BCIS, Brainwaves, and Big Brother: Decoding the Battle for Mental Privacy

I. Introduction

On December 23, 2021, the boundaries between thought and action were irrevocably transformed when Philip O’Keefe, a 62-year-old man suffering from amyotrophic lateral sclerosis (ALS), posted a tweet using nothing but his thoughts². Strapped to no keyboard and holding no device, O’Keefe achieved this feat through a revolutionary Brain-Computer Interface (BCI)³. This is not an isolated instance but rather one of many remarkable strides in neurotechnology, clearly signalling a new era in the intersection of science and human cognition.

Over the past decades, there has been a prolific surge in scientific advancements which has significantly assisted in our understanding of the human brain. This progress has facilitated the development of cutting-edge neurotechnologies such as deep brain stimulation, cochlear implants, and direct Brain-Computer Interfaces (BCIs).⁴ These technologies assist in enhancing cognitive and motor functions, restoring lost sensory abilities⁵, and even enabling direct communication between the human brain and external devices⁶.

Among these innovations, BCIs stand out as one of the most groundbreaking developments. In simple terms, BCIs as a system is a device that allows an individual to control external devices using only their brain activity⁷. This technology enables users to move a robotic arm, send an email, navigate a computer interface, or operate prosthetic limbs without any physical movement⁸. Essentially, a BCI system captures and processes electrical signals from the brain, commonly referred to as 'neural data' or 'brain data', and then links them to specific mental or movement-related functions⁹. It should be noted that these signals are computationally processed and interpreted into basic functional outputs¹⁰. Therefore, By translating electrical brain signals into digital commands, BCIs bridge the gap between thought and action, redefining the possibilities of human-machine interaction.

BCIs can be broadly classified into two forms: non-invasive and invasive, depending on whether the device is externally worn or surgically implanted¹¹. Externally worn BCIs, such as electroencephalography (EEG) caps which record brain activity through sensors placed on the scalp and detect electrical patterns without invasive procedures¹². On the other hand, internally implanted BCIs involve direct neural interfaces, where electrodes are surgically placed onto the brain’s surface or embedded deep within neural tissue¹³.

Beyond the traditional Physical Form, BCI can also be categorised based on how they particularly interact with a person’s cognitive processes and ability¹⁴. These are namely active, reactive, or passive systems. Each system essentially differs in the level of conscious control required from the user. ActiveBCIs generate actionable output through mental commands or Conscious Control. Here, users deliberately their brain activity to produce actionable outputs, For example imagining limb movements to control a robotic arm¹⁵.

Reactive BCIs, on the other hand work by measuring how the brain responds to external stimuli. For example, if a user focuses on a flashing button on a screen, the BCI will detects the brain’s natural reaction to that visual stimulus and will allow control without needing deliberate "mental commands." This method is often used in systems like spellers or navigation interfaces¹⁶. Meanwhile, Passive BCIs don’t require any conscious effort from the user. Instead, it continuously monitor brain signals like attention, stress, or fatigue without the user needing to "do" anything. This method is significant for applications like monitoring mental states in drivers or adjusting a game’s difficulty based on the player’s focus level¹⁷.

Therefore, the development of above given categorise of BCIs holds tremendous promise for the healthcare sector which is clearly illustrated by cases like Philip O’Keefe’s¹⁸. These systems are already transforming rehabilitation as the same is benefiting individuals affected by amyotrophic lateral sclerosis (ALS), stroke, spinal cord injuries, and even Locked-in syndrome.¹⁹

The transformative potential of Brain-Computer Interfaces (BCIs) is clearly reflected in their growing use across various sectors such as healthcare, education, security and authentication, neuromarketing, smart environments, neuroergonomics, and entertainment²⁰. This immense potential is also evident in the projected economic growth of the industry. The global market for Brain-Computer Interfaces is anticipated to expand from two billion dollars in 2024 to approximately three point two five billion dollars by 2029²¹. Furthermore, the Asia-Pacific region , especially China and Japan is gaining prominence in driving forward the BCI market²².

Recently, even various private companies have realised the importance of neurotech, although for different reasons. While early BCIs focused on assisting patients with neurological impairments, companies like Neuralink²³ and Synchron²⁴ are now pushing the boundaries far beyond traditional medical applications. Neuralink, for instance, aims not only to treat disorders but also to enable memory storage and direct integration with artificial intelligence²⁵. Major tech players like Facebook have also invested 500 million dollars in non-invasive neural interfaces²⁶.

