5. Legal concerns that includes technical and inferred information.217 This would be supported by a non‑exhaustive list of information that may be personal information (where it also satisfies the definition of personal information) to assist entities to identify the types of information that could fall within the definition.218 Relevantly for the purposes of neural data, the Privacy Act Review Final Report states that the list could include: One or more features specific to the physical, physiological, genetic, mental, behavioural, economic, cultural or social identity or characteristics of a person.219 These changes may better protect mental privacy because a broader range of neural data would be more clearly captured as personal information, reducing uncertainty about when neural data is covered by the Privacy Act. The Government has also agreed in principle to the inclusion of a statutory tort for serious invasions of privacy that are intentional or reckless in the Privacy Act.220 The Commission provided input on this issue and noted the need for the tort to include negligent acts of privacy invasion, in addition to the need for the tort to be non‑restrictive.221 Whether such a tort could be used to protect mental privacy and neural data is an open question. It has also been agreed in principle by the Government that the Privacy Act should be amended to require that the collection, use and disclosure of personal information must be ‘fair and reasonable in the circumstances’.222 This would create a positive obligation that requires entities captured by the Privacy Act to consider the foreseeable risks and impacts to individuals caused by information handling through neurotechnology at the beginning of a project. Accordingly, this may provide a baseline protection of neural data and mental privacy where it is considered personal information. This test would be supported by certain legislated factors (including but not limited to) consideration of the kind, sensitivity and amount of personal information being collected, used or disclosed and the risk of unjustified adverse impact of harm, among other considerations.223 The fair and reasonable obligation may be further supported by the agreed in‑principle requirement for privacy impact assessments (PIA) to be conducted for activities with high privacy risks (any function or activity that is likely to have a significant impact on the privacy of individuals).224 A PIA is a systematic assessment of a project, which can assist in identifying potential impacts that a project might have on individuals, and sets out recommendations for managing, minimising or eliminating those impacts. Noting the potential of neurotechnology to have a significant impact on privacy, organisations which offer neurotechnology products or services may need to conduct a PIA prior to commercialising their product or service, consider their privacy risks and impact, and develop management and minimisation strategies to address those risks and impacts. This is a well‑developed method to address the privacy‑related impacts of new technologies which encourages entities to take a ‘privacy‑by‑design’ approach to their personal information handling. While the Privacy Act may not expressly protect neural data or mental privacy, it may do so implicitly. It is expected that if reforms to the Privacy Act are legislated, the protection of mental privacy and neural data may also be improved. 5.2 Consumer technology Some of the biggest risks of neurotechnology will be realised as products are developed and deployed outside of therapeutic and medical fields and provided to consumers more broadly. The medical applications of neurotechnologies are quite stringently regulated in Australia (as noted below) and other countries. However, consumer products operate in an environment where existing consumer protections are not as effective at regulating consumer‑oriented neurotechnologies compared to the types of targeted regulation and safeguards that are seen in the therapeutic and medical contexts. The Commission is concerned that consumer‑oriented neurotechnologies are not sufficiently regulated. Consumer products operate in an insufficient regulatory environment.225 Given Australian Human Rights Commission 29