WEARABLE COGNITION-ANALYTICS GOVERNANCE IN RUSSIA

1. INTRODUCTION

Wearable cognition-analytics governance concerns the legal regulation of wearable technologies that collect, analyse and interpret information associated with human cognitive functioning. These technologies include smartwatches, EEG headbands, neural-monitoring devices, biometric sensors and other wearable systems capable of measuring attention, concentration, fatigue, emotional responses, sleep patterns and certain neurological signals.

In Russia, wearable cognition-analytics raises important legal questions concerning personal-data protection, medical confidentiality, employee surveillance, informed consent, algorithmic decision-making, cybersecurity and the protection of individual privacy.

Russia does not currently have a single comprehensive federal statute specifically regulating wearable cognition-analytics. Instead, its governance is derived from constitutional protections, personal-data legislation, healthcare legislation, labour law, consumer protection and applicable medical-device regulations.

2. CONSTITUTIONAL FRAMEWORK

A. ARTICLE 21 – HUMAN DIGNITY

Article 21 of the Russian Constitution protects human dignity and prohibits treatment that undermines human integrity.

Cognition-monitoring technologies should therefore be deployed with appropriate safeguards against coercive or degrading practices.

B. ARTICLE 23 – PRIVACY AND PERSONAL SECRECY

Article 23 protects privacy, personal and family secrets, and confidentiality of communications.

Information concerning attention, emotional responses, neurological activity and cognitive functioning may reveal highly personal information.

Unauthorised collection or disclosure of such information may interfere with constitutionally protected privacy.

C. ARTICLE 24 – PERSONAL INFORMATION

Article 24 restricts the collection, storage, use and dissemination of information concerning an individual's private life without the legally required consent or other lawful basis.

This provision is particularly relevant to wearable systems that continuously monitor cognitive behaviour.

D. ARTICLE 29 – FREEDOM OF INFORMATION

Article 29 protects freedom of thought and expression.

Cognition-analytics systems should not be used in ways that unlawfully interfere with an individual's freedom of thought, beliefs or expression.

3. PERSONAL-DATA PROTECTION FRAMEWORK

A. FEDERAL LAW NO. 152-FZ ON PERSONAL DATA (2006)

Federal Law No. 152-FZ is the principal legislation governing personal-data processing in Russia.

Wearable cognition-analytics platforms may process several categories of information:

Heart-rate and physiological measurements.

Sleep and fatigue information.

Attention and concentration indicators.

Emotional-response estimates.

EEG and other neurological measurements.

Behavioural and movement patterns.

Health-related predictive information.

Where the information constitutes personal data, the operator must comply with applicable requirements concerning lawful processing, purpose limitation, data security and individual rights.

Article 10 is particularly important because it regulates special categories of personal data, including information concerning health.

Not every cognitive-performance measurement automatically qualifies as health data. Its legal classification depends on the information collected, its purpose and what it reveals about the individual.

B. DATA SUBJECT CONSENT

Consent must satisfy the applicable statutory requirements.

Organisations should explain:

What information is collected.

Why the information is collected.

Whether automated analysis is performed.

Who receives the results.

How long information is retained.

Whether information is transferred to third parties.

How individuals can exercise their legal rights.

Consent obtained through misleading or coercive practices may not provide a sufficient legal basis for processing.

C. FEDERAL LAW NO. 149-FZ ON INFORMATION, INFORMATION TECHNOLOGIES AND INFORMATION PROTECTION (2006)

This legislation establishes general requirements for information protection and information-system security.

It is relevant to cognition-analytics platforms that store neurological measurements, behavioural profiles and predictive assessments.

Operators should implement access controls, cybersecurity safeguards and appropriate incident-response procedures.

4. MEDICAL DEVICE AND HEALTHCARE REGULATION

Wearable cognition-analytics devices may fall within the medical-device regulatory framework when their intended purpose qualifies them as medical devices.

A. FEDERAL LAW NO. 323-FZ ON HEALTH PROTECTION (2011)

Federal Law No. 323-FZ regulates medical activities and patient rights.