So, while these progress and growth might signal enormous positive potential, they also come with their own set of negative consequences. BCIs are no longer just tools for sending mental commands to machines they are also capable of accurately decoding the contents of specific thoughts.²⁷ BCI systems can detect basic movement intentions or identify focused stimuli using brain activity, including P300 waves from the visual cortex. However, the technology has advanced to the point where it may also access more complex cognitive functions. Regions like the medial temporal lobe, which process memories and abstract thoughts, could potentially be decoded by BCIs.²⁸. In fact, studies suggest that merely examining neural signals collected by BCI devices may be enough to identify a user , strongly raising the concern that even thoughts, when translated into data, can be reused in unintended contexts.²⁹

To better understand the concerns surrounding privacy and ownership, let’s consider a situation where a particular patient undergoing treatment in a hospital uses a BCI device developed by a private neurotechnology company. The patient generates neural data while performing cognitive tasks, and this data is processed by the device for both medical monitoring and further algorithm development. Now the question arises who owns this data? Is it the patient, because it originates from their brain? Or the company, whose technology enabled the entire process? This raises questions about the implications of granting ownership to corporate entities over data derived from the human brain

In this backdrop, the paper is divided into five interconnected sections. The introductory section outlines the understanding and growing integration of Brain-Computer Interfaces (BCIs), the subsequent part delves into the nature of neural data. The third section conducts a comparative legal analysis, focusing on how jurisdictions like Chile and the European Union have responded to the challenges posed by neural data. The fourth section highlights the ethical and legal risks associated with unregulated control over neural data, especially in the context of consent, surveillance, and autonomy. Finally, the paper concludes by outlining a way forward and offering policy recommendations that aim to strengthen cognitive sovereignty and mental privacy.

II. Neural data: at the crossroads of innovation, privacy, and property

The debate surrounding the ethical use of brain-computer interfaces (BCIs) centres heavily on one critical element , i.e., neural data. As BCIs transition from experimental tools in research labs to everyday instruments in clinical care and neurotechnology development, the question of who controls and benefits from the data they capture becomes increasingly urgent.

Neural data, also referred to as brain data is collected through BCIs using methods such as EEGs or ECoGs³⁰. The OECD Recommendation of the Council on Responsible Innovation in Neurotechnology classifies personal brain data as the “data relating to the functioning or structure of the human brain of an identified or identifiable individual that includes unique information about their physiology, health, or mental states³¹”.

In a similar direction, recent legislative developments in the United States also attempt to grapple with the nature of such sensitive information. Colorado’s amended Privacy Act explicitly includes neural data within the broader category of “biological data,” which not only include neural signals but also genetic and physiological information³². The law basically defines neural data as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems and that can be processed by or with the assistance of a device”.³³

What makes neural data particularly contentious is its uniquely intimate and revealing nature³⁴. It enters the locus internus, which is the innermost realm of human thought, where beliefs, emotions, and convictions reside beyond the grasp of external observation. This space, often referred to as the "last refuge" of autonomy and selfhood, has historically remained shielded from intrusion³⁵. However, with the advent of Brain-Computer Interfaces (BCIs), neural data now grants unprecedented access to subconscious tendencies, cognitive biases, and behavioural patterns that may lie beyond even the individual's conscious awareness.³⁶

Neural data is multidimensional in character. It engages not only with one’s cognitive processes but also with psychological and emotional integrity. Emerging research suggests that such data may be used to forecast behavioural inclinations, emotional responses, and even future decision-making tendencies, including internal visualization, unspoken language, and predictive cues linked to criminal predispositions ³⁷. This is aptly described by Girardi that "Brain data is the next battleground for human freedom, And I never gave Emotiv permission to use mine in that way.³⁸"

Both invasive and non-invasive BCI systems are capable of accessing and decoding real-time mental processes. ³⁹Given the brain’s continuous activity, these technologies have the potential to generate uninterrupted streams of neural data⁴⁰. Thus, bringing society closer than ever to the technological reality of cognitive surveillance or “mind-reading.”⁴¹

This level of access raises serious concerns about misuse and unauthorised interpretation. Neural data can reveal deeply personal insights, including decision-making patterns, emotional states, and memory retrieval processes. Without adequate protections, there is a very real risk that such data could be exploited for profiling, behavioural targeting, or manipulation⁴². For example, seemingly innocuous EEG data gathered during gaming or attention-tracking applications could, in the wrong hands, be repurposed to draw conclusions about a person's medical condition, political beliefs, or psychological vulnerabilities.

Therefore, given the magnitude of risks tied to the misuse of neural data, it becomes important to critically examine whether we have sufficient legal safeguards in place. The following section explores how different jurisdictions have attempted to respond to the Present challenge.

