Federal trade commission study and report on neural data governance

(a) Study and report (1) Study (A) In general The Commission shall conduct a study on— (i) what additional authorities, if any, the Federal Government needs to regulate neural data and other related data that can reveal an individual’s mental state or activity, and to establish appropriate privacy protections for individuals in the United States; (ii) best practices for privacy and data security for the private sector to protect such data; and (iii) the extent to which existing laws, regulations, and governing frameworks, including the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191), govern the use, storage, processing, portability, and privacy of such data, any gaps in law that should be addressed, and potential additional protections for such data that fall outside the scope of such Act. (B) Consultation In conducting the study described in subparagraph (A), the Commission shall consult with— (i) the Director of the Office of Science and Technology Policy; (ii) the Commissioner of Food and Drugs; (iii) other relevant Federal agencies determined appropriate by the Commission; and (iv) representatives of the private sector, academia, civil society, consumer advocacy organizations, labor organizations, patient advocacy organizations, and clinical research stakeholders including medical and health care professionals. (2) Report Not later than 1 year after the date of enactment of this Act, the Commission shall— (A) submit to Congress a report on the study conducted under paragraph (1) that— (i) includes the information described in subsection (b); and (ii) describes a regulatory framework that maximizes opportunities for responsible innovation in neurotechnology while minimizing the risks of harm that arise from such innovation, such as discrimination, profiling, surveillance, manipulation, and the misuse of neural data and other related data in employment, healthcare, financial services, education, commerce, and public life; and (B) publish the report on the website of the Commission. (b) Report contents The report described in subsection (a)(2) shall include— (1) an analysis on— (A) the collection, processing, storage, sale, and transfer of neural data and other related data; and (B) all relevant uses of neurotechnology, neural data, and other related data for understanding, analyzing, and influencing human mental states and behavior; (2) a summary of the ethical, legal, and regulatory landscape surrounding neural data and other related data that can reveal an individual’s mental state or activity, including any existing guidelines related to— (A) the collection of such data; (B) consent for the collection, use, and transfer of such data; (C) individual rights relating to such data; (D) predictive modeling; and (E) using such data to infer or influence behavior; (3) an assessment of— (A) how neural and other related data is collected, processed, and transferred in interstate commerce, and the benefits and risks associated with the collection and use of such data, including how such data may serve the public interest, improve the quality of life of the people of the United States, or advance innovation in neurotechnology and neuroscience; and (B) how the use of such data may pose risks to individuals, including vulnerable populations, across different contexts or use cases; (4) recommendations for the categorization and oversight of neural data and other related data uses, including— (A) a framework that— (i) distinguishes categories of such data, classifying such data based on both the potential for beneficial use cases (including medical, scientific, or assistive applications), and the potential for individual, societal, or group-level harm arising from misuse; (ii) describes the properties of such data based on its capacity to directly or indirectly identify an individual or to reveal or infer sensitive personal information about an individual; and (iii) suggests corresponding governance requirements such as heightened oversight, stricter consent standards, prohibited use cases regardless of individual consent, enhanced access restrictions, and cybersecurity protections; (B) standards for computational models of the brain and guidance on assessing harms in contexts where such data is integrated with artificial intelligence or used as part of a system designed to influence behavior or decision making; (C) an analysis of whether, and if so how, individuals may be exposed to unfair, deceptive, or coercive trade practices through the misuse of neural data and other related data across different environments, and recommendations for safeguards to prevent such harms; and (D) recommendations for categorizing certain applications of neural data and other related data, or certain practices regarding such data, as impermissible, such as those designed to manipulate behavior or erode privacy with respect to an individual’s mental state or activity; (5) an examination of how the application of artificial intelligence to neural and other related data that can reveal an individual’s mental state or activity may reshape the risks, oversight demands, and ethical considerations associated with such data; (6) recommendations for consumer transparency, consent frameworks, and neural data and other related data use restrictions, such as— (A) limiting such data use to only clearly disclosed purposes; (B) restricting the resale of such data to third parties or the use of such data for individual profiling or targeted