Neural data lives in a legal grey area. It has characteristics of biometrics and genomics, and when passed through an AI model, could also produce copyright. And because litigation hasn't yet caught up to the complexities of neural data, care must be taken with how it is collected and stored to ensure that operations are future-proofed.
We caught up with a veteran of the industry - Shane Brubaker, a neuroscientist and genomics expert - to discuss the matter. Shane is senior manager of bioinformatics software engineering at Myriad Genetics, one of the largest hereditary cancer testing laboratories in the United States. Shane took a computer science degree at Purdue and a master's in neuroscience at Oregon before going into genomics. Before Myriad, Shane worked at Affymetrix, LS9 and Solazyme designing the systems that enforce data protection rules by writing them into software.
He explained that, having worked with both neural data and genomic data, there were a lot of similarities.
Generous to the patient
The working assumption inside a commercial genomics lab is the inverse of what the courts decided. In scores of cases, judges ruled that after tissue or DNA are donated or excised, the contributor's rights over them are terminated, granted that the consent was taken appropriately.
"For us it's almost the opposite, where it's the patient's data," he said. "They have a right to retrieve it. They have a right to ask that it be deleted."
And retention is not indefinite. "We're building data management systems that can clean up the data after seven years." This is a Myriad policy, not one mandated by law.
His position on where a neurotechnology company should sit was unambiguous. "I would lean more on having more control from patients and people that are essentially licensing you valuable data, whether it's your neural data, your genomic data."
Perhaps Shane's patient-generous stance is tempered from experience.
In 2016 four patients backed by the ACLU filed a complaint alleging Myriad had withheld variant data it judged not medically significant, on the argument that it sat outside the records a patient is entitled to. The company released the data and kept its legal position. That position has since lost. Federal guidance now holds that for a laboratory covered by HIPAA the patient's record set includes the report, the full variant information, and the raw and curated data files. Which is roughly the distance between where genomics started on this question and where Shane is describing it from.
What about allowing revocation of consent after a model has been trained?
If the eventual purpose of collecting neural data is to train a model, what does revocation mean? A participant withdraws. The model is already trained. Nobody retrains a production model from scratch because one person changed their mind.
Myriad has the same problem from the other side. It has been working through whether to train genomic foundation models on the variants in its own patient population.
Shane's answer was to stop treating it as one consent.
"What I would suggest is to have people opt in for the AI training when they get their test. That can then be used to train models, but it won't have personally identifying information in the model."
I think you're right that we can't give them the option really to revoke the training. But they could ask that their raw data be cleaned up and removed at a certain point. People talk about AI whitewashing, where I've now learned from your data, trained a model, but you're not personally identifiable. Where does that lie?
The practical consequence is that a consent form should make two separate asks, because only one of them is reversible. Consent to record and consent to train are two different promises.
Architecture for handling data
The architecture for keeping identity away from the signal is older and well settled.
"We separate the genomic data and the PII into two different systems. We have your address and your name in a LIMS system. Then there's another identifier that's just a random UID, that connects it to your genomic data. So your genomic data that way is not really treated as PII."
Roles enforce the split as much as the schema does. "Only the data reviewers see the PII. But people like myself, we can work with the genomic data."
It is the pattern most biobanks run on, and it rests on an assumption that you can't re-identify a person from their genome. But can you?
"You can't quite easily do it yet, but I think probably people could, or it's very close to where it will become routine."
Genomes have been re-identified, but never by reading a genome on its own. Yaniv Erlich's group recovered surnames in 2013 by querying Y-chromosome markers against public genealogy databases, at roughly a 12 percent hit rate and only on white American men. By 2018 the same approach could reach a third cousin or closer for about 60 percent of Americans of European descent. What changed across those five years was that consumer genealogy databases passed a million profiles. Genomic re-identification is gated by the reference database, not by the mathematics, which is why it barely works for populations those databases underrepresent.