III. Neural data regulation in practice: lessons from chile and the eu

Despite the rising commercial, medical, and policy interest in neurotechnology, legal frameworks around the world continue to evolve in an inconsistent and often inadequate manner when it comes to neural data. There are not many countries that have taken meaningful steps to understand and address the significance of neural data. Most continue to rely on existing data protection laws, which rarely engage with the unique nature of brain-derived signals. Core legal questions, such as who owns neural data, what constitutes meaningful consent in brain-data collection, and how such data may be repurposed or shared, remain unsettled in most regions.

This paper focuses on two jurisdictions that reflect different stages of legal engagement with these issues. The first is Chile, which has taken a proactive and constitutional approach by embedding the right to mental integrity and pushing forward with legislative efforts to regulate neuro data use. The second is the European Union, whose General Data Protection Regulation (GDPR) is often regarded as the global benchmark for data protection but still lacks targeted provisions for neural data. Together, these jurisdictions show both the progress and gaps in the global legal treatment of of brain-computer interface (BCI) technologies.

A) Chile

Chile stands as the first country in the world to formally engage with the legal status of neural data⁴³, both through constitutional amendment and judicial interpretation. This development was significantly advanced by the 2023 Supreme Court ruling in Girardi v. Emotiv Inc⁴⁴., which has since become a landmark case in the neuro-rights discourse.

The case concerned the Insight device sold by Emotiv Inc., a U.S.-based neurotechnology company marketing portable neuro-enhancement headsets in Chile. The device uses electroencephalography (EEG) sensors to collect brain signals. The petitioner, Mr. Guido Girardi Lavín, raised constitutional concerns regarding Emotiv’s handling of this sensitive brain data. His main grievance was that the device, along with its associated software, compelled users to accept restrictive terms of service in order to access and manage their own neural data.

In particular, Emotiv's policy allowed users access to their neurodata only if they upgraded to a paid "PRO" account. Without this, data was stored on the company’s cloud servers, with no option for users to download, export, or manage their brain data independently. Girardi argued that such practices violated constitutional guarantees of privacy, mental integrity, and informational self-determination.

In its defence, Emotiv maintained that it had complied with Chile’s Law No. 19.628 on the Protection of Private Life⁴⁵, highlighting provisions such as Article 11⁴⁶, which mandates responsible data handling, and Article 13⁴⁷, which allows individuals to cancel or block use of their personal data. The company also claimed its data had been pseudonymised and used only for statistical research, and that consent had been explicitly obtained through detailed terms and conditions. It further asserted that the Insight device, being recreational rather than therapeutic, posed no real health risk.

Nonetheless, the Chilean Supreme Court sided with the petitioner in part. Relying on Chile’s 2021 constitutional amendment⁴⁸ protecting “mental integrity,” the Court recognised that the State has a duty to pre-empt the adverse effects of neurotechnological applications. Accordingly, it ordered Emotiv to delete the plaintiff’s brain data from its records and directed that the device be reviewed by relevant public authorities before further commercial distribution.

The ruling, while progressive, does not establish concrete obligations for neurotechnology firms regarding the scope of neural data protection, standards for consent, or justified exceptions for data processing. The case has therefore been criticised for recognising a fundamental right without providing an enforceable regulatory framework for its implementation⁴⁹.

Further reinforcing this framework, Chile introduced the Neuroprotection Bill , which seeks to establish specific legal protections around the access, storage, and sharing of neural data⁵⁰. However, as of early 2025, the Neuroprotection Bill remains pending and has not yet been enacted into binding law. The current framework, though working in the direction of strengthening mental integrity and data protections, does not explicitly answer the foundational question of who owns neural data. While the Chilean model leans toward individual control, it still falls short of codifying ownership as a legal entitlement leaving room for interpretive ambiguity, especially in cases involving commercial use.

Nonetheless, Chile’s achievements have garnered significant attention across neuroethics, human rights, and tech-policy communities⁵¹. For instance, In July 2023, Mexico announced its intent to follow Chile’s lead by drafting a constitutional amendment to Article 4, aiming to modernise its guarantees for health and human dignity in light of challenges posed by neurotechnology.⁵²

B) European Union

The European Union’s General Data Protection Regulation (GDPR)⁵³ is often hailed as the most comprehensive data protection regime globally⁵⁴. The regulation was adopted in 2016 and enforced since May 2018⁵⁵. It should be noted that For GDPR protections to apply, data must be both processed and personal.⁵⁶ Neural data easily satisfies both criteria. Article 4(2) of the GDPR⁵⁷ defines processing as “any operation or set of operations performed on personal data,” while Article 4(1)⁵⁸ recognises personal data as “any information relating to an identified or identifiable natural person.” Now, given their intimate link to cognitive identity and ability to reveal identifiable patterns, Neural signals undoubtedly fall within this scope⁵⁹.

