Elements for the development of a model law on neurotechnologies and the processing of neurodata from the perspective of the right to privacy

The brain determines, among other things, the behaviour, personality, essence and imprint of any individual, which make that individual unique and different from other individuals. Indeed, according to Manes and Niro, “if we underwent a kidney or lung transplant, we would still be ourselves; if our brains were changed, however, we would become different people”.¹ Highlighting the greatness of the brain, they state that “the human brain is the most complex structure in the universe … The brain dictates all our mental activity – from unconscious processes, such as breathing, to the most elaborate philosophical thoughts – and contains more neurons than there are stars in the galaxy”.²

1. Facundo Manes and Mateo Niro, Usar el cerebro: conocer nuestra mente para vivir mejor, 4th ed. (Autonomous City of Buenos Aires, Editorial Planeta, 2014), p. 8. ↩
2. Ibid. ↩

According to the Neurorights Foundation, the “human brain is unlike any other organ, as it generates all of our mental and cognitive activities. The data it produces is unlike any other data, as it reflects mental processing. Neural data, which refers to information directly reflecting the activity of an individual’s central or peripheral nervous systems, is therefore capable of revealing enormously sensitive information about the people from whom it was collected, including identifiable information about their mental health, physical health, and cognitive processing”.³

3. Jared Genser, Stephen Damianos and Rafael Yuste, Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies, Neurorights Foundation (April 2024). ↩

The Neurorights Foundation notes that “in the coming years, the sensitivity of neural data will only deepen as investments from the private sector, governments, and similar initiatives expand. This will result in improvements to the technical capabilities of neurotechnology, affording increased resolution of brain scans and larger datasets of brain data being collected, while generative artificial intelligence will accelerate the ability to accurately decode these scans. Meanwhile, implantable neurotechnologies can already accurately decode language and emotions, while wearable devices are beginning to have some of these capabilities as well. These developments have significant implications for mental privacy, highlighting the pressing importance of understanding the privacy practices and user protections provided by consumer neurotechnology companies”.⁴

4. Ibid. ↩

In its resolution 3384 (XXX), of 10 November 1975, on the use of scientific and technological progress in the interests of peace and for the benefit of mankind, the General Assembly noted that scientific and technological progress had become one of the most important factors in the development of human society, and that while it provided ever-increasing opportunities to better the conditions of life of peoples and nations, in a number of instances it could give rise to social problems, as well as threaten the human rights and fundamental freedoms of the individual. The Assembly also noted that scientific and technological achievements could entail dangers for the civil and political rights of the individual or of the group and for human dignity. In its resolution 58/6, of 2 April 2025, on neurotechnology and human rights, the Human Rights Council also noted with concern that the rapid development of neurotechnology presented challenges to physical and mental integrity and the safeguarding of human rights; and requested its Advisory Committee to draft a set of recommended guidelines for applying the existing human rights framework to the conception, design, development, testing, use and deployment of neurotechnologies and in doing so, to seek the views and inputs of all stakeholders.

At a time when technology is advancing at a dizzying pace, some authors have stated that “the global technological landscape has changed enormously, not only since the inception of the idea of the right to privacy, but also since the need to protect the rights of individuals against the improper processing of their personal data began to take hold”.⁵ The use of technology for the benefit of humanity and the protection of human rights are two essential pillars for laying the foundations of a humane, trustworthy, inclusive and human-centred society.

5. Nelson Remolina Angarita, Recoleccion internacional de datos personales: un reto del mundo post-internet (Madrid, Official Gazette and Data Protection Agency, April 2015), p. 361. ↩

Although innovations such as neurotechnologies offer many benefits, they also pose unprecedented challenges that require a clear response in order to preserve human dignity. This issue must be addressed in an objective and dispassionate manner in order to achieve a balance between human rights, innovation and development. It has been noted that “it is not wise to approach the issue in terms of ‘technophobia’ or ‘technofascination’. Innovation and development based on respect for human rights and human dignity will always be welcome. Blind and uncritical ‘technofascination’ poses many risks. We should not be submissive and conformist when it comes to what others want to do with our rights and our lives. If we allow ourselves to drift along, our rights could be eroded, or even lost entirely, and we may have to pay for those rights. We must wake up and take action to demand respect for our rights”.⁶

6. Ibid., p. 375. ↩

There is an urgent need to take measures to avoid the potential negative consequences of neurotechnologies for society in general, and for human rights and human dignity. In that connection, in its resolution 3384 (XXX), the General Assembly proclaimed, inter alia, as follows:
“7. All States shall take the necessary measures, including legislative measures, to ensure that the utilization of scientific and technological achievements promotes the fullest realization of human rights and fundamental freedoms without any discrimination whatsoever on grounds of race, sex, language or religious beliefs.

