5. Legal concerns The novel nature of neurotechnologies present a myriad of legal questions which must be considered. This background paper seeks to highlight a few pertinent areas where neurotechnology may challenge existing legal frameworks. 5.1 Privacy The Privacy Act 1988 (Cth) (Privacy Act) is the foundational piece of privacy legislation in Australia. Currently the Privacy Act has no express protection for neural data or mental privacy. However, the Privacy Act is principle‑based legislation which emphasises a technology‑neutral and flexible framework for regulating how entities collect, use and disclose personal information. This means that it is adaptable to changing technologies and environments, including emerging neurotechnology. This would create legal obligations that address the collection, use or disclosure of personal information in this technology. ‘Personal information’ is, at the time of writing, broadly defined within the Privacy Act as: Information or an opinion about an identified individual, or any individual who is readily identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.213 What is personal information will vary, depending on whether a person can be identified, or is reasonably identifiable, in the circumstances. Information collected, used and disclosed by neurotechnologies may be considered personal information under the Privacy Act if it is information about an identified or reasonably identifiable individual. 28 The information collected, used and disclosed by neurotechnologies may also meet the definition of ‘sensitive information’ under the Privacy Act as in certain circumstances it may be considered health information.214 Sensitive information is subject to a higher level of protection under the Privacy Act. Privacy Act 1988 (Cth) reforms The Australian Attorney‑General’s Department has recently undertaken a review of the Privacy Act, which would see it updated and fit‑for‑purpose in respect of an increasingly digitised world. At the time of writing the Government has committed to progressing consideration of reforms to Australia’s privacy framework under five key areas of focus: ƒ bringing the Privacy Act into the digital age ƒ uplifting protections ƒ increasing clarity and simplicity for entities and individuals ƒ improving control and transparency for individuals over their personal information ƒ strengthening enforcement.215 These reforms will hopefully create a stronger framework overall, including where neural data is captured by the Privacy Act. One aspect of the proposed reforms is amending the definition of personal information, which the Government has agreed to in principle.216 This includes changing the word ‘about’ in the definition of personal information to ‘relates to’ to clarify that personal information is an expansive concept Protecting Cognition: Background Paper on Human Rights and Neurotechnology