Moreover, neural data may also be interpreted as falling under Article 9(1) of the GDPR⁶⁰, which deals with the “special categories” of personal data. Although neural data is not explicitly named, it can reasonably be classified under existing heads. For instance, when neural signals are processed for the purpose of identifying an individual, they may qualify as biometric data. Similarly, if the data reveals cognitive, emotional, or neurological information about a person, it may be considered health data⁶¹.

It should be noted that GDPR does not explicitly establish data ownership of Neural Data. However, it does offers control mechanisms. The same is known as “informed consent”.⁶² However, this consent is often static, one-time, and fails to accommodate the dynamic nature of BCI-generated neural data⁶³. For instance, data collected for clinical monitoring may later be reused to train machine learning models without explicit consent. Additionally, a large portion of neural output, referred to as “data exhaust,” is not actively used in device functioning but may still be collected, stored, and repurposed. This again bypasses user control altogether⁶⁴.

This is particularly troubling given the research exemption under Article 9(2)(j), which allows the processing of sensitive data including neural data⁶⁵. The same is primarily allowed when done for scientific research, subject to certain safeguards. However, the problem is that GDPR does not provide a clear definition of “research,” leaving ample space for private neurotech companies to invoke this clause, even in commercially motivated projects⁶⁶.

As stated above, at its core, the GDPR governs usage, not ownership. While it grants individuals rights like access, correction, and forgotten , it stops short of recognising neural data as a property right. This creates a legal vacuum, especially in neurotechnology, where brain signals are increasingly commodified. Once processed, neural data becomes entangled in corporate IP regimes, effectively detaching individuals from data that originates in their own minds. The result is a structural imbalance between user autonomy and corporate control.

IV. Cognitive sovereignty & the ethical crisis in neurotechnology

Today, it is a matter of ethical urgency to protect our cognitive sovereignty in the face of rapidly advancing neurotechnologies. While private companies claim ownership over the neural data generated through their devices, arguing that it is a direct output of their proprietary system. This narrative conveniently ignores a fundamental truth: neural data originates from the human brain itself. Treating such data as a corporate asset undermines the individual's right to mental privacy, agency, and control over their own mind.

Even in research settings, where participants may consent to neural data collection, a critical question remains: Can true consent exist when the average person cannot fully comprehend the depth of what they are surrendering? The line between voluntary participation and unintentional exploitation grows dangerously thin when the data in question is as personal as the human mind.

The following part outline the primary ethical and legal risks that arise when individuals lose control over their brain data.

1. Mental Privacy and the Limits of Consent

Article 12 of the Universal Declaration of Human Rights affirms that “no one shall be subjected to arbitrary interference with his privacy”⁶⁷. But in the age of BCI, this protection falters. Neural data is often collected passively and continuously, even without any active input from the user⁶⁸.

Consumer-grade BCIs increasingly rely on blanket user agreements, where companies hide broad terms of data access in dense fine print⁶⁹. Furthermore, when these agreements include ambiguous clauses on third-party data sharing, individuals often remain unaware of how their sensitive neural data is later accessed, stored, or repurposed⁷⁰.

Even where data protection laws like the GDPR exist, they fall short in requiring renewed consent for third-party sharing or changed processing purposes⁷¹. Under current regimes, once consent is given for sensitive data, companies are only required to inform the user about additional use and not seek their approval again⁷². As a result, Neuro data may be used for purposes such as predicting future consumer preferences⁷³ or even discriminating based on early signs of neurological conditions like Alzheimer’s without the individual ever being aware such profiling has taken place⁷⁴ among many similar examples.

Therefore, the danger lies in this structural asymmetry: individuals are expected to surrender cognitive data without a meaningful understanding of how it might be used, by whom, and for what ends. The static nature of current consent models fails to reflect the dynamic and intimate nature of neural information.

2. Cognitive Surveillance and Autonomy Violation

In 2022, the United Nations Human Rights Council raised serious alarms by citing reports that neurotechnologies were already being deployed for cognitive surveillance. In one instance, factory workers in Hangzhou, China were allegedly made to wear AI-linked helmets capable of decoding emotional states to assess productivity. Similarly, attention-monitoring devices have been introduced in classrooms to track students' focus in real time⁷⁵.

