On 27 June 2024, the Spanish supervisory authority (‘AEPD’) and the European Data Protection Supervisor (‘EDPS’), announced the joint publication of a report addressing the data protection challenges associated with neuro data processing.
The ICO published a report on the same topic earlier in June, available here.
Neuro data, derived from monitoring the activity of the brain and nervous system, is increasingly used beyond clinical and research settings, finding applications in marketing, consumer behaviour analysis, education, entertainment, and even brain implants that can alter brain activity.
The report highlights the risks associated with neuro data including the potential for significant infringement on individuals' fundamental rights and freedoms. Specifically, the AEPD and EDPS address the following points.
- How neuro data is handled and the potential risks across various scenarios, including educational settings and video-gaming.
- The principles related to data protection, under Article 6 of the GDPR, that need to be adhered to when dealing with this kind of data processing. These principles include proportionality, precision, openness, and equity.
- The handling of sensitive data categories, such as biometric or health-related information, under Article 9 GDPR, as well as clarifying that processing this type of data is generally forbidden unless it falls under a specific exemption.
- The intrusive aspect of such data processing activities, specifically that the entities responsible for the processing must provide a clear rationale for their processing objectives and conduct a thorough evaluation of how these activities might affect fundamental human rights.
The press release is available here (in Spanish only), and the report is available in Spanish here and in English here.
[View source.]
