The right to mental privacy

"We are our brains and that's why we have to talk about human rights, because if you have a technology that allows you to measure the activity of the brain and change it, that same technology will allow you, sooner or later, to decipher mental activity and alter it."

Yuste, Rafael. (2025). Neurorights. A journey towards the protection of what makes us human. Paidós.

Neurotechnology  incorporates a set of methods or devices to record the activity of the brain or nervous system, and may even alter it. Therefore, as the techniques for analysing brain activity and therapeutic possibilities increase, ethical concern among professionals grows.

To integrate the analysis of this phenomenon with the European legal framework, we have an excellent guide: the work of Dr. Rafael Yuste and his book "Neurorights" (2025). The calcium imaging method, pioneered by Dr. Yuste, revolutionized the possibilities of neuroscientific research. It is an optical technique that uses calcium-sensitive dyes or indicators to infer when neurons are activated. When a neuron is activated, its calcium level increases, which produces an observable light signal. This technique has evolved from the use of chemical dyes to genetic sensors that neurons themselves produce, which makes it possible to study specific neuronal types and record their activity over longer periods.

Examples of behavior manipulation using neurotechnology

Dr. Yuste in his book provides very graphic examples that allow us to understand the possibilities that this methodology opens up:

•  A behavior can be stimulated in a laboratory mouse to suck a liquid in response to the viewing of video images. To do this, the neural groups that are activated by the learned visual stimulus are mapped. Then, with the stimulus turned off, those same neurons are activated with a laser and the mouse executes the expected behavioral response, without seeing anything in physical terms.
• In humans, speech neuroprostheses capable of decoding attempts at verbal production  have been developed in patients with paralysis and speech loss. From the recording of cortical activity during the reading and attempt to articulate sentences, these systems can generate text, synthetic voice and the animation of a facial avatar.
• Likewise, neurostimulation techniques are being experimented with  to improve the clinical situation of patients with Parkinson's disease and to intervene on certain behavioural aspects. We are also witnessing the development of new neurosurgical techniques based on brain-computer interfaces, both invasive – for example, by implants or wireless chips – and non-invasive, which can operate by means of energy beams or ultrasound.
• Finally, neurofeedback is emerging as a technology close to clinical and commercial application, as it allows brain activity to be modulated in cases such as post-traumatic stress disorder, through video games or interactive environments connected to measurement devices capable of detecting certain emotional states and generating conditions that favor the patient's improvement.

Paradoxically, artificial intelligence, which is accelerating neuroscience research processes, has largely been developed from models inspired by deep neural networks. Now, the study of biological neural networks could, in turn, decisively transform the future evolution of AI itself. Discovering the mathematical algorithms that underlie the functioning of the brain could favor the design of more efficient systems, inspired both by their processing capacity and by their very low energy cost.

The importance of neurorights

Dr. Yuste and the Neurorights Foundation have stated that these scientific advances require a specific ethical and legal approach: neurorights. In this regard, they have proposed five categories:

1. Right to mental privacy. 

   Research in this area of knowledge inevitably reveals private information, incorporating new risks into the profiling techniques that social networks deploy based on neuroscience. 

2. Right to personal identity.

   Our identity is highly dependent on the information and experience that consolidates our memory. Some therapies can affect our identity. 

3. Right to free will: to be able to decide in the face of techniques that generate behavioral alterations.

   It has been found that the use of neurostimulation to treat certain disorders causes the patient to behave differently. In this affectation, it is no longer just a matter of preserving identity, but of ensuring that any expected changes in the patient's personality and behavior result from their free choice. 

4. Fair access to neuroaugmentation.

   An expected result in the future may be the emergence of technologies that enhance our cognitive abilities. There is a danger that a market for services will be generated that privileges only those social or economic classes with the capacity to contract them. 

5. Protection against bias and discrimination.

   In the same way as was already the case with genetic research, the more information we have about the human brain, the greater the risk of biases and/or discrimination. Here the risk is no longer merely passive, it can be increased, for example, by the use of artificial intelligence when the risk of bias in its operation has not been adequately foreseen or governed.

Figure 1. Neurorights – Source: Dr Rafael Yuste (in his book *Neurorights*, 2025) and the Neurorights Foundation.

This proposal inspired the consideration of neurorights by the Charter of Digital Rights promoted by the Government of Spain and is generating a deep debate at the academic and legislative levels. The proposal to regulate neurotechnology through neurorights goes beyond scientific research and its origin, and becomes urgent due to the significant interest of the industry.