All States shall take effective measures, including legislative measures, to prevent and preclude the utilization of scientific and technological achievements to the detriment of human rights and fundamental freedoms and the dignity of the human person.”

The present report contains key inputs for the development of a model law on neurotechnologies and the processing of neurodata from the perspective of the right to privacy.

The Special Rapporteur on the right to privacy set out the foundations and principles for the regulation of neurotechnologies and the processing of neurodata from the perspective of the right to privacy in her report of 16 January 2025 (A/HRC/58/58). In that report, the Special Rapporteur reviewed United Nations documents on neurotechnologies and data processing,⁷ which highlight the relevance of such technologies, the risks of their misuse and the importance of establishing regulatory frameworks to protect human rights in the context of neurotechnologies.

7. In particular, she referred to the following documents: (i) Human Rights Council resolution 51/3, of 6 October 2022, on neurotechnology and human rights (A/HRC/RES/51/3); (ii) the report of the Special Rapporteur on the right to privacy entitled “Proposal for the updating of General Assembly resolution 45/95 of 14 December 1990, entitled ‘Guidelines for the regulation of computerized personal data files’”, of 17 July 2024 (A/79/173); and (iii) the report of the Human Rights Council Advisory Committee on the impact, opportunities and challenges of neurotechnology with regard to the promotion and protection of all human rights, of 8 August 2024 (A/HRC/57/61). She also referred to the working paper entitled “Emerging neurotechnologies and data protection”, presented at the seventy-fourth meeting of the International Working Group on Data Protection in Technology (Berlin Group), held on 17 and 18 November 2024 and published on 15 May 2025. ↩

The Special Rapporteur then defined neurotechnologies and highlighted their benefits,⁸ along with a number of risks to privacy, human dignity and society,⁹ and referred to brain data, or neurodata, as a special category of personal data that must be processed in a diligent, ethical and professional manner to ensure that individuals are protected and that their human dignity is safeguarded.

8. The benefits included the following: (i) conducting research to discover how the brain works and understand the scientific basis of the human mind; (ii) diagnosing, understanding and designing new therapies for neurological and neurodegenerative or psychiatric brain diseases, such as, Alzheimer’s, schizophrenia, Parkinson’s, epilepsy, mental impairment, stroke, lateral sclerosis, depression and anxiety, which are increasingly affecting a large percentage of the population and are a blight on humanity; (iii) encouraging the creation of brain-computer interface devices that connect directly to the Internet, and establishing a new industry with great economic and consumer benefits. ↩
9. The following risks were highlighted: (i) the use of neurotechnologies for purposes that are contrary to human dignity; (ii) artificial modification of human beings; (iii) causing physical damage or mental manipulation in human beings; (iv) improper processing of neurodata and their use for purposes that are contrary to human dignity or that are not authorized by law. ↩

The Special Rapporteur further noted that despite the mental health benefits that neurotechnologies would bring, there was a fear that neurodata would not only allow people to know what other people are thinking (which is not possible for now), but also to manipulate the human brain. For that reason, neurorights had recently been developed with the following aims:
(a) Preservation of a person’s privacy with respect to his or her brain (a person’s thoughts);
(b) The right to be as one is: the “right to the self”, to one’s natural cerebral identity;
(c) The right to decide for oneself, without artificial manipulation or programming;
(d) Neutral, unbiased neurotechnologies; biases should not be implanted in the human brain;
(e) Equitable access to neurotechnologies.