Important provisions include:

Article 13: Medical confidentiality.

Article 19: Patient rights.

Article 20: Informed voluntary consent.

Article 22: Patient access to medical information.

Article 38: Medical devices.

Where a wearable device is used to diagnose neurological disorders, monitor a medical condition or support clinical treatment, the applicable medical-device requirements must be considered.

B. GOVERNMENT DECREE NO. 1416 OF 2012

Government Decree No. 1416 established rules for state registration of medical devices.

Qualifying cognition-monitoring devices must satisfy the applicable registration requirements before being introduced into medical circulation, subject to relevant exceptions and transitional provisions.

Manufacturers must establish appropriate evidence concerning device safety, performance and intended medical use.

5. WORKPLACE COGNITION MONITORING AND EMPLOYMENT LAW

Wearable cognition-analytics creates particularly significant legal issues in employment relationships.

Employers may attempt to use wearable devices to assess employee concentration, fatigue, alertness and productivity.

However, monitoring must comply with Russian labour legislation.

A. LABOUR CODE OF THE RUSSIAN FEDERATION

Article 86 regulates the processing and protection of employees' personal data.

Article 87 addresses procedures governing the storage and use of employee personal data.

Article 88 regulates the transfer of employee personal data.

Article 89 establishes employee rights concerning personal data.

Article 91 establishes normal working-time limits.

Employers should not assume that employment contracts provide unrestricted authority to collect neurological or behavioural information.

B. EMPLOYER LIABILITY

Potentially unlawful practices include:

Continuous cognitive monitoring without an adequate legal basis.

Using inferred emotional states as automatic grounds for dismissal.

Disclosing employee neurological information.

Collecting excessive biometric or health-related information.

Penalising employees based on inaccurate fatigue predictions.

Using cognition scores without meaningful opportunities for review.

Employers should ensure that monitoring is necessary, proportionate and transparent, with particular attention to employee privacy and workplace safety.

6. ARTIFICIAL INTELLIGENCE AND ALGORITHMIC GOVERNANCE

Cognition-analytics platforms increasingly use artificial intelligence to interpret physiological and neurological signals.

These systems may generate assessments concerning:

Cognitive fatigue.

Attention levels.

Stress indicators.

Sleep deprivation.

Concentration patterns.

Predicted workplace performance.

Such assessments may be inaccurate because physiological measurements do not necessarily establish an individual's actual mental state.

Russia's general information, personal-data and employment laws provide relevant safeguards, but there is no comprehensive standalone federal neurorights statute specifically governing all AI-based cognition-monitoring systems.

Organisations should therefore maintain human oversight, explainability, data-quality controls and mechanisms for challenging inaccurate assessments.

7. RELEVANT CASE LAWS

There is no clearly established Russian Supreme Court jurisprudence specifically addressing wearable cognition-analytics or commercial neurotechnology surveillance. The following decisions are analogous international authorities and should not be represented as direct Russian precedents.

1. Bărbulescu v. Romania (2017), ECtHR Grand Chamber

The Court examined workplace monitoring of employee communications and the protection of private life.

Legal significance: Employers must consider transparency, proportionality, the extent of monitoring and safeguards against excessive workplace surveillance.

Application: Relevant to employers using wearable devices to continuously analyse employee attention and behaviour.

2. López Ribalda and Others v. Spain (2019), ECtHR Grand Chamber

The case concerned covert video surveillance of employees suspected of workplace theft.

Legal significance: The Court considered the proportionality of workplace monitoring and the circumstances in which surveillance may be justified.

Application: Provides analogous guidance for determining whether continuous cognitive monitoring is excessive.

3. Antović and Mirković v. Montenegro (2017), ECtHR

The case concerned video surveillance in university lecture halls.

Legal significance: Workplace-related monitoring may interfere with the right to respect for private life.

Application: Relevant to cognitive monitoring in educational institutions and professional environments.

4. Peck v. United Kingdom (2003), ECtHR

The Court examined the disclosure and dissemination of CCTV footage showing an individual in a public place.

