Neural data as sensitive / special-category data

The classification of brain-derived data under data-protection law. Under the EU GDPR, neural data can fall within special categories — for example as health data or, where used to identify a person, as biometric data — attracting heightened protections and stricter legal bases for processing. Several recent US state statutes now name 'neural data' as sensitive personal information outright.

Classification is complicated by inference: a single neural recording can reveal health conditions, cognitive traits, or reactions that were never explicitly measured, and it can yield new inferences as models improve. This makes the standard tools of purpose-limitation and data-minimization hard to apply, because the sensitivity of the data is not fixed at the moment of collection.