Montana Takes Neural Privacy Regulation in New Directions, Says Morrison Foerster
A Montana neurotechnology privacy law enacted this year “signals a shift toward integrating neural data protections within existing biological data laws,” Morrison Foerster lawyers Linda Clark, Melissa Crespo and Katherine Wang blogged Friday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Set to take effect Oct. 1, the Montana law adds neurotechnology data to the state’s Genetic Information Privacy Act (GIPA) (see 2504030066 and 2505150036). The third state to regulate neural data, Montana is part of a trend that has states looking to craft privacy rules for neurotechnology, according to Future of Privacy Forum (see 2508120003).
Unlike two previous neural privacy laws in California and Colorado, “Montana’s addition affects the state’s genetic privacy statute instead of a more general consumer privacy law,” said the Morrison Foerster lawyers.
While Montana didn’t expand what companies are regulated under GIPA, it added a definition of neurotechnology data that is broader than in the California and Colorado measures, the lawyers added. “For instance, Montana may include passive electroencephalography … monitoring as ‘neurotechnology data’ even if no further processing or assessment of the data occurs.”
Another notable difference from California’s law is that Montana specifically defined non-neural information that is excluded from regulation, the lawyers said. “For example, if an individual wears an EEG headset during a memory test, electrical signals generated in response to stimuli would be considered ‘neurotechnology data,’ but a physiological response, such as sweating, would be classified as nonneural information and would not be covered by the amendments to GIPA.”
Montana also went beyond Colorado and California by requiring data localization, the privacy attorneys said. “If neurotechnology data collected from a Montana resident is stored or transferred outside the United States, the individual must provide consent, and GIPA explicitly prohibits neurotechnology data collected from Montana residents within the state from being stored in any country sanctioned by the U.S. Office of Foreign Assets Control or designated as a ‘foreign adversary’” under federal code