Abstract

The rapid emergence of Brain-Computer Interfaces (BCIs) marks a defining moment in human–machine interaction, transforming thought into action and reshaping the boundaries of cognition, autonomy, and privacy. Originally developed to assist individuals with severe neurological conditions, BCIs are now increasingly being adapted for non-medical contexts, including education, employment, and surveillance which raises urgent ethical and legal questions. At the core of these concerns lies neural data: intimate, continuous, and revealing information derived directly from brain activity. This paper explores the nature of neural data and critically evaluates the regulatory responses to its collection, processing, and commodification. Through a doctrinal and comparative legal analysis, the paper examines how jurisdictions like Chile and the European Union have attempted to address the risks associated with BCIs and neural data governance. While Chile has pioneered the constitutional right to mental integrity and proposed neuro-specific protections, the EU’s GDPR which is robust in general data protection, lacks clarity when it comes to the unique vulnerabilities posed by brain data. Furthermore, after Drawing on case law, legislative developments, and international policy instruments, this paper identifies significant gaps in consent mechanisms, ownership models, and surveillance safeguards. In this backdrop, the paper argues for a future-facing legal framework grounded in cognitive sovereignty. It asks for recognition of neural data as qualitatively distinct and demands dynamic, intelligible consent, enforceable rights to access and erasure, and explicit limitations on corporate and state intrusions. It is stated unequivocally that without such controls, the monetisation of the mind risks becoming the next frontier of digital exploitation.

Keywords