Furthermore, governments too have begun harnessing neural data⁷⁶. Intelligence agencies in the EU, US, and Canada often operate outside the boundaries of conventional data protection laws.⁷⁷ Although the GDPR places restrictions on private actors, intelligence bodies still retain wide leeway through mechanisms like the Data Retention Directive and international sharing alliances such as the Five Eyes⁷⁸. Therefore, Once collected, neural data held by private entities can often be accessed by government networks with little oversight or transparency.

In the case of Kyllo v. United States decision (2001)⁷⁹ , the U.S. Supreme Court held that using thermal imaging to detect heat inside a home violated the Fourth Amendment due to its unusual technological intrusiveness. If heat signatures can trigger constitutional protection, surely the decoding of thoughts, emotions, and intentions through neuro devices must demand an even stronger privacy shield⁸⁰

Bottom of Form

Even if BCIs never reach mass adoption, the broader trajectory of hyper-personal surveillance is unmistakable. Regulatory responses must evolve beyond passive protections to actively defend cognitive liberty in the face of unprecedented intrusions.

3. The Challenge of Forgetting Neural Data

The right to be forgotten, enshrined in Article 17 of the GDPR, provides individuals with the legal ability to request the removal of their personal data⁸¹. This principle emerged prominently in the Google Spain case (2014)⁸², where the Court of Justice of the European Union emphasized the importance of protecting personal dignity by allowing individuals to control how their data is disseminated. Under this framework, once personal data is deemed irrelevant or excessive, it should be erased, reinforcing the privacy rights of individuals.

However, the practical application of the right to be forgotten becomes far more complicated in the case of neural data. Unlike traditional data, which can be deleted or anonymized relatively easily, neural data is often embedded within complex systems and algorithms⁸³. Once brain activity is captured and processed by a BMI, it is integrated into AI models that analyze and infer patterns from that data. These algorithms rely on large datasets to operate effectively, meaning the erasure of neural data could disrupt the model’s function⁸⁴.

This issue is particularly pertinent in the context of BCIs, where the functionality of the device is closely tied to the accuracy of the neural data used to power it. Research has shown that the removal of even small portions of data from machine learning models can lead to a significant decline in their performance. In BMIs, this loss of data integrity can result in devices becoming less effective, potentially impairing their ability to decode neural signals and translate them into actions for the user⁸⁵.

Thus, while the right to be forgotten remains a vital privacy protection, the challenge of applying it to neural data raises complex questions about the balance between privacy rights and the technical limitations of modern neurotechnology. The deep integration of neural data into AI models creates a scenario where true erasure, in the traditional sense, is simply not feasible, which undermines the very notion of individual control over one’s cognitive data.

V. The way forward

Existing data protection regimes, while commendable in intention, fall short of grappling with the intimacy, vulnerability, and permanence of brain-derived data. Many jurisdictions now stand at a critical juncture. The following considerations outline the foundational pillars of a more ethically aligned and legally coherent path forward:

A) Towards A Consent Regime That Works

Every new use or disclosure of neural data must trigger a transparent, and informed consent process. It must be ensured that the same is not buried under legalese or pre-checked boxes. The right to access, as provided under Article 15 of the GDPR⁸⁶, should not just exist on paper. Furthermore, Users must not only agree, but understand what they are agreeing to. The purpose for which brain data is being used, be it diagnostics, advertisements, or AI model training. The same must be clearly spelled out in language that reflects the user’s capacity to meaningfully consent.

The right to access, as provided under Article 15 of the GDPR⁸⁷, should not just exist on paper. When it comes to brain data, simply handing over millions of incomprehensible data points serves no real purpose. For this right to be meaningful, companies must summarize and present neural data in formats that are intelligible and accessible.

Furthermore, the Minnesota Neurodata Bill⁸⁸ stands out for its explicit departure from the outdated model of one-time consent. It mandates independent notice and separate consent for each specific use and every instance of third-party disclosure, effectively addressing the shortcomings of static, blanket agreements. Crucially, the burden of shaping informed consent should not fall on individuals alone. Hospitals, companies, and neurotechnology developers must take collective responsibility in designing user-friendly consent tools, whether through interactive interfaces, decision aids, or simplified data visualisation dashboards, ensuring users are empowered with clarity rather than overwhelmed by complexity.

B) Towards a Surveillance-Resistant Framework

If surveillance through neurotechnology is to be addressed meaningfully, it is imperative to shift from reactive safeguards to proactive structural limits. First, brain data must be explicitly excluded from intelligence loopholes and brought under specialized legal scrutiny, especially when sourced from consumer devices. Drawing inspiration from Kyllo⁸⁹, any neural data collection that reveals private cognitive activity should require judicial oversight and strict necessity thresholds.

