Under a new law signed by Colorado Governor Jared Polis, the state will be the first to offer privacy protections for neurological data, data created by measuring brain and spinal cord activity.
The new law, which Polis signed last week, expands the definition of “sensitive data” protected by the Colorado Privacy Act, Colorado's consumer data privacy law of 2021, which went into effect last July. Currently, sensitive data includes biological data such as neural data, defined as data generated by the brain, spinal cord, or neural networks of an individual that can be processed with the help of devices.
The law expands the country's definition of “sensitive data” to “any technical processing, measurement, or analysis of the biological, genetic, biochemical, physiological, or neurological characteristics, composition, or activities of an individual.” is expanding to include all biological data generated. Data about an individual's body or bodily functions that is or will be used alone or in combination with other personal data for identification purposes. ”
Currently, companies subject to Colorado's privacy laws must obtain consent before collecting “sensitive data” such as ethnic origin, religion, genetic data, or biometric data. Now, if you want to collect neural data, you need to do the same thing.
The expansion comes as neural data becomes more accessible through consumer devices such as brainwave headbands and implantable computer chips developed by Elon Musk's startup Neuralink. Neuralink announced in January that it was implanting its first computer chip into the human brain and measuring nerve cells. Activities.
Other states have passed data privacy laws with a narrower focus, including one that last year enacted into law broader protections for consumer health data not included in the federal health information portability law. This includes Washington state, which passed the My Health, My Data Act, the first law in the nation to do so. Accountability Act.
“Neurotechnology is no longer limited to medical and research settings, but is now being used in the devices we use every day,” state Sen. Kevin Priola, one of the bill's sponsors, said in a news release. “Outside these settings, neurotechnology can now operate without regulations, data protection standards, or comparable ethical constraints. Although neurotechnology has made great strides in recent years, sensitive information cannot be collected without controls. It's important to protect users like this.”
According to the bill's text, the law will go into effect 90 days after Congress adjourns, with the session scheduled for May 8.