A bipartisan bill to protect biological and neural data of Coloradans passed its initial committee hearing on Jan. 30. House Bill 24-1058, titled Protect Privacy of Biological Data, would expand the scope of the Colorado Privacy Act to include biological and neural data.
The bill passed through committee without a single no vote, coasting to its second reading. Sponsorship of the effort comes from both sides of the aisle in both chambers. Democratic Rep. Cathy Kipp and Republican Rep. Matt Soper led the effort in the House, while Democratic Sen. Kevin Priola and Republican Sen. Mark Baisley will spearhead the efforts on the Senate side.
Kipp told the committee the bill came about after Dr. Sean Pauzauskie, a neurologist at UCHealth and chairman of the Colorado Medical Political Action Committee, brought the bill to her in the Spring of 2023 and arranged a meeting that included Dr. Rafael Yuste and Jared Gesner, the chair and general counsel of the Neurorights Foundation, respectively. Pauzauskie, Yuste and Gesner all appeared at the hearing to testify in support.
Kipp noted the array of new technologies entering the neurological data sector, including technology from Apple and Elon Musk’s Neuralink, which recently implanted its first chip into a human brain.
“There are amazing things that can be done with this technology, we do not want to quash technology at all,” said Kipp. “What we are looking to do is protect people’s privacy so that we can go even bigger and make sure this technology has the protections it needs going forward.”
Soper told the committee the bill would be a first in the nation and second in the world legislation. Soper added the bill would add two definitions under the sensitive data statute within the Colorado Privacy Act, one for biological data and one for neuro data.
“It’s very important to be able to define these in such a way that as Representative Kipp said, we keep Colorado’s high-tech economy moving forward and that we continue to be known as a state that’s innovating,” said Soper. “But at the same time we will also want to be known as a state that’s protecting consumers’ privacy by also spelling out from the get-go what can be shared and transmitted without permission, and what needs explicit permission of the individual to be able to move this sensitive data over to being marketed, or analyzed or whatever purposes may be out there.”
Yuste told the committee the technology needs to be regulated, as currently it’s very powerful and there’s essentially no regulation. The bill, according to Yuste, would be pioneering in the country and world in terms of legal protection of brain activity.
Pauzauskie said he wants to help promote the innovation of neurotechnology to help treat his patients, but he thinks it’s also owed to patients the data being collected is safe.
Yuste, when asked about the need for the regulation from Rep. Lorena Garcia, told the committee the issue is with neurotechnology at the consumer level.
“So our worries are not so much the patients but the citizens of Colorado, neurotechnologies that are used in the clinic are subject to HIPAA,” said Yuste. “But the big problem comes when very similar devices are sold commercially as consumer electronics, and this is what’s going on right now in the U.S. The technology is advancing so quickly that it’s essentially unregulated.”
A few other witnesses, including a representative from the Colorado Department of Law, testified in support of the bill. But two witnesses, Ruthie Barko, executive director for Colorado and the Central U.S. at TechNet, and Andrew Kingman, general counsel for the State Privacy & Security Coalition, had reservations about the bill.
Barko told the committee TechNet believed some work still needed to be done on the bill, and testified as a mend.
“First, the vague scope of the definition of biological data should be modified to apply only to biological data that are in fact used to identify an individual,” said Barko. “Second, narrowing the definition of neural data is necessary in order to take precise aim at the future neuro-technological advancements with which the sponsor is concerned and to not include consumer-facing technologies that the scientific community would agree are not neural data.”
Kingman told the committee his organization worked alongside Technet and said he wanted to echo Barko’s remarks. But Kingman wanted to focus in particular on the element of intentionality in the definitions laid out by the bill.
“We want to make sure consumers are getting a clear expression of what [data] is being used and when, and that businesses are not required to say that they are using data for particular purposes when they may well not be,” said Kingman.
Following witness testimony, the committee passed an amendment that modified the definitions of “Biological data” and “Neural data” in the bill.