Second, the “right to be forgotten” must be adapted to cognitive contexts by mandating not just erasure, but traceable deletion logs, data withdrawal from AI training sets, and human-readable summaries of stored brain data. Finally, no data collected under private usage should be repurposed or handed to public authorities without a court order and user notification. Autonomy begins where opaque access ends . Any framework that fails to safeguard mental privacy in both commercial and state hands risks undermines the very foundation of individual liberty.

C) Towards Real Erasure

With respect to the right to be forgotten, companies must focus on ensuring meaningful and enforceable safeguards. Firstly, neural data used in AI models should be subject to traceable and auditable deletion mechanisms, rather than merely surface-level removals that do not affect the underlying insights derived from the data. Secondly, regulators must require that brain data be excluded from algorithmic training pipelines unless there is explicit, informed, and dynamic consent from the user. Lastly, any data linked to mental health, cognitive performance, or emotional vulnerability must be treated with heightened sensitivity—on par with medical records. This ensures that the right to mental integrity moves beyond aspiration and becomes a practical, enforceable standard.

VI. Conclusion

José Iglesias, an expert in neurorights and labor in Uruguay, recently stated, "These technologies are being given to us—but we are not producing them," and warned, "We should not be naive enough to think that the tech industry will regulate itself⁹⁰." These words resonate deeply in today’s neurotechnology landscape, where innovation continues to outpace regulation. As Brain-Computer Interfaces (BCIs) move beyond intention detection and edge closer to decoding emotions, memories, and cognitive patterns, the urgency of legal intervention can no longer be overstated.

This paper has argued that neural data, by virtue of its origin in the human brain and its intimate connection to one’s identity, requires specialised legal protection. Its unique sensitivity cannot be adequately addressed through existing, generalised data protection frameworks. The comparative analysis of Chile and the European Union demonstrates this gap: while Chile has taken symbolic steps by constitutionalising mental integrity and proposing a neuroprotection bill, the EU continues to lead in procedural safeguards under the GDPR while still lacking in tailored provisions for the neural Data related issues. Both models, though promising in parts, reveal the absence of a comprehensive, neuro-specific legal architecture that fully responds to the risks of commodification, profiling, and long-term data repurposing.

However, the real issue is not simply about ownership, but about cognitive sovereignty. The right of individuals to maintain control over their mental processes in the face of growing corporate and state intrusion. This paper has shown how informed consent remains static and often opaque, how neural surveillance is rapidly normalised, and how the application of rights like the right to be forgotten is fundamentally challenged in an AI-driven neurotech ecosystem.

If individual autonomy is to be preserved in this new era of technological intimacy, legal systems must evolve beyond abstract rights. Regulation must reflect the material realities of data extraction, profiling, and power asymmetries. Consent must be dynamic and intelligible, access must be user-oriented and meaningful, and deletion must be technically feasible and enforceable. Above all, individuals must never be reduced to streams of brain data within opaque systems they neither built nor understand.

*****

VII. References

1. Asher-Schapiro, A., & Baptista, D. (2023, September 12). Hands off my brainwaves: Latin America in race for 'neurorights'. Context. https://www.context.news/digital-rights/hands-off-my-brainwaves-latin-america-in-race-for-neurorights

2. Billauer, B. P. (2021). The bionic plaintiff and the cyborg defendant: Liability in the age of brain-to-computer interface. Virginia Journal of Law & Technology, 25(2), 38–111.

3. Caminatti, F. R. (2023). Copyrighting Brain Computer Interface: Where Neuroengineering Meets Intellectual Property Law. Cybaris: An Intellectual Property Law Review, 14, 1–32.

4. Cornejo-Plaza, M. I., & Saracini, C. (2023). On pharmacological neuroenhancement as part of the new neurorights' pioneering legislation in Chile: A perspective. Frontiers in Psychology, 14, 1177720. https://doi.org/10.3389/fpsyg.2023.1177720

5. Cornejo-Plaza, M. I., Cippitani, R., & Pasquino, V. (2024). Chilean Supreme Court ruling on the protection of brain activity: Neurorights, personal data protection, and neurodata. Frontiers in Psychology, 15, 1330439. https://doi.org/10.3389/fpsyg.2024.1330439

6. Cuthbertson, A. (2020, August 29). Elon Musk unveils working Neuralink chip that connects brain directly to computer. The Independent. https://www.independent.co.uk/tech/elon-musk-neuralink-brain-computer-chip-a9695036.html

7. Cuthbertson, A. (2021, December 27). Brain chip allows paralysed man to post first ever ‘direct-thought’ tweet. The Independent. https://www.independent.co.uk/tech/brain-chip-als-synchron-neuralink-computer-b1982745.html

8. Dodgson, L. (2022, September 15). What is a brain-computer interface and how does it work? Business Insider. https://www.businessinsider.com/brain-computer-interface-what-is-it-how-does-it-work-2022-9

9. Do, B., Badillo, M., Cantz, R., & Spivack, J. (2024, March 20). Privacy and the rise of “neurorights” in Latin America. Future of Privacy Forum. https://fpf.org/blog/privacy-and-the-rise-of-neurorights-in-latin-america/

10. Eden, G. W. (2020). Targeting Mr. Roboto: Distinguishing humanity in brain-computer interfaces. Military Law Review, 228(2), 1–51.

