Brain signal data sharing in research frameworks

Introduction

Brain signal data sharing refers to the collection, storage, transfer and exchange of information obtained from the human brain for scientific and medical research. Such information may be collected through technologies such as electroencephalography (EEG), functional magnetic resonance imaging (fMRI), magnetoencephalography (MEG) and brain-computer interfaces (BCIs).

Brain signal data can provide information about neural activity, cognitive processes, neurological conditions and responses to medical treatment. Researchers share this information to improve scientific collaboration, develop neurological therapies and advance artificial intelligence-based medical technologies.

However, brain signal data raises serious legal and ethical concerns because it may reveal highly personal information about an individual's mental and neurological functioning. Unauthorised sharing may affect privacy, confidentiality, autonomy and human dignity.

Therefore, brain signal data sharing requires a legal framework that balances scientific progress with individual rights and responsible research practices.

Legal framework governing brain signal data sharing in India

1. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data in India.

Brain signal information may qualify as personal data when it relates to an identifiable individual. Research institutions and biotechnology companies handling identifiable EEG, fMRI or BCI records must examine their obligations under the Act.

Important considerations include:

Obtaining valid consent where required.

Providing appropriate information about data processing.

Maintaining reasonable security safeguards.

Preventing unauthorised disclosure or access.

Complying with applicable requirements concerning data retention and erasure.

The Act does not create a separate statutory category called neural data or neurorights. Its application depends on whether the information constitutes digital personal data and on the applicable statutory provisions and exemptions.

2. Information Technology Act, 2000

The Information Technology Act, 2000 provides legal protections concerning electronic records, unauthorised access and certain forms of disclosure.

Section 43 addresses specified unauthorised computer-related activities, while Section 66 provides criminal consequences for certain acts committed dishonestly or fraudulently.

Section 72 addresses breach of confidentiality and privacy in circumstances covered by that provision.

These provisions may become relevant when research institutions or technology providers unlawfully access, obtain or disclose electronic brain signal records.

3. Indian Council of Medical Research (ICMR) Ethical Guidelines

The ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017 provide important ethical standards for research involving human participants.

They emphasise informed consent, confidentiality, privacy, independent ethics committee review and protection of research participants.

Research involving neural data should clearly explain:

What brain signals will be collected.

Why the information is required.

Whether the information will be shared with other researchers.

Whether data will be anonymised or coded.

How long the information will be retained.

Whether future research use is proposed.

Participants should receive appropriate information before their data is collected or shared.

4. Medical research and clinical trial regulations

Where brain signal data is collected as part of regulated clinical research, applicable provisions of the New Drugs and Clinical Trials Rules, 2019 and other relevant medical research requirements may apply.

Research institutions must also consider applicable ethics committee requirements and professional confidentiality obligations.

Major principles governing brain signal data sharing

1. Informed consent

Informed consent is one of the most important requirements for sharing brain signal data. Participants should understand the purpose of data collection, the proposed recipients, possible future research uses and relevant privacy risks.

Consent for participation in a study should not automatically be treated as unlimited permission to share neural information with unrelated researchers or commercial organisations.

2. Privacy and confidentiality

Brain signals may contain information about neurological functioning and, in some circumstances, may support inferences about cognitive or emotional states.

Research institutions should adopt strict confidentiality policies and prevent unauthorised disclosure. Access should be limited to individuals who genuinely require the information for approved research purposes.

3. Data anonymisation and security

Before sharing brain signal datasets, researchers should consider removing direct identifiers and using coding or pseudonymisation techniques.

However, removing names does not necessarily make neural datasets anonymous. Brain imaging and other neural information may sometimes be linked with other datasets to identify individuals.

Security measures may include encryption, controlled research databases, access logs and secure data-transfer arrangements.

4. Secondary use of research data

Brain signal data initially collected for one research project may later be useful for other scientific investigations.

Researchers should establish whether the original consent permits secondary use. Where necessary, they should obtain additional consent or seek approval under the applicable ethics framework.

