When we talk about the right to privacy, we are referring to one of the most widely recognized fundamental rights, one that is closely tied to our daily lives. Privacy should not be understood solely as what happens within our homes; it also encompasses the ability to decide which aspects of our lives we want to make public and which we prefer to keep private. However, in recent years, technological advances have made exercising that control increasingly complex. In an increasingly connected world, much of the information that exists about us no longer depends solely on what we choose to share; digital platforms constantly collect data on our habits, preferences, and behaviors: from the websites we visit and our purchases to the content we engage with on social media.
However, in recent years a phenomenon has emerged that deserves even greater attention: the development of technologies capable of penetrating our most intimate spaces as human beings—our own minds; This type of technological development is known as neurotechnology; devices and systems that, just a few years ago, existed only in science fiction have advanced to the point of being able to record and interpret certain signals from brain activity and, in some cases, even establish communication between the brain and external devices. This raises a question that until recently seemed extremely far-fetched or even impossible: if our brain activity can be recorded, processed, or even used to interact with a machine, what happens to our thoughts? The protection of privacy, then, ceases to refer solely to what we choose to share voluntarily and begins to extend into a much more personal realm: our thoughts, intentions, and mental processes. It is precisely at this point that the law faces the need to determine whether current legal tools are sufficient to protect our minds against the new possibilities offered by technology.
An example of this development is the project PRIME Neuralink's project, currently registered as a first-in-human clinical trial, aims to evaluate the safety and functionality of a brain-computer interface designed to record signals from brain activity and use them to control external devices; It has already been tested on people with tetraparesis or tetraplegia, with the goal of helping them regain a certain level of autonomy in activities that require interaction with digital devices. To do this, Neuralink uses an implant called the N1, which is placed directly into the brain using a robotic system specifically designed to perform the procedure; this technology seeks to interpret neural signals from the brain’s motor cortex—associated with the intention to perform certain movements—and translate them into commands that can be executed by a computer or other devices. Although the project has generated interest due to its potential medical applications, it has also faced criticism regarding the risks of implanting devices in the brain and the implications of developing technologies capable of recording neural activity, including potential violations of privacy and autonomy.
Advances in this field are not limited to the ability to control devices; scientific research has also shown that certain neural signals can be used to generate information related to human communication. Consequently, the development of these technologies opens up significant possibilities for medicine and for the autonomy of people with disabilities, but at the same time raises a question that the law cannot ignore: What protection should information derived from brain activity receive, and to what extent can it be used by third parties?
The Challenge for the Law
The main challenge for the law in the face of neurotechnology is not merely to determine whether neural data can be considered personal data, but to establish what can legitimately be done with it. Brain-computer interfaces can generate information directly related to nervous system activity, raising questions about who can access it, for what purpose it can be used, how long it can be retained, whether it can be shared with third parties, and what happens when a person withdraws their consent. The issue becomes even more complex when this data can be processed to draw inferences about an individual, as legal protection may need to extend not only to the information directly recorded by the device but also to certain conclusions derived from it.
In this context, consent takes on special importance: agreeing to the use of a technology for therapeutic purposes does not necessarily imply authorizing the retention, reuse, or sharing of the information generated for other purposes. Therefore, the regulation of neurotechnology must strike a balance between allowing its development and ensuring that individuals retain real control over information related to their brain activity, by establishing clear rules regarding its purpose, processing, security, retention, and disposal.
Neurorights – The Legal Protection of Neurodata
The ability to record, interpret, and process information obtained directly from brain activity has led to the development of the concept of “neuro-rights,” although there is not yet a clear definition of what these rights entail; the term is used to refer to various proposals aimed at protecting fundamental human interests that are at risk of being affected by the development of neurotechnologies, particularly the right to privacy. The legal problem arises because neurodata can reveal information that a person would not normally wish to disclose consciously or voluntarily, unlike traditional forms of information—such as photographs, messages, or social media posts—whose creation depends directly on each individual’s decision. This characteristic explains why some legal systems have begun to develop specific protection mechanisms.