advertising; (C) the use of separate, conspicuous consent mechanisms for the use of such data in developing or deploying computational models of the brain; (D) the public disclosure of— (i) intended uses for such data, sharing practices, and artificial intelligence applications; and (ii) policies related to the retention and deletion of such data; and (E) prohibited use cases, regardless of individual consent; (7) recommendations regarding applications of neural data and other related data in specific areas, including— (A) sectors or practices that raise concerns about privacy, manipulation, discrimination, inequality, or long-term harm, such as— (i) employment practices, such as in hiring, surveillance, or performance evaluation; (ii) educational settings and other settings involving children under the age of 13 and teens; (iii) insurance, financial, and housing services; (iv) neuromarketing and behavioral shaping, including the targeting of consumers; (v) commercial surveillance; (vi) monetization models, such as data brokers, that aggregate or sell neural data and other related data; (vii) the transfer of neural data and other related data through acquisitions, mergers, or bankruptcy proceedings; (viii) law enforcement and the criminal justice system; and (ix) sectors where algorithmic recommendation or design patterns intentionally amplify addictive use or behavioral manipulation; (B) how existing Federal statutes enforced by the Commission, including the Federal Trade Commission Act (15 U.S.C. 41 et seq.) and other consumer protection laws, apply to neural data and other related data; and (C) whether there are regulatory gaps in protecting the privacy of children and teens, including the applicability of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) and related laws to neural data and other related data; (8) an analysis of the potential security risks associated with the collection, use, and transfer of neural data and other related data, including— (A) an assessment of current cybersecurity and data protection requirements applicable to entities that collect, process, or store neural data or other related data, including any gaps in such requirements where such entities fall outside existing Federal standards, such as the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191); (B) an assessment of interagency review models to determine whether certain exports, public releases, or commercial uses of neurotechnologies, including their component parts and integration with artificial intelligence systems, should be subject to restrictions or enhanced controls; (C) an examination of foreign investment risks in neurotechnology firms; (D) recommendations on actions the Government and nongovernment actors can take to ensure transparency and due diligence in international partnerships involving such data; (E) supply chain risks involving components used in neurotechnology that are acquired from foreign countries; and (F) the implications of storing and processing such data locally versus in cloud environments; (9) recommendations for incentive structures that promote ethical innovation in neurotechnology that prioritize consumer protection and descriptions of how such structures can be aligned with existing regulatory and certification pathways or requirements, such as the development of— (A) voluntary standards tied to business incentives, such as research and development tax credits and expedited regulatory pathways; (B) financial support for responsible scientific inquiry and innovation in neurotechnology, conducted in ethically governed and controlled environments, with safeguards to prevent misuse or harmful applications; (C) regulatory sandbox mechanisms to enable early-stage neural data applications to be tested with agency oversight, informed consent, and structured risk review; (D) policies that promote long-term support for users of brain-computer interfaces, such as interoperability standards and post-trial maintenance practices; (E) competitive incentives, such as procurement preferences for companies that meet specified standards relating to the use of neurotechnology; (F) public-private partnerships to develop open standards and ethical practices regarding the treatment of neural data and other related data; and (G) ways the Centers for Medicare & Medicaid Services and the Food and Drug Administration can coordinate on the use and approval of neurotechnology to reduce reimbursement and coverage barriers; (10) a proposed framework for enforcement mechanisms, remedies, and penalties for the misuse of, gross negligence regarding the use of, and unauthorized collection, use, transfer, or disclosure of neural data and other related data; and (11) other analysis and recommendations determined appropriate by the Commission. (c) Annual updates Not later than 1 year after the date the Commission submits the report to Congress under subsection (a), and not less frequently than annually thereafter, the Commission shall publicly update the findings in such report to— (1) reflect evolving advancements in neurotechnology, neural data and other related data use cases, and the associated risks involved with such advancements and use cases; and (2) assess whether additional reports or updates to any guidance are necessary to ensure that privacy, particularly as it relates to neural data and other related data, continues to be protected. (d) Authorization of appropriations There is authorized to be appropriated $10,000,000 for purposes of carrying out this section.