5. International data sharing

International research collaborations may involve transferring neural datasets to foreign universities, laboratories and technology companies.

Such transfers must comply with applicable Indian data-protection requirements, contractual confidentiality obligations and the laws of the receiving jurisdiction.

Important case laws

There are currently no widely recognised Supreme Court decisions in India dealing specifically with the sharing of EEG, fMRI or brain-computer-interface datasets. However, constitutional and medical-consent judgments provide important principles.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other freedoms protected by Part III of the Constitution.

The judgment established that privacy includes informational privacy and that interference with personal information must satisfy applicable constitutional requirements.

Relevance: Brain signal data may reveal highly personal neurological information. The constitutional right to privacy provides an important foundation for protecting such information against unjustified collection, use and disclosure.

2. Selvi v. State of Karnataka (2010)

The Supreme Court examined the legality of involuntary administration of narco-analysis, polygraph examination and brain electrical activation profile tests.

The Court held that the involuntary administration of these techniques violated constitutional protections, including the right against self-incrimination under Article 20(3) and personal liberty under Article 21.

Relevance: This is particularly important for neural research because it recognises that techniques involving brain-related information raise questions of mental privacy, personal autonomy and consent. It does not, however, establish a general prohibition on voluntary brain-signal research.

3. Samira Kohli v. Dr. Prabha Manchanda (2008)

The Supreme Court explained the legal requirements of informed consent in medical treatment. It emphasised that consent must be voluntary and based on adequate information about the proposed procedure.

Relevance: The principles apply by analogy to research involving brain signal data. Participants should understand the nature and purpose of data collection and the proposed sharing arrangements before giving consent.

4. Mr. X v. Hospital Z (1998)

The Supreme Court considered the relationship between medical confidentiality and competing public interests. It recognised the importance of confidentiality while acknowledging that disclosure may be justified in limited circumstances.

Relevance: The judgment offers guidance for research institutions dealing with confidential neurological information. Disclosure should not be treated as unrestricted and must be justified under the applicable legal principles.

Institutional responsibilities in research frameworks

Universities, hospitals, biotechnology companies and neuroscience research centres should establish formal data-governance systems.

Their responsibilities include:

Obtaining ethics committee approval where required.

Preparing clear data-sharing agreements.

Restricting access to authorised researchers.

Maintaining records of data access and transfers.

Establishing procedures for responding to data breaches.

Ensuring that research publications do not unnecessarily identify participants.

Reviewing whether future uses remain consistent with consent and applicable law.

Research institutions should also establish procedures for withdrawing consent where legally and practically possible, while explaining any limitations arising from data already incorporated into completed research or shared datasets.

Challenges in brain signal data sharing

1. Difficulty of complete anonymisation: Neural datasets may retain identifying characteristics even after obvious identifiers are removed.

2. Unclear ownership: Legal rights and control over neural datasets may be divided among participants, hospitals, researchers and technology providers.

3. Commercial exploitation: Private companies may use research datasets to develop commercial neurotechnology products, raising questions about consent and benefit-sharing.

4. Cross-border transfers: Different countries have different standards for neural privacy and research-data protection.

5. Future technological risks: Advances in artificial intelligence may allow researchers to derive new information from previously collected brain signals.

Conclusion

Brain signal data sharing is an important part of modern neuroscience and biotechnology research. It supports neurological diagnosis, brain-computer interface development and scientific collaboration. However, the sensitive nature of neural information requires strong safeguards concerning informed consent, privacy, confidentiality, data security and secondary research use.

In India, the DPDP Act, 2023, the Information Technology Act, 2000, constitutional privacy protections and ICMR ethical guidelines provide the principal foundations for regulating such activities. The decisions in Justice K.S. Puttaswamy, Selvi, Samira Kohli and Mr. X v. Hospital Z offer important legal principles for protecting autonomy and confidential information.

A responsible brain signal data-sharing framework should therefore promote scientific cooperation while ensuring that individuals retain meaningful protection over their neural information.