In the report, the Special Rapporteur also set out the following principles to guide the regulation of the use of neurotechnologies and the processing of neurodata:
• Human dignity
• Neurodata as highly sensitive personal data
• Mental privacy and consent for the processing of neurodata
• Ethics and the protection of human rights by design and by default in the development and use of neurotechnologies
• Precaution
• Demonstrated accountability, international transfer and safety in neurodata processing
• Non-discrimination
• Effective protection of the rights of individuals in the processing of neurodata.

In the light of the foregoing, the Special Rapporteur urged States:
(a) To promote the regulation of neurotechnologies and the processing of neurodata. It is essential that each country develop a specific regulatory framework for neurotechnologies and neurodata, given their potentially profound impact on privacy, human dignity and fundamental rights. The associated risks must be anticipated in the regulation to ensure the safe, ethical and responsible use of these technologies;
(b) To incorporate the foundations and principles for the regulation of the use of neurotechnologies and the processing of neurodata from the perspective of the right to privacy suggested in that report. The foundations and principles set out in the report, including the protection of human dignity, informed consent, ethics by design, the precautionary principle and non-discrimination, should be integrated into national legal frameworks. These principles will ensure a balance between technological innovation in neurotechnologies and the protection of human rights, with a particular focus on privacy and the proper processing of neurodata;
(c) To promote ethical practices in the use of neurotechnologies. It is essential to establish guidelines and oversee practices that guarantee the ethical use of neurotechnologies and ensure the proper processing of neurodata as highly sensitive information. These practices must prevent any improper use that could compromise privacy or give rise to discrimination;
(d) To promote education on neurotechnologies and neurodata. To ensure informed use of these technologies, States should promote public education on the benefits and risks associated with neurotechnologies. This will enable people to better understand their impact, make conscious decisions about their neurodata and demand that their rights be respected in this new technological era.

In 2024, the Neurorights Foundation published a study in which it analysed the privacy practices of consumer neurotechnology companies.¹⁰ According to the study, neurotechnologies are devices capable of recording or altering the activity of the nervous system, including the brain, spinal cord and peripheral nerves and, although these technologies are traditionally used in medical, scientific and research settings, some of them are readily available to consumers.

10. Jared Genser, Stephen Damianos and Rafael Yuste, Safeguarding Brain Data: Assessing the Privacy Practices of Consumer Neurotechnology Companies, Neurorights Foundation (April 2024). ↩

In the study, the authors present an assessment of the privacy policies and user agreements of 30 companies with publicly available neurotechnology products that can be purchased online, benchmarking them against global data protection standards. Their analysis focuses on five areas in relation to consumer neurotechnology products: access to information, data collection and storage, data-sharing, user rights, and data safety and security.

In the study, they conclude, inter alia, that: (i) consumers do not have adequate information about data practices, privacy or their rights as users; (ii) there is enormous ambiguity regarding whether companies consider neural data a form of personal data; (iii) data collection and storage practices are ambiguous; (iv) almost all the companies can share data with third parties; (v) the extent to which companies can or cannot sell data is unclear; (vi) user rights, such as withdrawing consent to data processing and requesting data deletion, are not uniformly extended; and (vii) the data safety and security provisions of consumer neurotechnology companies are generally ill-equipped to safeguard neural data.

The quantitative findings of the study include the following:
(a) 96.67 per cent of the companies have full access to users’ neural data;
(b) 73.33 per cent of the companies have general privacy policies on their websites that govern the use of their neurotechnology products;
(c) 60 per cent of the companies surveyed do not provide consumers with information on how their neural data are handled and what rights they have in relation to the data;
(d) 13.3 per cent of the companies have policies in which efforts to minimize the amount of data collected from neurotechnology consumers are explicitly mentioned;
(e) Only 43.33 per cent of the companies explicitly mention neural data in their policies;
(f) Only 6.67 per cent of the companies explicitly discuss data minimization, data retention and neurodata;
(g) 66.67 per cent of the companies acknowledge that they may share personal information with third parties.

In the study, the authors confirm that neurotechnologies are advancing more quickly than legislation and that current protections are insufficient. In that connection, an immediate, informed and globally coordinated response by States, among other things, is required in order to prevent abuse or acts contrary to human dignity. Regulation can no longer be reactive; it must be preventive, ethical and centred on human rights.