Legal significance: Information collected in public settings may still attract privacy protection when subsequently disclosed or disseminated.

Application: Relevant to sharing wearable-generated cognitive and behavioural information with third parties.

5. S. and Marper v. United Kingdom (2008), ECtHR Grand Chamber

The Court examined the retention of fingerprints and DNA profiles by public authorities.

Legal significance: Biological information requires strong privacy safeguards, particularly where retention is excessive or insufficiently justified.

Application: Provides important comparative reasoning for the retention of neurological and biometric information.

6. Big Brother Watch and Others v. United Kingdom (2021), ECtHR Grand Chamber

The Court considered large-scale communications surveillance and the safeguards required to prevent abuse.

Legal significance: Surveillance systems require adequate safeguards, oversight and protection against arbitrary interference.

Application: Relevant to large-scale cognition-monitoring platforms operated by public authorities or private organisations.

7. Vukota-Bojić v. Switzerland (2016), ECtHR

The case concerned covert surveillance of an individual by insurance investigators.

Legal significance: The Court considered the privacy implications of surveillance and the need for a lawful and proportionate framework.

Application: Relevant to insurers seeking to use wearable cognitive or behavioural information when assessing claims.

These judgments are comparative authorities. Their principles may assist legal analysis, but they do not automatically create binding obligations under Russian domestic law. Russia ceased to be a party to the European Convention on Human Rights on 16 September 2022, subject to the Convention's temporal jurisdiction over earlier events.

8. LIABILITY AND REGULATORY ENFORCEMENT

A. CIVIL LIABILITY

The Russian Civil Code provides several possible remedies:

Article 15: Compensation for losses.

Article 151: Compensation for moral harm.

Article 1064: General liability for causing harm.

Article 1095: Liability for harm caused by defects in goods or services in applicable circumstances.

A person may seek legal remedies where unlawful cognition monitoring results in privacy violations, financial damage or other legally recognised harm.

B. ADMINISTRATIVE LIABILITY

The Code of Administrative Offences may impose liability for violations involving personal-data processing, confidentiality and applicable information-security requirements.

Article 13.11 is particularly relevant to violations of personal-data legislation.

Article 13.14 addresses unlawful disclosure of restricted-access information in circumstances covered by that provision.

C. CRIMINAL LIABILITY

Serious violations may also engage criminal law.

Article 137 of the Russian Criminal Code concerns violations of privacy.

Article 272 addresses unlawful access to computer information where its statutory elements are satisfied.

9. PRACTICAL COMPLIANCE REQUIREMENTS

Russian organisations developing or deploying wearable cognition-analytics systems should implement the following safeguards:

Establish a lawful basis for collecting personal information.

Obtain appropriate consent where required.

Distinguish ordinary physiological data from health-related information.

Provide transparent explanations of analytical methods.

Avoid presenting cognitive predictions as established medical diagnoses.

Restrict access to neurological and behavioural records.

Apply appropriate cybersecurity safeguards.

Establish data-retention and deletion policies.

Ensure compliance with applicable medical-device registration requirements.

Provide human review of consequential algorithmic assessments.

Avoid discriminatory employment decisions based on unreliable cognitive scores.

Maintain procedures for complaints, correction and investigation of data breaches.

10. CONCLUSION

Wearable cognition-analytics governance in Russia is an emerging regulatory issue involving constitutional privacy, personal-data protection, medical-device regulation, employment law and artificial intelligence.

The principal legal foundations include Articles 21, 23, 24 and 29 of the Russian Constitution, Federal Laws No. 152-FZ, No. 149-FZ and No. 323-FZ, and relevant provisions of the Russian Labour Code.

The central regulatory challenge is balancing technological innovation with individual privacy, cognitive autonomy, medical safety and workplace fairness.

Russian organisations must ensure that wearable cognition-analytics is deployed through lawful data collection, proportionate monitoring, secure information management and meaningful human oversight. The development of more specific safeguards for neurological information and AI-based cognitive profiling would strengthen the protection of individual rights while supporting responsible neurotechnology innovation.