California enacted an Amendment to the California Consumer Privacy Act (CCPA) that adds neural data to the list of protected personal sensitive information. For Illinois business owners—especially those conducting business in California or utilizing neurotechnology—this development is worth understanding, as it marks another step in the expanding landscape of data privacy laws. Neural data, often collected through non-invasive neurotechnology tools, is now considered sensitive and will be protected under the same stringent requirements as other personal information like genetic, biometric, and geolocation data.
What is Neural Data and Why is it Important?
Neural data refers to information generated by measuring a person’s brain activity. This includes brain waves that can be captured through non-invasive neurotechnology tools, such as electroencephalography (EEG) devices, which are increasingly used in consumer products. These technologies can measure brain responses, potentially influencing how individuals interact with digital tools or providing insights into their mental states. Neural data has increased importance in creating Generative Artificial Intelligence or Machine Learning. California’s new law focuses on protecting this data as it becomes more integral to advanced tech products, particularly in the consumer electronics and medical fields.
For Illinois businesses dealing with California consumers or operating in the tech sector, particularly in areas intersecting with neurotechnology, this is an important consideration. Companies that utilize consumer neurotechnologies or offer products that collect neural data will now need to adhere to stringent compliance measures under the CCPA. This includes adopting safeguards to protect neural data from misuse or unauthorized access.
Why Should Illinois Business Owners Pay Attention?
Although the California law applies specifically to California, it’s worth noting that California is a trendsetter in privacy laws. Illinois businesses with a presence in California, or those selling products to California residents, will need to ensure that they comply with this amendment to avoid legal exposure. As the Amendment went into effect in October, 2024, businesses must update their data privacy protocols to protect neural data and adhere to the CCPA’s requirements.
For Illinois business owners who are already familiar with the Illinois Biometric Information Privacy Act (BIPA), the SB 1223 amendment to the CCPA may feel somewhat familiar. BIPA regulates the collection of biometric data in Illinois and has been one of the strictest data privacy laws in the U.S. California’s inclusion of neural data as sensitive personal information under the CCPA mirrors the robust protections Illinois has long enforced concerning biometric data like fingerprints and facial recognition scans.
Key Takeaways for Illinois Businesses
- Thresholds for Compliance: Businesses that fall under the CCPA—those with annual gross revenues exceeding $25 million, that buy, sell, or share the personal information of over 100,000 consumers, or derive 50% or more of their annual revenue from selling personal information—must comply with SB 1223 if they collect neural data.
- Impact on Tech and Healthcare Companies: The new amendment is especially relevant for companies working with neurotechnology products that collect brain data. Whether you are in tech, healthcare, or research, if you handle neural data from California residents, you must adhere to these updated regulations.
- Data Privacy Framework: The expansion of the CCPA’s scope reflects a growing trend toward more comprehensive data privacy regulations, especially concerning technologies that interact with human cognition. Illinois businesses should consider whether their practices align with emerging privacy trends, as more states may follow California’s lead in regulating neural data.
What’s Next?
For businesses already operating under the CCPA or Illinois’s BIPA, ensuring compliance with the California law should be a priority. With neurotechnology advancing rapidly, neural data is becoming a valuable commodity, but it also poses significant privacy risks. Illinois businesses should stay ahead of the curve by evaluating their data collection practices and updating their privacy policies accordingly.
The passing of the California Amendment underscores the importance of understanding how evolving data privacy laws impact your business. Whether you’re developing new technology or handling sensitive consumer data, ensuring that your business complies with both state and federal laws is crucial to protecting consumer trust and avoiding potential legal pitfalls.
If your business deals with consumer data contact George Bellas, Chicago Business Lawyer, to ensure you’re equipped to meet the growing demands of privacy regulations in Illinois, California, and beyond.