The authors warn that neural data reveal unique and deeply intimate information about individuals, such as their thoughts, emotions, mental states, neurological disorders, cognitive patterns and identity. In addition, neural data are biometrically identifiable, as in the case of DNA or fingerprints, and can be used to read thoughts, detect mental illnesses or infer personality traits without the user’s knowledge. This poses real and immediate risks to mental autonomy and the innermost privacy of human beings. Furthermore, neural data can be reprocessed or sold for purposes such as behavioural advertising, surveillance, discrimination or control.

According to the study, there is an alarming regulatory gap that allows neurotechnology companies:
(a) To access, store and process neural data without informed consent or clear boundaries;
(b) To develop opaque policies that do not expressly mention neural data or do not include effective mechanisms for communication, withdrawal of consent or deletion of data;
(c) To market technologies that are not subject to oversight or guarantees in the consumer market, even though they would be strictly regulated in a medical context.

The lack of specific regulations enables companies to exploit legal loopholes that can be used against human beings.

In 2025, the Joint Research Centre – the scientific and knowledge service of the European Commission – and the European Union Policy Lab published a study entitled Emerging applications of neurotechnology and their implications for EU governance, in which they summarized recent advances in neurotechnologies and noted that these technologies “are rapidly advancing and are likely to have a profound impact on various aspects of society. In the near future, neurotechnology has the potential to revolutionize the way we approach a range of policy areas, from healthcare,¹¹ education, employment, law enforcement and security, to more obvious areas such as digital technologies and research”.¹²

11. For example, recent developments in brain-computer interfaces will enable people with paralysis or other motor disorders to interact with their environment in ways that would not previously have been considered possible, while neurostimulation techniques will offer new treatments for mental health disorders and neurological conditions. ↩
12. Antonia Mochan and others, Emerging applications of neurotechnology and their implications for EU governance, European Commission Joint Research Centre (Luxembourg, Publications Office of the European Union, 2025). ↩

The convergence of neurotechnologies and artificial intelligence will raise important questions about personal identity, privacy and autonomy, among other concerns. It is therefore essential that “policymakers are aware of the potential benefits and challenges, so they can make informed decisions that ensure the responsible development and deployment of neurotechnology”.¹³

13. Ibid. ↩

According to the study, the major area of innovation in applications of neurotechnology is non-implanted wearables that monitor brain activity for non-medical (lifestyle) uses. The availability of devices that can both monitor and stimulate the brain will probably generate new considerations of the importance of individual rights, data privacy and data protection. As noted in the study, at the very least, existing frameworks will need to be strengthened, so there is trust that they are operating effectively to protect existing rights.

The study highlights, inter alia, that neurodata are highly personal, cannot be replicated and reveal intimate aspects of thought, emotion and will. Children and adolescents are especially vulnerable, as their brains are still developing and they are more susceptible to manipulation or the misinterpretation of data. In addition to the more than 30 uses of neurotechnologies for brain monitoring and stimulation, including for medical, occupational, educational, military and commercial purposes, there has been a massive increase in the use of consumer devices, such as headphones, headbands, sleep masks and sensors embedded in clothing.

Mental privacy is not expressly protected by existing regulations. Furthermore, the passive collection of neurodata (without conscious interaction) could lead to the non-consensual collection of sensitive data becoming “normal” or “natural”.

The inclusion of neurotechnology in work or school settings can become coercive or discriminatory if there is no guarantee of informed consent, proportionality and the right to disconnect.

In that light, it is recommended that States, inter alia:
(a) Explicitly incorporate the right to mental privacy, free thought and brain integrity into their constitutional or human rights framework;
(b) Expressly prohibit the marketing or use of neurodata without informed, specific and revocable consent;
(c) Use controlled spaces (regulatory sandboxes) to test adaptive legal frameworks, with the participation of the public, scientists and companies;
(d) Prohibit the use of commercial neurotechnology on children and adolescents until its safety has been scientifically proven;
(e) Ensure equal access to therapeutic benefits for all people.