11. Edelman, B. J., Zhang, S., Schalk, G., Brunner, P., Muller-Putz, G., Guan, C., & He, B. (2025). Non-invasive brain-computer interfaces: State of the art and trends. IEEE Reviews in Biomedical Engineering, 18, 26–49. https://doi.org/10.1109/RBME.2024.3449790

12. Eke, D., et al. (2021). Pseudonymisation of neuroimages and data protection: Increasing access to data while retaining scientific utility. NeuroImage: Reports, 1(4), 100053. https://doi.org/10.1016/j.ynirp.2021.100053

13. European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L119, 1–88. https://eur-lex.europa.eu/eli/reg/2016/679/oj

14. Genser, J., Damianos, S., & Yuste, R. (2024). Safeguarding brain data: Assessing the privacy practices of consumer neurotechnology companies (NeuroRights Foundation Report, April 2024). NeuroRights Foundation. https:/perseus-strategies.com/wp-content/uploads/2024/04/FINAL_Consumer_Neurotechnology_Report_Neurorights_Foundation_April-1.pdf

15. Goering, S., Klein, E., Specker Sullivan, L., et al. (2021). Recommendations for responsible development and application of neurotechnologies. Neuroethics, 14, 365–386. https://doi.org/10.1007/s12152-021-09468-6

16. Government of Chile. (1999, August 28). Law No. 19.628 on the Protection of Private Life. Official Gazette of the Republic of Chile.

17. Greenberg, A. (2019). Inside the mind's eye: An international perspective on data privacy law in the age of brain machine interfaces. Albany Law Journal of Science & Technology, 29(1).

18. Heine, I. (2021, September 13). 3 years later: An analysis of GDPR enforcement. Strategic Technologies Blog. Center for Strategic and International Studies. https://www.csis.org/blogs/strategic-technologies-blog/3-years-later-analysis-gdpr-enforcement

19. Hildt, E. (2010). Brain-computer interaction and medical access to the brain: Individual, social and ethical implications. Studies in Ethics, Law, and Technology, 4(3), 1–20.

20. House Bill 24-1058, 74th Gen. Assemb., Reg. Sess. (2024).

21. Information Commissioner’s Office. (2024). ICO tech futures: Neurotechnology (Version 0.1).https://ico.org.uk/media/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/ico-tech-futures-neurotechnology-0-1.pdf

22. ISO/IEC JTC 1/SC 43. (2025). *2025 BCI technology report: Brain-computer interface symposium – Bridging innovation and application*. International Electrotechnical Commission.https://jtc1info.org/wpcontent/uploads/2025/01/2025_BCI_Technology_Report.pdf

23. Istace, T. (2024, December). Neurodata: Navigating GDPR and AI Act compliance in the context of neurotechnology. Geneva Academy. https://preview.geneva-academy.ch/joomlatools-files/docman-files/Neurodata%20-%20Navigating%20GDPR%20and%20AI%20Act%20Compliance%20in%20the%20Context%20of%20Neurotechnology.pdf

24. Johnson, W. (2024, December 2). What are neural data? An invitation to flexible regulatory implementation. Stanford Law School Blog. https://surl.li/sedgep

25. Jwa, A., & Poldrack, R. (2022). Addressing privacy risk in neuroscience data: From data protection to harm prevention. Journal of Law and the Biosciences, 9, lsac025. https://doi.org/10.1093/jlb/lsac025

26. Ken Research. (2023, November). Asia Pacific brain computer interface market outlook to 2028: Surge in adoption of wearable BCI devices and growing demand in healthcare sector to drive market growth. Ken Research. https://www.kenresearch.com/industry-reports/asia-pacific-brain-computer-interface-market

27. Khan, S., Cole, D., & Ekbia, H. (2024). Autonomy and free thought in brain-computer interactions: Review of legal precedent for precautionary regulation of consumer products. UC Law Science and Technology Journal, 15(1).

28. Landis, B. (2024). Brain-computer interfaces and bioethical implications on society: Friend or foe? St. Thomas Law Review, 36(2), 127–152.