Chile
One of the most notable examples comes from Chile in 2021, with the enactment of Law No. 21,383, Article 19, Section 1, of the Chilean Constitution was amended to establish that scientific and technological development must be carried out while respecting the life and physical and mental integrity of individuals; and the amendment expressly added that technological development must be carried out with a particular focus on protecting brain activity, as well as the information it generates; Therefore, the significance of this reform lies not only in the introduction of specific regulations governing a particular technology, but also in the fact that it constitutionally recognizes that certain scientific advances may affect assets directly related to a person’s most intimate sphere; furthermore, it recognizes the legal existence of information derived directly from brain activity and mandates its protection.
California
Another example can be found in California, United States, where Senate Bill 1223 was enacted in 2024, amending the state's privacy framework to include neural data within the category of sensitive personal information, that is, sensitive personal information; the legislation defines neural data as information generated by measuring the activity of the central or peripheral nervous system that has not been inferred from non-neural information. This case is particularly significant because it demonstrates that the protection of neurodata does not necessarily require the creation of a completely separate right, but rather simply expanding or updating the conception of certain rights in light of these new technologies, so that such data can be included.
The Case of El Salvador
In El Salvador, this challenge takes on special significance with the passage of the Personal Data Protection Act, enacted by Legislative Decree No. 144 of 2024, which establishes a general framework for the legitimate and informed processing of personal data and seeks to protect rights such as privacy and informational self-determination; this legislation may serve as a starting point for addressing data generated by neurotechnologies, but it does not necessarily resolve all the specific issues they present. There is an important difference between the information a person consciously provides and that which can be obtained by measuring their neural activity and subsequently processed to generate new inferences. Therefore, the challenge for El Salvador is not necessarily to create a new regulation for every technological advance, but rather to determine the next steps to provide adequate protection against these new forms of information collection and processing.
Conclusion
Clearly, addressing the topic of neurotechnology means discussing something far more profound than a mere technological tool; it means discussing the possibility that what for centuries belonged solely to each person’s privacy may come to be known, interpreted, or used by others, and that is precisely why the protection of the mind deserves a place within the legal protection of the individual. In El Salvador, the Law on the Protection of Personal Data serves as a starting point, but it clearly cannot, on its own, address the specific characteristics of the information that can be obtained from brain activity through new technologies; that is why it will be necessary to build upon that foundation to establish more specific protections, capable of recognizing that not all personal data is of the same nature nor does it have the same consequences when exposed. The experience of other countries shows that this issue has already begun to be taken seriously: Chile has elevated the protection of brain activity to the constitutional level, while California has recognized neural data as sensitive personal information; El Salvador can learn from these experiences and adopt whatever elements are appropriate for its own legal system, without needing to replicate them exactly.
Neurotechnology will continue to advance, and will likely go much further than we can imagine today, but one thing should remain clear: the fact that we may one day be able to access the human mind does not mean we should have the right to do so without limits; protecting each person’s thoughts, brain activity, and autonomy is, ultimately, protecting a space that is at the very core of our freedom, individuality, and identity as human beings. That is why the challenge for Salvadoran law is to advance the regulation of this development without completely closing the door to progress, but making it clear that, even in the face of the most advanced technology, the human person and their protection must remain the priority.
Bibliography
Legislative Assembly of the Republic of El Salvador. (2024). Law on the Protection of Personal Data (Legislative Decree No. 144).
California Privacy Protection Agency. (2024). SB 1223 (Becker), Consumer Privacy: Sensitive Personal Information: Neural Data.
Müller, O., & Rotter, S. (2017). Neurotechnology: Current developments and ethical issues. Frontiers in Systems Neuroscience, 11, 93.
Neuralink. (April 12, 2024). PRIME Study progress update.
Republic of Chile. (2021). Law No. 21,383: Amends the Constitution to establish scientific and technological development in the service of the people. Library of the National Congress of Chile.
Zaror Miralles, D., Bordachar Benoit, M., & Trigo Kramcsák, P. (2021). On the Need for Constitutional Protection of Brain Activity and Information in the Face of Advances in Neurotechnologies: A Critical Analysis of the Constitutional Amendment Introduced by Law 21,383. Revista Chilena de Derecho y Tecnología, 10(2), 1–10.
Zúñiga-Fajuri, A., Villavicencio Miranda, L., Zaror Miralles, D., & Salas Venegas, R. (2021). Neurorights in Chile: Between neuroscience and legal science. In M. Hevia (Ed.), Developments in Neuroethics and Bioethics (Vol. 4, pp. 165–179). Academic Press.