The accelerated advancement of neurotechnologies and their capacity to capture, process and analyse neurodata poses ethical and legal challenges that transcend national borders and demand a regulatory response combining rights protections and technological development. Set out below are the essential foundations and principles, from the perspective of the right to privacy, for the development of a draft model law to serve as a tool for harmonization at the international level. The model law would not only establish minimum standards for the safe and ethical use of neurotechnologies but would also constitute a reference which countries can use to develop local regulations suited to their legal and social contexts.

In recent years, regulations have been established and draft laws¹⁴ have been introduced on the subject of neurotechnology and neurodata. Regulatory strategies include constitutional reforms, reforms of data processing laws to incorporate matters relating to neurodata, and proposed principles on neurotechnologies, neurosciences and neurorights.

14. For example, on 11 March 2025, Senator Carlos Julio González Villa introduced draft law No. 395 of the Republic of Colombia, intended to establish principles governing neurosciences, neurotechnologies and human rights. The official text of the draft law and other documents relating to the discussion process or debates can be consulted on the website of the Senate of the Republic of Colombia, at: https://leyes.senado.gov.co/proyectos/index.php/textos-radicados-senado/p-ley-2024-2025/3487-proyecto-de-ley-395-de-2025. ↩

International harmonization efforts must feed into any regulation on technology, as technologies have a global impact and transcend borders. They are typically designed and manufactured in some countries and used in others. An exclusively local or territorial focus would be insufficient to properly address the challenges posed to humankind by neurotechnologies.

Accordingly, the work of various international organizations fed into the pillars proposed in the present report. In particular, the proposals reflect, with some modifications, the content of the Inter-American Declaration of Principles Regarding Neuroscience, Neurotechnologies, and Human Rights, adopted in March 2023 by the Inter-American Juridical Committee of the Organization of American States (OAS). The guidelines and directives of the following entities were also taken into account: the United Nations,¹⁵ the Ibero-American Data Protection Network,¹⁶ the Global Privacy Assembly,¹⁷ the Organisation for Economic Co-operation and Development,¹⁸ the Council of Europe,¹⁹ OAS,²⁰ the United Nations Educational, Scientific and Cultural Organization (UNESCO)²¹ and the Latin American and Caribbean Parliament.²²

15. Human Rights Council resolution 51/3, of 6 October 2022, on neurotechnology and human rights (A/HRC/RES/51/3); report of the Special Rapporteur on the right to privacy entitled “Proposal for the updating of General Assembly resolution 45/95 of 14 December 1990, entitled ‘Guidelines for the regulation of computerized personal data files’”, of 17 July 2024 (A/79/173); report of the Human Rights Council Advisory Committee entitled “Impact, opportunities and challenges of neurotechnology with regard to the promotion and protection of all human rights”, of 8 August 2024 (A/HRC/57/61); and report of the Special Rapporteur on the right to privacy entitled “Foundations and principles for the regulation of neurotechnologies and the processing of neurodata from the perspective of the right to privacy”, of 16 January 2025 (A/HRC/58/58). ↩
16. Statement of the Ibero-American Data Protection Network on neurotechnologies and neurodata within the context of data protection regulations, adopted at a closed session of the meeting of the Network held in Cartagena, Colombia, on 29 May 2024; and statement of the Ibero-American Data Protection Network on neurodata, adopted at a closed session of the meeting of the Network held in Antigua Guatemala, Guatemala, on 25 September 2023. ↩
17. Global Privacy Assembly resolution on principles regarding the processing of personal information in neuroscience and neurotechnology, adopted at the forty-sixth session of the Assembly, in November 2024. The text of the resolution is available at: https://globalprivacyassembly.org/wp-content/uploads/2024/11/Resolution-on-Neurotechnologies.pdf. ↩
18. Recommendation of the Organisation for Economic Co-operation and Development on innovation in neurotechnology, adopted in 2019. Available at: https://legalinstruments.oecd.org/ en/instruments/oecd-legal-0457. ↩
19. Report entitled “Common human rights challenges raised by the different applications of neurotechnologies in the biomedical field” of the Council of Europe, October 2021. ↩
20. Inter-American Declaration of Principles Regarding Neuroscience, Neurotechnologies, and Human Rights, adopted in March 2023 by the Inter-American Juridical Committee of OAS; Updated Principles on Privacy and Personal Data Protection, with annotations, adopted by the Inter-American Juridical Committee on 9 April 2021 and by the General Assembly of OAS in November 2021; and Declaration on Neuroscience, Neurotechnologies and Human Rights: New Legal Challenges for the Americas, adopted in August 2021 by the Inter-American Juridical Committee. ↩
21. Publication entitled Unveiling the neurotechnology landscape: scientific advancements innovations and major trends, UNESCO, 2023; UNESCO recommendation on the ethics of artificial intelligence (2021); and report entitled Ethical issues of neurotechnology of the International Bioethics Committee of UNESCO, December 2021. ↩
22. Model Law on Neurorights in Latin America and the Caribbean, adopted by the Latin American and Caribbean Parliament (Panama City, 19 and 20 May 2023). ↩

