WHAT IT IS
Neurodata
The ICO defines neurodata as data gathered directly from your brain and nervous system, plus inferences drawn from it. Wearable headbands are expected to be the most common kind of device in the near term.
Check a use
WEARABLES AND BRAIN DATA
Your brainwaves
are personal data.
Headbands and earbuds that read brain activity are moving from labs into living rooms.
They are sold to help with focus, meditation or sleep. The UK Information Commissioner's Office calls the information they gather neurodata, and has flagged real privacy questions about it. Here is what that means for you.
READ THE POLICY before the headband
Check a use- Neurodata is personal
- Purpose sets the rules
- You have rights
- Ask where the data goes before you put it on
THE SHORT ANSWER
Data from your brain
is still data about you.
UK data protection applies to it.
How strictly depends on what it is used for.
WHAT COMPANIES SAY
Policies are patchy
A 2024 review of 30 consumer neurotechnology companies found that 29 appeared to have access to users' neural data with no meaningful limits, and 8 had no relevant privacy policy viewable before purchase.
See the numbers
YOUR RIGHTS
Ask, and you can see it
Under UK data protection law you can ask an organisation for copies of your personal information. The ICO says organisations usually have one month to respond.
Questions to ask
FOUR QUESTIONS TO ASK
Before you buy
a brain-sensing band.
None of these needs special knowledge. They follow from what the ICO and the 2024 policy review highlighted.
Is there a privacy policy?
Look for one that covers the device itself, not just the website, and read it before you buy. In the 2024 review, 8 of 30 companies had none to view in advance.
Does it mention neural data?
Check whether the policy says what brain data is collected, how long it is kept and whether it is shared with third parties.
Can you get a copy?
You can make a subject access request to see your personal information. The ICO says you do not need a solicitor and organisations usually have one month.
Can you delete it?
The ICO says you can ask for data to be erased in some cases, for example if you consented to its use and have now withdrawn that consent.
TWO NUMBERS WORTH KNOWING
What the policies
actually say.
From a 2024 review of 30 companies selling
brain-sensing products to consumers.
29 of 30
Companies that appeared to have access to consumers' neural data with no meaningful limits
Based on policy documents and correspondence. The same review found 29 of the 30 could transfer data to third parties in practice.
ACCESS · NEURORIGHTS FOUNDATION, 2024
60%
Companies giving consumers no information about how neural data is handled
Only 13 of the 30 explicitly mentioned neural data in their policies. Only 4 explicitly mentioned efforts to minimise the data they collect.
CLARITY · NEURORIGHTS FOUNDATION, 2024
The review, published in April 2024, looked at companies with products available to consumers. It assessed published policies, not how the devices perform.
A QUICK USE CHECK
How sensitive is
this use?
Pick a way brain-sensing technology might be used to see what the ICO's 2023 report says about it. The bar shows how sensitive the regulator considers that use.
Based on the ICO's Tech Futures report on neurotechnology (June 2023). General information only.
A WIDER DEBATE
Mental privacy
is on the agenda.
UNESCO describes brain data as revealing our most private thoughts and calls for its collection to be strictly protected. Its figures show investment in neurotechnology companies rose by 700% from 2014 to 2021, to a total of USD 33.2 billion.
UNESCO has since adopted what it calls the first global standard on the ethics of neurotechnology. In the UK, the ICO has said it plans neurotechnology-specific guidance in the longer term and invited organisations to its Regulatory Sandbox.
Questions
Questions people ask
What is neurodata?
The ICO defines it as data gathered directly from a person's brain and nervous system, plus second-order inferences based on that data. There is no agreed definition in UK data protection law itself.
Is brain data covered by UK data protection law?
Yes, where it relates to an identifiable person it is personal data. Where it relates to health, ethnicity or sexuality it is special category data under Article 9 of the UK GDPR, with extra safeguards.
Are consumer headbands medical devices?
Not necessarily. The ICO notes many may be marketed as wellbeing and fitness trackers, which blurs the line between wellbeing and health and can change what rules apply to the data.
How do I see what a company holds about me?
Make a subject access request. The ICO says anyone can make one, you do not need a solicitor or lawyer, and organisations usually have one month to respond.
What worries regulators most?
The ICO highlights a significant risk of discrimination in non-medical settings such as workplaces, the need for people to understand the technology to give clear consent, and the need for regulators to co-operate.
Sources
- ICO: ICO tech futures: neurotechnology (June 2023)
- ICO: Getting copies of your information (SAR)
- ICO: Your right to get your data deleted
- Neurorights Foundation: Safeguarding Brain Data, consumer neurotechnology report (April 2024, PDF)
- UNESCO: Ethics of neurotechnology
Updated