New Research Brief Evaluates the Effectiveness of GDPR in Mitigating Risks Associated with the Distinctive Nature of Neurodata

21 January 2025

Advances in neurotechnology (NT) have driven the growing collection and processing of neurodata – data related to the structure and functioning of the human brain – across various societal domains. The development and use of NTs heavily depend on neurodata to ensure device functionality (e.g., neurofeedback monitors or brain-computer interfaces) and to enhance performance by refining AI algorithms integrated into these devices.

In our new Research Brief, ‘Neurodata: Navigating GDPR and AI Act Compliance in the Context of Neurotechnology’, Timo Istace highlights the delicate balance needed between leveraging neurodata for progress and protecting individual rights. He notes that ‘the indispensability of neurodata to fuelling progress in the sector needs to be balanced against the risks to individual users. Neurodata is a highly sensitive and personal form of data, akin to genetic data. Its combined features – including its informational richness (extending to cognitive processes), predictive potential, and risk of involuntary disclosure – warrant significant scrutiny to preserve individuals’ privacy, particularly mental privacy.’

Timo further explains, ‘Data protection regulations are crucial in addressing these concerns. The sensitive nature of neurodata raises questions around whether current regulatory frameworks offer adequate protection against incursions on mental privacy and the safeguarding of neurodata. While no supranational regulation specifically addresses neurodata, regional instruments like the EU’s General Data Protection Regulation (2018) provide a framework for assessing protection measures.’

This paper evaluates the effectiveness of the GDPR in mitigating risks associated with the distinctive nature of neurodata, with the goal of safeguarding neuroprivacy and mental privacy in the context of emerging NTs. It analyzes the scope and applicability of the GDPR, examines the challenges of ensuring robust protection during the collection, processing, storage, and transfer of neurodata, and considers how the recent EU AI Act might complement or reinforce GDPR safeguards.

MORE ON THIS THEMATIC AREA

GHRP Ai for Good Workshop News

Exploring the Role of Artificial Intelligence in Human Rights Monitoring: Key Takeaways from the AI for Good Workshop

22 July 2025

Our event brought together human rights practitioners, data scientists, and AI experts to explore how artificial intelligence can support efforts to monitor human rights and the Sustainable Development Goals.

Read more

FORTAJUS-DH Logo News

In Highlight: FORTAJUS-DH – Human Rights Monitoring System

7 October 2025

Via its DHRTTDs Directory, the Geneva Human Rights Platform provides a comprehensive list and description of such key tools and databases. But how to navigate them? Which tool should be used for what, and by whom? This interview helps us understand better the specificities of the current highlight of the directory: FORTAJUS-DH – Human Rights Monitoring System

Read more

surveillance image of people Project

Human Rights in a Digitalized World: Mapping Risk, Strengthening Regulation and Promoting the Development of International Human Rights Law

Started in August 2023

To unpack the challenges raised by artificial intelligence, this project will target two emerging and under-researched areas: digital military technologies and neurotechnology.

Read more

Online folders Project

Digital Human Rights Tracking Tools and Databases

Started in March 2023

This initiative wishes to contribute to better and more coordinated implementation, reporting and follow-up of international human rights recommendations through a global study on digital human rights tracking tools and databases.

Read more

Cover of the 2023 Geneva Academy Annual Report Publication

Annual Report 2024

published on July 2025

Read more