California’s governor has signed an amendment to CCPA, the state’s well-known privacy law. While California was the first to pass a “comprehensive” privacy law, it is the second -with this new amendment- to include “neural data” to the definition of sensitive personal information. It follows Colorado, which added this information to its law earlier this year. Unlike Colorado, the modification will not go into effect until January 1, 2025. (Colorado’s amendment, on the other hand, became effective at the beginning of August.)
While the language of the two state’s definition of what constitutes neural data similar, they are not identical. California defines neural data as information that is “generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.” Colorado, on the other hand, defines it as “information . . . generated by the measurement of the activity of an individual’s central or peripheral nervous system and that can be processed by or with the assistance of a device.” (Emphasis added on both.)
Putting It Into Practice: As a reminder, for companies that process sensitive data in California, obligations include giving people choices about how that information is processed, providing notice around the collection and use of that information, and limiting use of that information to the purposes for which it was collected.