Another recent reference document was the report of the present Special Rapporteur concerning foundations and principles for the regulation of neurotechnologies and the processing of neurodata from the perspective of the right to privacy, of 16 January 2025 (A/HRC/58/58).

A set of principles on neurotechnologies, neurodata and human rights should be established to convey what is advisable and what is not in research on and development and application of neurosciences and neurotechnologies, with a view to protecting human dignity and fundamental rights. 23 15 Human Rights Council resolution 51/3, of 6 October 2022, on neurotechnology and human rights (A/HRC/RES/51/3); report of the Special Rapporteur on the right to privacy entitled “Proposal for the updating of General Assembly resolution 45/95 of 14 December 1990, entitled ‘Guidelines for the regulation of computerized personal data files’”, of 17 July 2024 (A/79/173); report of the Human Rights Council Advisory Committee entitled “Impact, opportunities and challenges of neurotechnology with regard to the promotion and protection of all human rights”, of 8 August 2024 (A/HRC/57/61); and report of the Special Rapporteur on the right to privacy entitled “Foundations and principles for the regulation of neurotechnologies and the processing of neurodata from the perspective of the right to privacy”, of 16 January 2025 (A/HRC/58/58). 16 Statement of the Ibero-American Data Protection Network on neurotechnologies and neurodata within the context of data protection regulations, adopted at a closed session of the meeting of the Network held in Cartagena, Colombia, on 29 May 2024; and statement of the IberoAmerican Data Protection Network on neurodata, adopted at a closed session of the meeting of the Network held in Antigua Guatemala, Guatemala, on 25 September 2023. 17 Global Privacy Assembly resolution on principles regarding the processing of personal information in neuroscience and neurotechnology, adopted at the forty-sixth session of the Assembly, in November 2024. The text of the resolution is available at: https://globalprivacyassembly.org/wpcontent/uploads/2024/11/Resolution-on-Neurotechnologies.pdf. 18 Recommendation of the Organisation for Economic Co-operation and Development on innovation in neurotechnology, adopted in 2019. Available at: https://legalinstruments.oecd.org/ en/instruments/oecd-legal-0457. 19 Report entitled “Common human rights challenges raised by the different applications of neurotechnologies in the biomedical field” of the Council of Europe, October 2021. 20 Inter-American Declaration of Principles Regarding Neuroscience, Neurotechnologies, and Human Rights, adopted in March 2023 by the Inter-American Juridical Committee of OAS; Updated Principles on Privacy and Personal Data Protection, with annotations, adopted by the Inter-American Juridical Committee on 9 April 2021 and by the General Assembly of OAS in November 2021; and Declaration on Neuroscience, Neurotechnologies and Human Rights: New Legal Challenges for the Americas, adopted in August 2021 by the Inter-American Juridical Committee. 21 Publication entitled Unveiling the neurotechnology landscape: scientific advancements innovations and major trends, UNESCO, 2023; UNESCO recommendation on the ethics of artificial intelligence (2021); and report entitled Ethical issues of neurotechnology of the International Bioethics Committee of UNESCO, December 2021. 22 Model Law on Neurorights in Latin America and the Caribbean, adopted by the Latin American and Caribbean Parliament (Panama City, 19 and 20 May 2023). 23 Draft law No. 395 of the Republic of Colombia, which was introduced in 2025 by Senator Carlos Julio González Villa, was also taken into account in the drafting of the present proposal. 12/15

Human dignity is a supreme value that is inherent to human beings and is inviolable. States therefore have a duty to respect, protect and safeguard human rights in all actions relating to the design, development, implementation, marketing, assessment and use of neurotechnologies.

