There isn’t an agreed definition of neurodata. The recent UNESCO International Bioethics Committee Report on Neurotechnology uses the term neurodata to describe personal brain data. It states that neurodata is “data relating to the functioning or structure of the human brain of an identified or identifiable individual that includes unique information about their physiology, health, or mental states”. This is a definition drawn from the Organisation for Economic Cooperation and Development’s (OECD) Recommendation on Responsible Innovation in Neurotechnology.5
Neurotechnology, another widely debated term, is also defined by the OECD as “devices and procedures that are used to access, investigate, assess, manipulate, and emulate the structure and function of neural systems.”6
There is no explicit description or definition of neurodata (or neurotechnologies) under the UK GDPR or other data protection legislation. Neurodata is likely to link to the ‘mental identity’ definition of personal data under Art 4(1). However, neurodata is not specified in the Article’s text, unlike biometric data (which is discussed in our Biometric: Insight report). The broad category of ‘mental’ identity may only cover aspects of neurodata gathered directly from the brain and may not include data gathered from the nervous system by devices that gather information from the spinal cord, for example. However, for the purposes of this report, neurodata includes information gathered from both the brain and nervous system.
There are contexts and uses that place neurodata clearly within the definition of special category data under article 9 of the UK GPDR. For example, where neurodata relates to health, ethnicity or sexuality. When processing special category data, the UK GDPR puts additional safeguards in place. However, as we will explain in this report, whether neurodata is also special category data is unlikely to depend on the specific technology, but rather on the purpose of processing, in many cases.
ICO definitions
For the purposes of this report, we therefore define neurodata as:
“first order data gathered directly from a person’s neural systems (inclusive of both the brain and the nervous systems) and second order inferences based directly upon this data”.
This helps us to define the scope for this report. We will consider information drawn from both the brain and the neural system, as well as morphological data (data allowing identification as well as classification), but exclude neurodata inferred via biometric technologies and their data.
We then define neurotechnology as:
“consumer, enterprise and healthcare devices and procedures, both invasive and non-invasive, that directly record and process neurodata for the purposes of gathering data, controlling interfaces or devices, or modulating neural activity”.
This definition does not directly include approaches that ‘emulate’ neural activity at this time. This is due to the significant overlap with algorithmic processing that mirrors neural activity without being directly drawn from the source. However, if appropriate, we will consider this in specific circumstances, such as smart prosthetics.
For example, a wearable device such as a headband (a neurotechnology) may gather raw information on brain patterns (neurodata). Through algorithmic analysis it may indicate how alert a person is (first order data). Following this, wider inferences about future performance or behavioural patterns might be extrapolated and even combine with additional data (second order inferences).
While we are focusing on first order data captured from brains, we do not allude to ‘mind reading’. The information produced by devices is often binary, a categorisation of neural responses as ‘either / or’ rather than a detailed picture of a person’s thoughts. This is particularly likely when discussing wearable or non-invasive devices that are not surgically implanted, such as headbands. Long term plans for neurotechnologies may seek to capture phenomenological responses, such as memories evoked by sight, sound or taste, or even images from a person’s mind. However, these remain largely theoretical, lab-based approaches at present. In either case, at this time, more granular information from the brain is largely obtained from invasive technologies that are not accessible to the broader population. Most people are more likely to gain access to wearable brain activity sensing and recording devices in the near term.
We have identified relevant use cases for neurodata that illustrate potential data protection concerns in sectors including employment, entertainment, healthcare and education. Through our research approach set out in Annex B, we have developed the scenarios presented below. Annex C sets out the contemporary legal and regulatory context of this report.
For further supporting information on definitions about neurotechnologies, Annex D sets out a brief chronological and technical exploration of developments central to our analysis.
5 UNESCO International Bioethics Committee. Report of the International Bioethics Committee of UNESCO (IBC) on the Ethical Issues of Neurotechnology Dec. 2021
6 OECD Recommendation on Responsible Innovation in Neurotechnology - OECD