Info Gov

Brain data should receive stronger legal protections than other forms of personal data, according to a Citizens’ Jury established as part of research commissioned by the Information Commissioner’s Office (ICO).

A report on the project’s findings also found that the jury – made up of 20 members of the public – backed tighter restrictions on how such data can be collected and used.

Neurotechnology, also known as neurotech, is broadly defined in the report as devices that can record and/or send electrical signals to the brain and nervous system.

The information watchdog commissioned the research, which was carried out by the Centre for Collective Intelligence, in light of developments in the sector which have seen the technology extend beyond healthcare into more consumer-facing applications.

According to the report, most jurors were enthusiastic about the technology’s potential, particularly for medical uses like Parkinson’s treatment, cochlear implants, and managing conditions like ADHD or dementia.

But this support was contingent on there being “robust” data security and privacy rules in place, it said.

Jurors raised concerns that highly sensitive, intimate neurodata could be hacked by malicious actors or used by commercial entities for targeted marketing.

In light of these concerns, the jurors supported clear regulatory standards to build public confidence – and a new legal category.

A new legal category for brain data should be introduced to account for the difference, and mitigate the risk of exploitation of legal loopholes by commercial actors, according to the jury.

Desired new regulatory standards included restrictions on neurodata collection from children or vulnerable people, restrictions on uses of neurodata for marketing or access to services, and stricter regulations for ‘read-write’ devices.

Jurors concluded that brain data is “fundamentally different” from other forms of personal data, as it inherently captures subconscious thoughts and intentions that individuals cannot fully control.

The jury met over three online sessions which involved informational videos, specialist input and discussions guided by expert facilitators.

Also in this section

Sep 11, 2026

ICO opens investigation into Police Scotland's handling of subject access requests

The Information Commissioner's Office has opened an investigation into Police Scotland's handling of subject access requests, seeking to establish whether the force has failed, or is failing, to comply with its obligations under Articles 12 and 15 of the UK GDPR and section 45 of the Data Protection Act 2018, including responding to requests within the statutory timescale.
Jul 30, 2026

Section 166 application succeeds as tribunal finds ICO left complaints unresolved

The First-tier Tribunal (General Regulatory Chamber) has ordered the Information Commissioner to take further steps and issue a written outcome on a data protection complaint after finding that the regulator invited the complainant to return if dissatisfied with the department's response, received her further material but then did not demonstrate that it had concluded the complaints.

InfoGov Masthead Newsletter 800