29. Lawrence, C., Shapiro, Z. E., & Fins, J. J. (2019). Brain-computer interfaces and the right to be heard: Calibrating legal and clinical norms in pursuit of the patient's voice. Harvard Journal of Law & Technology, 33(1), 167–202.

30. Liv, N. (2021). Neurolaw: Brain-computer interfaces. University of St. Thomas Journal of Law and Public Policy (Minnesota), 15(1), 328–355.

31. Malle, B., Schrittwieser, S., Kieseberg, P., & Holzinger, A. (2016). Privacy aware machine learning and the right to be forgotten. ERCIM News, 107(10), 22–23.

32. Minnesota Legislature. (2023–2024). HF 1904.

33. Morris, P. S. (2016). ‘War crimes’ against privacy – The jurisdiction of data and international law. Suffolk University Journal of High Technology Law, 17, 1–42. https://ssrn.com/abstract=2897465

34. Mridha, M. F., et al. (2021). Brain-computer interface: Advancement and challenges. Sensors, 21(17), 5746. https://pmc.ncbi.nlm.nih.gov/articles/PMC8433803/

35. Neuralink. (n.d.). Home. Neuralink. https://www.neuralink.com/

36. Organisation for Economic Co-operation and Development. (2019, December 11). Recommendation of the Council on Responsible Innovation in Neurotechnology (OECD Legal Instrument No. 0457). https://legalinstruments.oecd.org/en/instruments/oecd-legal-0457

37. Proton AG. (n.d.). What is GDPR, the EU’s new data protection law? GDPR.eu. https://gdpr.eu/what-is-gdpr/

38. Pulicharla, M. R. (2023). AI-powered neuroprosthetics for brain-computer interfaces (BCIs). *EDUZONE: International Peer Reviewed/Refereed Multidisciplinary Journal, 12*(1), [page range if known]. http://www.eduzonejournal.com

39. Quezada-Tavarez, K., Dutkiewicz, L., & Krack, N. (2022). Voicing challenges: GDPR and AI research [version 1; peer review: 2 approved with reservations]. Open Research Europe, 2, 126. https://doi.org/10.12688/openreseurope.15145.1

40. Rabbi, M. F., et al. (2022). BCI-based consumers' choice prediction from EEG signals: An intelligent neuromarketing framework. Frontiers in Human Neuroscience, 16, Article 861270. https://doi.org/10.3389/fnhum.2022.861270

41. Rainey, S., et al. (2020). Is the European data protection regulation sufficient to deal with emerging data concerns relating to neurotechnology? Journal of Law and the Biosciences, 7(1), lsaa051. https://doi.org/10.1093/jlb/lsaa051

42. Rothermich, E. (2022). Mind games: How robots can help regulate brain-computer interfaces. University of Pennsylvania Journal of Law & Public Affairs, 7(2), 391–431.

43. Ruiz, S., et al. (2024). Neurorights in the constitution: From neurotechnology to ethics and politics. Philosophical Transactions of the Royal Society B: Biological Sciences, 379(1899), 20230098. https://doi.org/10.1098/rstb.2023.0098

44. Seshadri, N. (2021, October 2). Chile becomes first country to pass neuro-rights law. JURIST. https://www.jurist.org/news/2021/10/chile-becomes-first-country-to-pass-neuro-rights-law/

45. Singh, R. (Ed.). (2021, December 29). ‘Hello, World’: Paralysed man posts tweet using only his mind, thanks to a brain implant. India.com. https://www.india.com/viral/viral-news-paralysed-man-posts-tweet-using-only-his-mind-brain-implant-direct-thought-tweet-5161601/

46. Spino, J. (2024). Brain data availability presents unique privacy challenges. AJOB Neuroscience, 15(2), 146–148. https://doi.org/10.1080/21507740.2024.2326881

47. Synchron. (n.d.). Home. Synchron. https://www.synchron.com/

48. United Nations. (1948). Universal Declaration of Human Rights, Article 12. https://www.un.org/en/about-us/universal-declaration-of-human-rights

49. Yang, H., & Jiang, L. (2025). Regulating neural data processing in the age of BCIs: Ethical concerns and legal approaches. Digital Health, 11, 1–19. https://journals.sagepub.com/doi/full/10.1177/20552076251326123

50. Zander, T. O., Kothe, C., Jatzev, S., & Gaertner, M. (2010). Enhancing human-computer interaction with input from active and passive brain-computer interfaces. In D. Tan & A. Nijholt (Eds.), Brain-computer interfaces (pp. 181–199). Springer.

*****