Neural data narrows the hatch. Yale showed in 2015 that a person's functional connectivity profile identifies them across scanning sessions and across different tasks. A group at Binghamton reached 100 percent identification across fifty people from EEG event-related potentials in 2016. A corpus of recordings does not need names attached to work as a way of following one person between datasets, and unlike a password or a stimulus set, nobody can be issued a new brain.
His mitigation was to stop relying on the pseudonym alone. "Maybe you encrypt their genome, and you say that system is allowed to decrypt it for training. That way a random person that gets hold of a file can't necessarily use it."
Intended use is the crux of the agreement
"In your license agreement you should have some intended use clauses that explain this is going to be used to train aphasia models, or motor models, or whatever it is. So you cannot just say, okay, I'm going to use your thoughts to go train a self-driving car."
"Most intellectual property is that way too. You have the claims, and you are probably not going to get super broad claims. If I'm making a food ingredient, I'm going to get claims around putting it in certain foods, not just any use of that microbial."
This stance is supported by the laws that do exist. Chile, which has the world's strictest neural data laws, mandates that you seek consent for the end-use of the data.
A commons your competitors can use
Maybe companies are competing in the wrong place. They say data is the moat, and if you are the only company that has data that is difficult to collect, that is certainly true.
Shane thinks perhaps we are competing in the wrong arena.
"In genetic testing, different companies make de-identified foundation models and data available somehow through this public resource. Then the different companies can train their own models on top of that. It's a way to share data with your competitors, but in a way that's safe for everyone."
This incentivises companies to compete on the model architectures rather than the data alone, which should lead to better results for everyone.
For this to work, it just requires everyone to contribute to a central repository until data is no longer a moat. Challenging.
Consent is king
The most important rule shared between neural and genomic data is that consent is king. You must seek consent to record, and for the purpose of the recording's use.
All of the data engineering stuff is secondary, and you can learn about it in Shane's new book.
Learn bioinformatics engineering from Shane
Shane is the author of the fourth edition of Bioinformatics with Python Cookbook, published by Packt in December 2025. It runs to 618 pages of recipes for sequencing workflows, quality control, alignment and variant calling, population genomics, cloud infrastructure and workflow orchestration, and a long stretch on what large language models are doing to protein and DNA design. It holds 4.6 stars from 20 ratings on Amazon.
The chapter we would point a neurotechnology team at first is the one on modern coding practices and AI-assisted development, because the argument running underneath this whole interview is that governance is a systems problem before it is a legal one.
References
- Moore v. Regents of the University of California, 51 Cal. 3d 120 (1990)
- Greenberg v. Miami Children's Hospital Research Institute, 264 F. Supp. 2d 1064 (S.D. Fla. 2003)
- Washington University v. Catalona, 490 F.3d 667 (8th Cir. 2007)
- Hecht v. Superior Court, 16 Cal. App. 4th 836 (1993)
- Yearworth v. North Bristol NHS Trust, [2009] EWCA Civ 37
- Association for Molecular Pathology v. Myriad Genetics, 569 U.S. 576 (2013)
- Biometric Information Privacy Act, 740 ILCS 14, and Article 9 GDPR, on special categories of personal data
- Finn et al., Functional connectome fingerprinting, Nature Neuroscience (2015)
- Ruiz-Blondet et al., CEREBRE: A Novel Method for Very High Accuracy Event-Related Potential Biometric Identification, IEEE Transactions on Information Forensics and Security (2016)
- Gymrek et al., Identifying personal genomes by surname inference, Science (2013)
- Erlich et al., Identity inference of genomic data using long-range familial searches, Science (2018)
- 42 CFR 493.1105, CLIA retention requirements
- OCR FAQ 2048, on the right of access to genomic information, and Tayeh et al., The designated record set for clinical genetic and genomic testing, Genetics in Medicine (2023)
- Patients File HIPAA Complaint Against Myriad Genetics for Withholding Variant Data, GenomeWeb (2016)
- MIND Act of 2025, S.2925
- Oseh Mathias, Whose thought is it anyway?