Brain Data Privacy Act NeuroPrivacy Passes in EU: Neural Data Classified as Highest-Level Sensitive Information

Brain Data Privacy Act NeuroPrivacy Passes in EU: Neural Data Classified as Highest-Level Sensitive Information

On April 10, 2029, the European Parliament passed the NeuroPrivacy Act by an overwhelming vote of 487 to 102, becoming the world's first legislation specifically protecting brain data privacy. The Act classifies brainwaves, neural signals, and brain-computer interface data as "special category personal data" alongside genetic data, subject to the strictest processing rules.

NeuroPrivacy Act's core provisions include: prohibiting employers and insurers from requiring brain data during hiring or underwriting; users' right to delete their neural data records at any time; cross-border brain data transfers requiring explicit data subject consent; and fines of up to 6% of annual revenue for violations.

The direct impetus for this legislation was the rapid proliferation of brain-computer interface devices. According to the European Data Protection Board, by early 2029, over 8 million people in the EU use various BCI devices spanning medical assistance to gaming. These devices generate massive neural data daily, containing users' attention states, emotional fluctuations, and even subconscious responses.

European Data Protection Supervisor Wojciech Wiewiórowski stated: "Brain data is the last privacy frontier. If someone can read your thought patterns, traditional privacy concepts cease to exist. The NeuroPrivacy Act ensures this frontier remains unbreached."

Tech companies have expressed concern about the Act. Neuralink's European policy director stated in a release that overly strict data processing rules could hinder BCI innovation and application in healthcare.

The Act takes effect January 1, 2030, with a 9-month compliance transition period for businesses.