Tag: privacy

Imagine being able to control machines using your thoughts alone. This idea inspired many popular science fiction franchises such as The Matrix or Pacific Rim. In these stories, humans are able to interface with digital machines that detect brain signals, which gives the characters superhuman powers. For many, these brain-computer interfaces (BCIs) seem futuristic and fantastic, which may explain the hype behind recent innovations such as Elon Musk’s Neuralink.

However, BCIs are not new, and neither are most of the concerns that they raise. Humans have been able to control computers with brain signals since the early 1990s. Existing BCIs often leverage non-invasive electroencephalography (EEG), which simply sits on someone’s head, and usually uses machine learning to detect changes in brain patterns. These detected brain patterns have been applied to a limited number of functions such as spelling applications and video games. Nonetheless, research in non-invasive EEG, including ongoing research in our group at Dalhousie University, has yielded to various innovative applications, such as detecting mind wandering when watching online long lectures.

For some individuals, such as people with locked-in syndrome, BCIs are not just novel technologies but life-enhancing devices through which they can interact with the world. Even a limited EEG-based BCI can enable someone suffering from paralysis to regain a degree of freedom. This in-turn inspired medical researchers and biomedical engineers to develop research into BCI that was much more functional, by leveraging brain implants. The implants that have since been developed have enabled patients who were otherwise paralyzed to command prosthetics, often far more precisely than they could with an EEG-based BCI. While invasive BCI offers a much higher degree of functionality than non-invasive BCI, progress was limited because these brain implants require surgeons to drill holes in a patient’s skull, which is a high-risk surgery.

BCI technology is now changing quickly because there are emerging technologies that are both comparatively less invasive and highly functional. On July 6^th, a company called Synchron became the second company in history to receive US Food and Drug Administration approval for clinical trials of an invasive permanent BCI. While not the first to implement permanent surgical BCI (that is, BCI that fits under the scalp, rather than on the scalp), Synchron’s solution is implemented through blood vessels, which makes it much easier to deploy and less risky than transcranial surgery. In the coming months, Synchron plans to conduct a wider trial which, if successful, will allow them to sell the implant as a medical device. This development would mark a major milestone in the advancement of BCI technology, as it would enable digital programs to interface with smaller collections of neurons, and in-turn enable wider range of people to precisely control robotic prosthetics with their brains. It is reasonable to expect a greater proliferation of the technology in medical applications, and possibly to commercial applications in the future.

With this milestone there will also be some new legal and policy challenges. While not qualitatively different from existing BCI technologies, I argue that the complexity and sensitivity of data warrant new privacy considerations, which past technologies did not.

The complexity raises specific concerns with privacy and consent, especially with potential commercial applications of implanted BCI. Since the development of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada has affirmed principles of informed consent and limiting use of data. The recently proposed Consumer Privacy Protection Act, which will supersede PIPEDA, will expand on these principles to include a more rigorous expectation of documenting consent, similarly to GDPR guidelines.

The complexity of the new systems that could be developed from the new generation of BCI would present challenges with informed and documented consent. Machine learning systems that use this type of brain data would be very complex, involving deep learning that is non-transparent and often developed from other individuals’ data. Companies and watchdogs may wish to consider guidelines to manage the clear communication of the nature of the data that would be collected, its use, and the limits of its use. It may also motivate the application of explainable AI solutions to BCIs, which would help users understand exactly what their data is being used for.

The new generation of BCI will likely collect a range of data that is more sensitive than non-invasive BCI. With EEG-based BCI the signals that are detected are generated from a limited range of neural patterns which are difficult to identify as belonging to a particular individual or diagnose an illness. Many participants of EEG studies even consent to publishing their brain data publicly on the internet, given that it is impossible to link this data to a specific individual. However, with an endovascular BCI, the signals will be much less limited, and it would be more likely to identify a specific individual.

This may raise new issues with respect to Canada’s privacy torts. Following the ruling of Jones v Tsige 2012, Ontario recognized damages that could be incurred from the improper access of personal data. The courts have since established that the possible damages are also related to the degree of sensitivity of the data. While it is not immediately clear to what degree someone’s brain data in this context could be considered sensitive, it is clear that there would be at least some sensitivity concerns analogous to health data. Whether this would be categorically different from, say, a Fitbit, would likely hinge on precisely how identifiable the data would be and what types of health information could be inferred from the data.

As the technology develops, it will become increasingly important for legal and policy professionals to understand the nuances of this technology. BCIs are no longer a matter of science fiction and are quickly becoming much more sophisticated. Moving forward, Canadians would benefit by considering these in light of recent advancements. While these will not be categorically different form existing technologies, we should take care to consider the implications of their data complexity and sensitivity.