Interface

Applying Lessons from Genomics Data Governance to Neural Data

Shane Brubaker talks to us about what neural data governance efforts should learn from the field of genomics.

By Oseh Mathias·Aug 1, 2026·9 min

Neural data lives in a legal grey area. It has characteristics of biometrics and genomics, and when passed through an AI model, could also produce significant value. And because litigation hasn't yet caught up to the complexities of neural data, care must be taken with how it is collected and stored to ensure that business operations are future-proofed and patient rights protected.

We caught up with a veteran of the industry - Shane Brubaker, a neuroscientist and genomics expert - to discuss the matter. Shane is Senior Manager of Bioinformatics Software Engineering at Myriad Genetics, one of the largest hereditary cancer testing laboratories in the United States. Shane earned a Computer Science degree at Purdue University and a Master's in Neuroscience at the University of Oregon before going into genomics. Before Myriad, Shane worked at Affymetrix, LS9 and Solazyme designing systems that enforce data protection rules by writing them into software.

He explained that, having worked with both neural data and genomic data, there were a lot of similarities.

Generous to the patient

The working assumptions inside a commercial genomics lab are governed by a variety of regulations including HIPAA, GINA, and CAP/CLIA. This is despite some significant and often contradictory history in case law around ownership of patient samples. In scores of cases, judges ruled that after tissue or DNA are donated or excised, the contributor's rights over them are terminated, granted that the consent was taken appropriately (e.g. Moore v. the Regents of the University of California). In the genomics industry, regulations were then layered on top of this informed consent model to ensure patients have a right to determine how their data is used and to access their reports, as well as to avoid any discrimination based on their data.

Regulations require that patient data be kept for a certain period of time, usually a few years, so that patients can retrieve their records. "In general my preference would be to emphasize patient rights first and foremost", Shane says. While not explicitly mandated, he believed patients should have mechanisms for requesting their data be removed once it has passed beyond mandatory retention periods. Many aspects of consumer law do provide such protections for customer data.

His position on where a neurotechnology company should sit was unambiguous. "I would lean toward having more control from patients and people that are essentially licensing you valuable data, whether it's your neural data, your genomic data." This is not just about satisfying regulatory bodies, but making sure satisfied customers drive successful, profitable business models in a synergistic manner.

Perhaps Shane's patient-generous stance is tempered from experience. While there is little US case law on the matter, the case of Girardi v. Emotiv in Chile resulted in an order to delete patient brain data. Four states have now added neural data to their privacy protection laws. "Again the goal should not be to meet minimum requirements, but to create an ecosystem where patients and neurotech companies can both benefit by ensuring informed consent of clear activities aimed at an intended use".

What about allowing revocation of consent after a model has been trained?

If the eventual purpose of collecting neural data is to train a model, what does revocation mean? A participant withdraws. The model is already trained. Nobody retrains a production model from scratch because one person changed their mind.

The genomic testing industry has the same problem from the other side. It has been working through whether to train genomic foundation models on the variants in its own patient population.

Shane's answer was to stop treating it as one consent.

"What I would suggest is to have people opt in for the AI training when they get their test. That can then be used to train models, but it won't have personally identifying information in the model."

I think you're right that we can't give them the option really to revoke the training. But they could ask that their raw data be cleaned up and removed at a certain point. People talk about consent washing in AI, where I've now learned from your data, trained a model, but you're not personally identifiable. Where does that lie?

Companies should provide clear consent information around when data will be used to train models, what those models will do, and to what extent those models may be sold or licensed to third parties.

The practical consequence is that a consent form should make two separate asks, because only one of them is reversible. Consent to record and consent to train are two different promises.

Architecture for handling data

The architecture for keeping identity away from the signal is older and well settled.

"Typically, genomic data and PII (Personally Identifiable Information) are separated into two different systems. Your address and your name are kept in a LIMS (Laboratory Information Management System). Then there's another identifier that's just a random ID, that connects it to your genomic data. So your genomic data that way is not really treated as PII". Using this system, people and algorithms that work on your genomic data are safely firewalled away from the people who need to see your personal information to do their job (think technicians or Lab Directors). Shane recommends that neurotech companies adopt a similar strategy.

