5. Legal concerns
The novel nature of neurotechnologies present a myriad of legal questions which must be considered.
This background paper seeks to highlight a few pertinent areas where neurotechnology may challenge
existing legal frameworks.
5.1 Privacy
The Privacy Act 1988 (Cth) (Privacy Act) is the
foundational piece of privacy legislation in Australia.
Currently the Privacy Act has no express protection
for neural data or mental privacy.
However, the Privacy Act is principle‑based
legislation which emphasises a technology‑neutral
and flexible framework for regulating how entities
collect, use and disclose personal information.
This means that it is adaptable to changing
technologies and environments, including
emerging neurotechnology. This would create
legal obligations that address the collection,
use or disclosure of personal information in
this technology.
‘Personal information’ is, at the time of writing,
broadly defined within the Privacy Act as:
Information or an opinion about an identified
individual, or any individual who is readily
identifiable:
(a) whether the information or opinion is true
or not; and
(b) whether the information or opinion is
recorded in a material form or not.213
What is personal information will vary, depending
on whether a person can be identified, or is
reasonably identifiable, in the circumstances.
Information collected, used and disclosed by
neurotechnologies may be considered personal
information under the Privacy Act if it is information
about an identified or reasonably identifiable
individual.
28
The information collected, used and disclosed by
neurotechnologies may also meet the definition of
‘sensitive information’ under the Privacy Act as in
certain circumstances it may be considered health
information.214 Sensitive information is subject to a
higher level of protection under the Privacy Act.
Privacy Act 1988 (Cth) reforms
The Australian Attorney‑General’s Department has
recently undertaken a review of the Privacy Act,
which would see it updated and fit‑for‑purpose in
respect of an increasingly digitised world.
At the time of writing the Government has
committed to progressing consideration of reforms
to Australia’s privacy framework under five key
areas of focus:
bringing the Privacy Act into the digital age
uplifting protections
increasing clarity and simplicity for entities and
individuals
improving control and transparency for
individuals over their personal information
strengthening enforcement.215
These reforms will hopefully create a stronger
framework overall, including where neural data is
captured by the Privacy Act.
One aspect of the proposed reforms is amending
the definition of personal information, which the
Government has agreed to in principle.216 This
includes changing the word ‘about’ in the definition
of personal information to ‘relates to’ to clarify
that personal information is an expansive concept
Protecting Cognition: Background Paper on Human Rights and Neurotechnology