Two powerful new technologies enable the collection of especially intimate personal information and pose special threats to privacy. These are technologies that collect and analyse data on the genomes and brain activity of individuals. Both technologies are enabling tremendous medical advances, but they come with new kinds of risks to the individuals whose information is compiled. The United States and European Union have so far taken different paths in their approach to balancing scientific innovation and individual privacy, with important implications for these technologies. While laws in both jurisdictions leave gaps in privacy protection, those is in the United States are especially porous, particularly with regard to data amassed by private companies that collect them from customers on a direct-to-consumer basis. However, even in the EU where the General Data Protection Regulation offers a single comprehensive regulatory scheme for residents of member states, privacy protection is incomplete and will likely be reduced by a subsequent regulatory proposal, the European Health Data Space. This article describes key privacy laws in both jurisdictions concerning health-related information, explains the implications of their shortcomings for genomic and brain data, and suggests reforms to address those shortcomings. These reforms would promote closer convergence of laws in the two jurisdictions, which could provide more consistent protection for individuals and clearer compliance standards for entities that use sensitive health data to advance new technologies.
Keywords: genomics; neurotechnology; privacy; GDPR; regulation