Lawmakers consider Colorado bill protecting neural, biological data

CHEYENNE — In their continued discussion of how to secure Wyomingites’ private data, state lawmakers reviewed a recently passed Colorado bill that aims to protect a person’s biological data, including their brain activity.

It’s hard to imagine lawmakers discussing the privacy of a person’s neurological behavior as a legitimate area of concern. But as AI and other technology advances, state legislators are looking at protecting private data from every possible angle.

Rep. Daniel Singh, R-Cheyenne, presented Colorado House Bill 24-1058 to the Legislature’s Select Committee on Blockchain, Financial Technology and Digital Innovation Technology on Tuesday. Singh said the Colorado bill poses an “excellent question” on whether a person’s biological data, including their behavioral patterns traceable online, should be protected.

Colorado HB 1058, which was just passed this year, expands the definition of “sensitive data” in the Colorado Privacy Act to include an individual’s biological and neural data.

“Neural data” is defined in the bill as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems, and that can be processed by or with the assistance of a device.”

Considering the advancement of cutting-edge technology, Singh said, it may be worthwhile to consider all types of vulnerable sensitive data. For example, drones that capture images of people in public spaces could easily be equipped with scanning technology that could reproduce a 3D image of a person, he said.

“I understand that this may sound silly,” Singh said, “considering futuristic technology in our green books, in our statutes.”

Rep. Ocean Andrew, R-Laramie, said he found the topic personally intriguing, especially since there are lab-based devices out there with the ability to interpret brain waves to tell what a person is thinking.

“Which just sounds so crazy to me,” Andrew said. “But it is real, at least, in some sort of controlled lab situation. How long (until) it is more accessible to people?”

Committee co-Chairman Rep. Cyrus Western, R-Big Horn, said a conversation such as this one would’ve been considered “loony” five or 10 years ago.

But in this day and age, it’s now a legitimate concern among state lawmakers, he said.

“You can go on YouTube and check out the demonstration of neuro links,” Western said. “It’s very real, and so I think these definitions are worth considering.”

Committee co-Chairman Sen. Chris Rothfuss, D-Laramie, said the topic is certainly worth exploring, and he suggested continuing its discussion during the committee’s next meeting in September.

Wyoming currently has a Genetic Information Privacy Act with similar protections, Rothfuss said. This could be an area worth considering some modification to include a person’s neural and biological data.

Lawmakers on the committee considered the possibility of drafting a bill that would expand personal identity information in current statute or folding this definition into the current bill draft, House Bill 163, “Data privacy-government entities.” This bill was sponsored by the committee last interim, but failed to pass the introduction vote in the 2024 budget session.

The bill, as written, would set a three-year limit on the retention of private data by a state or local government entity. It also would require these entities to obtain “the express written consent of the natural person” before purchasing, selling, trading or transferring their personal data.

This story was published on July 6, 2024.