Human dignity must be the main foundation of any regulation and must be incorporated into all the provisions of the regulation. It is considered a supreme mandate that is to be protected and a criterion for the interpretation and application of said regulation.

The development and use of neurotechnologies must help to uphold the right of every person to a dignified life. It should be ensured that the benefits of scientific and technological progress serve to respect and protect fundamental rights, such as the rights to identity, autonomy, privacy and the free development of personality.

All individuals must have exclusive control over their neural identity, to ensure their self-determination and freedom of thought. In other words, all individuals have the right to decide on their natural cerebral identity and not to have their brain undergo any artificial manipulation that alters their decisions or their personality, except in cases that are expressly authorized by law and that meet strict ethical standards.

Any artificial manipulation of the brain or of neural information should be prohibited, except when carried out for the following purposes:
(a) Health protection;
(b) Diagnosis, treatment, rehabilitation or alleviation of disease, in the context of the fundamental right to health;
(c) Scientific research in biology, psychology and medicine aimed at alleviating suffering or improving health, provided that it is conducted in accordance with applicable ethical and legal standards.

Ethics are another essential component of any regulation. Any process relating to neurotechnologies should, by design, be governed by ethical principles. This entails ensuring that studies, trials and research protocols are in compliance with the norms, standards and guidelines of research ethics, to always protect the dignity and fundamental rights of participants.

A preventive approach should be adopted in order to protect human rights, from the design to the development, implementation and use of neurotechnologies. This means, among other things, that before starting a neural study or research project, or designing or developing neurotechnologies associated products, a human rights assessment should be conducted in order to establish an effective system of risk management and internal oversight to ensure that fundamental rights are protected.

In that connection, from the time neurodata are collected, and throughout their life cycle, technological, organizational, human and procedural preventive measures should be taken to prevent the violation of fundamental rights and the improper use of neurotechnologies

The precautionary principle strengthens the preventive approach in terms of human rights, as it serves to prevent serious or irreversible risks that may jeopardize human dignity, personal integrity, mental privacy and other fundamental rights, even in the absence of scientific certainty about the magnitude of such risks.

Neurodata should be classified as highly sensitive personal data that must be subject to special and enhanced protection, including: (i) effective systems to ensure the confidentiality, integrity and availability of neurodata; and (ii) protocols to ensure compliance with the right to privacy and the informed consent of the data subject.

Given the high sensitivity of neurodata, it is essential to adopt not only useful, timely, relevant, effective and demonstrable regulatory compliance measures, but also enhanced or stricter security measures for the processing of neurodata, to prevent improper or unauthorized access to or distribution, supply, use, manipulation, alteration or destruction of neurodata.

In that regard, it is useful to bear in mind that, in the UNESCO draft text of the recommendation on the ethics of neurotechnology, special mention is made of the need to foster data-sharing by establishing repositories that meet “stringent cybersecurity, data privacy and ethical use standards (including data minimization and purpose limitations)”. Fittingly, reference is also made to the need to “prioritize efforts to reduce obstacles to cross-border data-sharing in neurotechnology research, working towards greater alignment of data protection standards, particularly concerning neural data and non-neural data allowing cognitive states inferences, by establishing clear protocols for data transfer for secure, risk-based and compliant data exchanges across borders, and standards for interoperability of data, including governance frameworks for data-sharing, while taking into account existing mechanisms and guidelines for privacy protection and data governance”.²⁴

24. UNESCO, “Draft text on the recommendation on the ethics of neurotechnology” (SHS/IGM-NEURO/2025/MAY/3). ↩

It is worth noting the significance of the international transfer of personal data, given the harmonization of standards and the challenges that it entails. In that connection, “an appropriate regional framework should be developed in Latin America for the recognition of the alignment of local jurisdictions, to ensure the free flow of data within a framework in which personal data protection rights are upheld”.²⁵

25. Luca Belli and others, Transferencia internacional de datos personales en América Latina: hacia la armonización de normas (México, Ubijus,2025). ↩

The Special Rapporteur agrees fully with the statement in the above-mentioned UNESCO draft text that “appropriate funding mechanisms should be established for 24 UNESCO, “Draft text on the recommendation on the ethics of neurotechnology” (SHS/IGMNEURO/2025/MAY/3). 25 Luca Belli and others, Transferencia internacional de datos personales en América Latina: hacia la armonización de normas (México, Ubijus,2025). 14/15 the curation and maintenance of data”,²⁶ and that governance processes should be streamlined.