It is the pattern most biobanks run on, and it rests on an assumption that you can't re-identify a person from their genome. But can you?

"You can't quite easily do it yet, but I think probably people could, or it's very close to where it will become routine."

Genomes have been re-identified, but never by reading a genome on its own. Yaniv Erlich's group recovered surnames in 2013 by querying Y-chromosome markers against public genealogy databases, at roughly a 12 percent hit rate and only on white American men. By 2018 the same approach could reach a third cousin or closer for about 60 percent of Americans of European descent. What changed across those five years was that consumer genealogy databases passed a million profiles. Genomic re-identification is gated by the reference database, not by the mathematics, which is why it barely works for populations those databases underrepresent. Traits predicted from your genome, such as facial features or your voice, can also potentially be used for identification (Lippert, 2017).

Neural data narrows the gap. Yale showed in 2015 that a person's functional connectivity profile identifies them across scanning sessions and across different tasks. A group at Binghamton reached 100 percent identification across fifty people from EEG event-related potentials in 2016. A corpus of recordings does not need names attached to work as a way of following one person between datasets, and unlike a password or a stimulus set, nobody can be issued a new brain.

In other words, genomic and neural data should not be treated so much as de-identified, but more as "not trivially labeled".

Shane's suggested mitigation was to stop relying on the pseudonym alone. "Maybe you encrypt their genome, and you say that the system is allowed to decrypt it for training. That way a random person that gets hold of a file can't necessarily use it." Companies should also investigate ways to minimize the reverse engineering of AI models to derive underlying information (model inversion and membership inference). These could include restricting the nature of features, privacy noise injection, and other approaches.

Intended use is the crux of the agreement

"In your license agreement you should have some intended use clauses that explain this is going to be used to train aphasia models, or motor models, or whatever it is. So you cannot just say, okay, I'm going to use your thoughts to go train a self-driving car."

"Most intellectual property is that way too. You have the claims, and you are probably not going to get super broad claims. If I'm making a food ingredient from a microbial fermentation, I'm going to get claims around putting it in certain foods, not just any use of that microbial matter."

This stance is supported by the laws that do exist. Chile, which has the world's strictest neural data laws, mandates that you seek consent for the end-use of the data.

A commons your competitors can use

They say data is the moat, and if you are the only company that has data that is difficult to collect, that is certainly true. Shane thinks perhaps we are competing in the wrong arena.

"In the genetic testing industry, companies are currently exploring pooling of de-identified data across labs and institutions to build better AI foundation models. Companies can then leverage this data and train their own custom models in a way that is safe for patients and even safe for competitors in the same industry". For example the Genomic Testing Cooperative (GTC) leverages data from multiple participating labs to advance AI models for better variant interpretation and outcome prediction.

This incentivises companies to compete on the model architectures rather than the data alone, which should lead to better results for everyone.

For this to work, it just requires everyone to contribute to a central repository until data is no longer a moat. Challenging.

Consent is king

The most important rule shared between neural and genomic data is that consent is king. You must seek consent to record, and for the purpose of the recording's use. "An informed patient is a happy patient". Customers should be told how their raw data will be stored and retained, when it will be encrypted, and when and how they can request it be deleted. They should also be informed as to how that data may be used to train AI models, what the models will be used for, and how the models can be leveraged as part of community ecosystems, or resold to third parties either in whole or in Model-as-a-Service architectures. This approach seeks to maximize the rights of the patient while encouraging a healthy ecosystem of companies that can provide a rising standard of patient care for everyone.

All of the data engineering stuff is secondary, and you can learn about it in Shane's new book.

Learn bioinformatics engineering from Shane

Shane is the author of the fourth edition of Bioinformatics with Python Cookbook, published by Packt in December 2025. It runs to 618 pages of recipes for sequencing workflows, quality control, alignment and variant calling, population genomics, cloud infrastructure and workflow orchestration, and a long stretch on what large language models are doing to protein and DNA design. It holds 4.6 stars from 20 ratings on Amazon.

The chapter we would point a neurotechnology team at first is the one on modern coding practices and AI-assisted development, because the argument running underneath this whole interview is that governance is a systems problem before it is a legal one.

References

In this piece

PersonShane Brubaker

More from Interface