures and neural activity^[93]. AI is used as a tool to discover patterns and decode brain activities. If a tool is trained exclusively on a group defined by a characteristic, it could not correctly recognise patterns or the correct activity of individuals that do not share that characteristic (e.g. age, gender or ethnic origin).

It is important to consider the risks associated with biased data or AI models when using neurodata in education and healthcare. In these domains, the aim is to make decisions based on evidence that can, for example, optimise learning outcomes or select the appropriate therapy. However, if the data used to train AI models is biased, it may result in unfair outcomes for individuals, which goes against the principle of fairness. Therefore, it is crucial to ensure that those developing neurotechnologies guarantee that the individuals considered during neurotechnologies’ development are representative of the target users.

5. Future developments

The developments in neurotechnologies seems to push the boundaries of innovation beyond current application domains. At the same time, they raise serious concerns about the respect for human dignity and human agency, mental integrity, non-discrimination, privacy and data protection issues. Neurotechnologies reveal details of the human brain and, therefore, touch the most intimate parts of what constitutes us as human beings.

The path of neurotechnological development will extend beyond the brain’s motor functions. The next frontier lies in the ambitious attempt to target other essential functions, with a particular emphasis on those dedicated to memory^[94]. Neurotechnologies could decode, modulate and store information related to the complex neural networks responsible for memory processes, thus leading to the possibility preserve human memory on a storage device^[95]. However, such developments should also lead us to wonder whether achieving superhuman performances is a desirable goal, from a fundamental rights perspective.

Another worrying example of future neurotechnology development are multisensory headsets, for example, in the gaming industry. Gathering data simultaneously from the user’s heart, skin, muscles, eyes and brain, and combining this capability with head-mounted displays or augmented and virtual reality headsets will provide new forms of real-time interactivity and control by augmenting the human mind. These new technologies will also be able to make quantifiable inferences about factors such as stress, fatigue, cognitive workload and focus. A prototype of this technology is already able to allow a user flying a drone only through neurodata by repurposing dormant muscles for extended and augmented interactivity^[96]. However, we cannot help but think of the use that could be made of such techniques in the field of defence and law enforcement, for instance.

These developments raise obvious data protection threats and risks. The vast collection of data processed by neurotechnologies together with the growing diffusion of today’s neurotechnologies already in use, anticipates the creation of massive neurodata databases. This accumulation of personal data, given their sensitiveness, represents a serious risk for the protection of our personal data and, more broadly, for the respect for our private lives and other fundamental rights. They also represent a potential interest for cybercriminals, as the volume and sensitivity of this information could be an attractive target. The protection of the confidentiality and integrity of brain information should be a crucial priority.

6. Conclusion

Neurodata processing, a form of personal data processing, promises to enable new ways of interacting with the physical and digital world, enhancing human capabilities and experiences.

Neurotechnologies, once confined to healthcare or security, are now being directly sold to consumers, marking a significant shift in accessibility, but also in harmfulness. This accessibility, coupled with the power of Artificial Intelligence to combine data from various sources, is paving the way for discovering patterns or trends in the data these neurotechnologies collect and manage.

This TechDispatch has introduced how different types of neurodata processing enable different use cases, in the present and in the future. At the same time, we provided some high-level indications on how certain uses of neurodata can substantially interfere with fundamental rights and freedoms and  jeopardise the fundamental right to respect for human dignity.

Neurotechnologies deal with human brain activity, where our most intimate thoughts and feelings reside. They raise crucial issues from a philosophical, ethical and legal perspective: ’Understanding, treating, and augmenting the human brain and mind is one of the great scientific challenges of our age. Achieving these goals in a way that preserves justice, safeguards fundamental rights and human dignity is the corresponding task of ethics and law’⁸⁶

Before further progress is made, it seems essential to undertake an in-depth analysis of neurodata and assess its impact on fundamental rights, including whether the creation of new human rights, namely neurorights, is required.

“The Council of Europe’s Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine (Oviedo Convention) offers an ideal platform and normative substrate for the protection and promotion of neurorights. Given its focus on prohibiting the misuse of innovations in biomedicine, protecting the dignity and identity of all human beings, and guaranteeing respect for their integrity and fundamental freedoms, the Convention is well placed for either enshrining neurorights through ad hoc protocols or for serving as a basis for future instruments.” [97]

In any case, as noted, in the European Union, the Charter of Fundamental Rights already expressly acknowledges the fundamental right to mental integrity (Article 3), as one of the expressions of the fundamental right to human dignity (Article 1), which is also the foundation of the right to privacy and to the protection of personal data (respectively, Article 7 and 8 of the Charter).

7. Recommended readings

• Rashid, M., Sulaiman, N., PP Abdul Majeed, A., Musa, R. M., Ab Nasir, A. F., Bari, B. S., & Khatun, S. (2020). Current status, challenges, and possible solutions of EEG-based brain-computer interface: a comprehensive review. Frontiers in neurorobotics, 14, 515104. https://doi.org/10.3389/fnbot.2020.00025
   
• Unveiling the neurotechnology landscape. Scientific advancements innovations and major trends. (2023). In UNESCO eBooks. https://doi.org/10.54678/ocbm4164
   
• Information Commissioner's Office (2023).  ICO tech futures: neurotechnology. https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/ico-tech-futures-neurotechnology
   
• Ienca M, Andorno R. Towards new human rights in the age of neuroscience and neurotechnology. Life Sci Soc Policy. 2017 Dec;13(1):5. https://doi.org/10.1186/s40504-017-0050-1
   
• Australian Human Rights Commission (2024). Protecting Cognition: Background Paper on Human Rights and Neurotechnology. https://humanrights.gov.au/our-work/technology-and-human-rights/publications/protecting-cognition-background-paper 

References