26. UNESCO, “Draft text on the recommendation on the ethics of neurotechnology”. ↩

The prior, free, informed, express, specific and unequivocal consent of the data subject is a prerequisite for the processing of neurodata,

It is necessary to include provisions:
(a) To prevent neurodata and neurotechnologies from being used for the purpose of discrimination, stigmatization or violation of human rights and freedoms;
(b) To ensure that neurotechnologies and their benefits reach all persons who need them and not only those who have the financial resources to obtain them.

Neurotechnologies must be used for medical purposes, such as the promotion of health and the prevention, diagnosis, treatment, rehabilitation and alleviation of diseases.

It is critical to prevent the creation of first-class human beings, with artificially enhanced brains, and second-class human beings, with natural brains. Great caution must therefore be exercised in the use of neurotechnologies to increase or improve human cognitive capacities or alter human nature beyond the scope of therapeutic application or healthcare, or for other non-medical uses.

Care must be taken to ensure that neurocognitive integrity and privacy are not violated, altered, manipulated or modified in a way that jeopardizes or affects personal integrity. The altering of freedom of thought and consciousness and the use of neurotechnology to make an individual dependent on a third party should also be prohibited. In other words, cerebral manipulation should not be allowed to turn human beings into puppets or brainwashed subjects.

The benefits of neurotechnologies must be shared with the whole of society and must contribute to collective well-being. Inclusive access to technological and scientific advances must be promoted, especially for vulnerable groups and those requiring special protection, in order to improve quality of life and ensure that human dignity is respected.

Current generations have a duty to ensure that future generations are protected, in accordance with the principles of human dignity and respect for fundamental rights.

Neurodata must be considered a common heritage of humanity and an expression of people’s most private and sensitive information, which should not be subject to financial gain, trade or enrichment by third parties.

In the light of the foregoing, in addition to the recommendations contained in the report of the Special Rapporteur dated 16 January 2025 (A/HRC/58/58), in which the Special Rapporteur sets out the basis for the creation of a conceptual framework for regulating the use of neurotechnologies and the processing of neurodata, from the perspective of the right to privacy, and seeks to establish a sound basis for ensuring that the regulation of neurotechnologies is consistent, ethical and designed to safeguard fundamental rights, and to ensure the establishment of regulations on neurotechnologies and neurodata that include the pillars outlined in the present report, the Special Rapporteur respectfully urges States:
(a) To promote the regulation of neurotechnologies and the processing of neurodata. It is essential that each country develop a specific regulatory framework for neurotechnologies and neurodata, given their potentially profound impact on privacy, human dignity and fundamental rights. The associated risks must be anticipated in the regulation, to ensure the safe, ethical and responsible use of these technologies;
(b) To incorporate the foundations and principles for the regulation of the use of neurotechnologies and the processing of neurodata from the perspective of the right to privacy suggested in the present report. The foundations and principles set out in the report, including the protection of human dignity, informed consent, ethics by design, the precautionary principle and non-discrimination, should be integrated into national legal frameworks. These principles will ensure a balance between technological innovation in neurotechnologies and the protection of human rights, with a particular focus on privacy and the proper treatment of neurodata;
(c) To promote ethical practices in the use of neurotechnologies. It is essential to establish guidelines and oversee practices that guarantee the ethical use of neurotechnologies and ensure the proper processing of neurodata as highly sensitive information. These practices must prevent any improper use that could compromise privacy or give rise to discrimination;
(d) To promote education on neurotechnologies and neurodata. To ensure informed use of these technologies, States should promote public education on the benefits and risks associated with neurotechnologies. This will enable people to better understand their impact, make conscious decisions about their neurodata and demand that their rights be respected in this new technological era.