Neural data as the newest frontier in data privacy

The IAPP reports that the Federal Trade Commission Act empowers the U.S. FTC to pursue unfair or deceptive trade practices, which can include collection, use and sharing of neural data.[1] The IAPP adds that some FTC rules, such as the Health Breach Notification Rule, are also likely to apply to the collection of neural data.[1]The IAPP also says the FTC's regulatory power is constrained by its inability to directly regulate medical devices[1]. It says that power is also limited by the case-by-case manner in which unfair or deceptive trade practices tests are applied.[1]At the state level, Sigma Law Group reports that Connecticut expanded its Data Privacy Act to treat neural data as sensitive[2]. According to PrivacyOn, Connecticut joins Colorado, California, and Montana[3] in protecting brain data.KFF Health News reports that Colorado and Montana require initial express consent to collect or use neural data and separate consent or the ability to opt out before disclosing that data to a third party.[4]Outside the U.S., the IAPP reports that Canada's privacy commissioner added neural data among the types of personal information that will generally be considered sensitive[5]. According to a separate IAPP report, the U.K. Information Commissioner's Office is targeting early 2027 to send neurodata privacy guidance out for public[6] consultation.The IAPP also quotes OECD policy analyst Christina Michelakaki, who said that "effective governance should be risk-based, context-specific, innovation-friendly and privacy protective."[6]