Chilean Supreme Court ruling on the protection of brain activity: neurorights, personal data protection, and neurodata

The paper analyzes Chilean Supreme Court ruling rol N 1.080-2020 (August 9, 2023) arising from a constitutional protection action by Senator Guido Girardi Lavín against Emotiv Inc., which markets the Insight EEG headset in Chile. The core research questions are whether neurodata collected by such devices should be treated as personal data and/or classified as a special category (sensitive) of data, whether existing data protection regimes (Chile’s Law N 19.628 and the EU GDPR) adequately protect neurodata, and whether a broader framework of “neurorights” is needed. Contextually, Emotiv’s device collects brain electrical activity; the company claims anonymization/pseudonymization, storage in the cloud, and consent-based processing, while the complainant alleges risks such as reidentification, hacking, unauthorized reuse, commercialization, surveillance, and use without consent. Additional issues include informed consent in research, lack of local health authority authorization for the device, and contractual constraints (e.g., access to neurodata conditioned on a paid “PRO” account). The introduction also flags potential safety concerns with DIY neurostimulation (tDCS) and frames the case as the first worldwide judgment on “neurodata,” motivating a legal and ethical analysis to determine whether current data protection law suffices or whether specific instruments and neurorights are required.

The article conducts a doctrinal legal analysis of the Chilean Supreme Court’s Girardi/Emotiv judgment. It examines statutory and regulatory frameworks (Chile’s Law N 19.628, Law 20.120, Law N 21.383; EU GDPR; OECD recommendations), compares concepts such as personal data, special category data, biometric and health data, and considers jurisprudence (CJEU) and policy texts. It analyzes the device’s contractual and consent arrangements, consumer protection implications (including EU Directive 2005/29/EC), and integrates neuroethics literature to assess neurorights (mental privacy, cognitive liberty, psychological integrity). The paper synthesizes these sources to evaluate whether neurodata fit within existing regimes or require tailored protections.

• Neurodata challenge existing data protection regimes: their interpretive nature and potential to reveal mental states and intentions raise risks not fully addressed by current laws.
• Depending on context and identifiability, neurodata can be personal data; identifiability may evolve with technology, making formerly non-identifying data potentially identifying over time.
• Neurodata are not explicitly recognized as a special category in current Chilean law or the GDPR, but may qualify as health-related or biometric data in certain uses; the authors argue neurodata should be treated as sensitive data due to the intimate aspects of personality involved.
• The notion of “neurodata exceptionalism” parallels genetic exceptionalism: neurodata’s unique properties justify tailored safeguards beyond generic data protection rules.
• Informed, specific consent for research purposes is essential and cannot be presumed from general device-use consent or broad anonymization claims; pseudonymization may not suffice to prevent reidentification risks.
• Consumer protection concerns arise where device functionality is conditioned on acceptance of terms that grant broad, potentially irrevocable licenses over recorded data, possibly constituting misleading or aggressive commercial practices.
• Chile’s constitutional and legislative developments (Law N 21.383; neurorights bill Bulletin 13.828-19) recognize the need to safeguard brain activity and neurodata, positioning Chile as a pioneer and highlighting neurorights as a framework beyond personal data protection.
• The Court’s ruling underscores the need for proactive state action to protect human integrity, including privacy and confidentiality, in light of rapidly evolving neurotechnologies.

The analysis shows that while existing data protection frameworks offer partial coverage, they are ill-fitted to the specific informational content and risks of neurodata. This addresses the research question by demonstrating that neurodata may be personal and potentially sensitive data, yet their distinct capacity to model or infer mental states demands heightened protection. The discussion situates neurorights—mental privacy, cognitive liberty, psychological integrity, freedom of thought, fair algorithmic treatment, and equitable access to neuroenhancement—as a more comprehensive rights-based response to the governance challenges posed by neurotechnologies. It also highlights the importance of specific, purpose-bound research consent, recognizing that generic consent tied to device usage is inadequate. Furthermore, it stresses the consumer protection dimension: contractual practices that condition device usability on expansive data licenses or restrict user control over neurodata can distort consent formation and may be unfair, calling for regulatory scrutiny. Finally, the paper emphasizes that regulatory schemes must consider both structural (potentially enduring) and functional (episodic) neurodata properties, as structural data may more profoundly affect identity, privacy, and psychological integrity.

The paper concludes that neurodata’s unique characteristics and risks are insufficiently addressed by current personal data protection regimes. It recommends recognizing neurodata as sensitive data, requiring specific, informed consent for research uses, and developing targeted legal frameworks that incorporate neurorights to safeguard mental privacy, cognitive liberty, psychological integrity, freedom of thought, and fairness in neurotechnology deployment. Consumer protection mechanisms should address potentially misleading or aggressive practices in device marketing and data licensing. Future work should refine the conceptual and legal architecture of neurorights, clarify classifications of neurodata (structural vs. functional), and ensure interoperability with data protection and AI governance regimes to keep pace with technological advancements and evolving societal needs.

The article is a legal-doctrinal analysis centered on one national Supreme Court ruling and related Chilean and EU frameworks; it does not present empirical data or technical validation of identifiability risks. The ruling itself left some issues unaddressed (e.g., neurotechnology-enabled identification and its broader rights impacts), and ongoing legislative processes in Chile mean the regulatory landscape is evolving. Conclusions about consumer practices and reidentification risks rely on existing literature and policy reasoning rather than case-specific technical audits.