Neurotechnology, like wearable EEG headbands and invasive brain implants, collects information from electrical nerve impulses and brain waves derived from your brain, spinal cord, or nervous system.  This information, or neurodata, is valuable, unique, potentially individually identifiable, and has the potential to provide access to a person’s memories, biases, and intentions.  (For more information, see our more fulsome discussion of neuroprivacy in Bloomberg Law).

Neurodata remained largely outside the focus of privacy statutes, leaving it potentially less regulated in the United States – until last week.

On January 10, 2024, the Colorado General Assembly introduced Bill 124-1058 (the “Bill”) which aims to amend the Colorado Privacy Act (CPA) to extend protections currently offered to “sensitive data” to neural data, genetic, and other biological data.   The bill is scheduled to be discussed by the Colorado house judiciary on January 30, 2024.

The Bill adds “biological data” to the definition of “sensitive data”. “Biological data” is defined as “data that provides a characterization the biological, genetic, biochemical, physiological, or neural properties, compositions, or activities of an individual’s body or bodily functions.”

Further, the Bill creates “neural data” as a new defined term, and includes is as part of the ”biological data” it treats as sensitive.  “Neural data” is defined as “data that concerns the activity of an individual’s central or peripheral nervous systems, including the brain and spinal cord, and that can be processed by or with the assistance of a device.”

Currently, under the CPA, businesses must obtain consumers’ consent prior to collecting sensitive data such as ethnic origin, religion, or genetic or biometric data.  The CPA also requires businesses to conduct and document data protection assessments prior to processing sensitive data.  If passed, the Bill would require businesses to extend those same protections to neural data.

These protections are similar to some of the protections contained in Washington’s My Health My Data Act.  As consumer health data continues to become more of a focus for legislators and regulators, similar statutes may become of interest in other States.  Thus, this Bill may inspire other States to introduce similar legislation in the near future.

[View source.]