Guaranteeing neurorights from the existing regulatory framework: the right to privacy

One of the challenges that we must overcome from the world of law is to be able to address the impacts of technology from the tools provided by the current legal system. The absence of a specific right does not imply that this technology can be developed and deployed without limits. The EU has understood the importance of guaranteeing a humanistic conception of technology focused on guaranteeing fundamental rights, ensuring the indemnity of patients against any physical or psychological repercussions and ensuring that technology will not put democracy or the rule of law at risk.

The right to mental privacy is proposed as the first tool available for the guarantee of people's rights in the field of neurotechnology. And, although the natural temptation is to place the focus on the scope of the fundamental right to data protection, the truth is that the right to privacy – which is recognised in Article 18.4 of the Spanish Constitution and Articles 7 and 8 of the European Charter of Fundamental Rights – offers a set of promising instruments for an early approach to the risks that the use of this technology may pose.

In the first place, from the point of view of human dignity, intimacy is projected onto our body as a scenario to guarantee the patient's free self-determination. This capacity for control and disposition is clearly manifested in the Law regulating patient autonomy, and defines informed consent as a first barrier. In this it coincides with the principles in force in the field of biomedical research. For this reason, both those who intend to develop systems based on neurotechnology and to implement them in a clinical setting find in the duty of transparency and in the establishment of guarantees to obtain free consent from the patient the first insurmountable legal barrier. Neurotechnologies are particularly complicated instruments whose understanding may escape the capabilities of the majority of the population, including legal experts themselves. Consequently, the promise of the advantages offered by the treatment or service that is intended to be provided to us will not be enough: it will be essential that the information is provided in a clear, accessible and understandable way in a verifiable process and free of any type of coercion.

Secondly, article 18 of the Constitution includes the guarantee of the right to family privacy, as well as honour and one's own image. From a material point of view, it can be understood that the impact on a subject's conduct derived from the use of neurotechnology could have an impact on these rights. On the one hand, if some type of change is caused in the personality of the subject, it could affect interpersonal relationships in the private sphere. On the other hand, honor guarantees the esteem or social consideration that a subject has had. By its very nature, it implies a certain self-perception on the part of the subject with respect to his personality, behavior and social esteem, and could be affected in the event that, as a result of the treatment, there is a personality change with reputational impact. It is more complicated to determine the existence of effects on the right to one's own image, except in relation to the dissemination of medical images or the possibility of theorizing with the idea that behavioral changes can have an impact on the image projected by a given subject when he or she decides to change it.

However, and although it has not been the subject of a specific legal development, there is an emerging property that links the right to privacy of article 18.1 of the Constitution with the problem at hand: the right to identity. Without wishing to theorize excessively, over the last two centuries it has been pointed out very precisely that the guarantee of private life operates as a sphere of protection of the individual against third parties, which provides him with a space of freedom in which to develop his personality. This is particularly noticeable in the case of children and adolescents for whom gradually expanding their sphere of privacy vis-à-vis their family environment is crucial to guarantee the processes that allow them to achieve due maturity and autonomy. The conclusion is clear: the guarantee of the right to privacy must be rigorously applied in the field of neurotechnologies as a necessary instrument for the preservation of human dignity, free individual self-determination and the development of personality.

From the fundamental right to data protection to the Artificial Intelligence Regulation: the commitment to process engineering

The guarantee of our fundamental rights with respect to the development and use of neurotechnologies will depend essentially on the processes defined by the General Data Protection Regulation (GDPR) and the Artificial Intelligence Regulation (RIA).

The right to data protection has an instrumental nature that projects them on all fundamental rights. It is not conceived in the abstract, but with reference to a concrete treatment for a specific purpose in a given context. For example, when behavioral algorithms are intended to profile a subject on a social network and guide their consumption of information, we may be affecting ideological freedom or freedom of belief. The paradigmatic example of this can be found in scientific denialism. Personalization algorithms, by betting on monetizing the user experience with advertising, do nothing more than consolidate the confirmation bias that feeds irrational beliefs. Therefore, when we apply the procedures of the GDPR for the development of systems that will be able to obtain neural information, process it, develop treatments or deploy services, we are guaranteeing that this technology is respectful of all our fundamental rights.

The GDPR and the RIA share a highly productive dual approach. The first is that of design focused on the guarantee of human rights. Therefore, in both cases, before developing any invention in the field of neurotechnology, we must ask ourselves if what we intend to achieve violates any fundamental right, incurs in any prohibited practice or finds any legal restriction in current law. In addition, we will be able to apply the ethical standards of biomedical research, as well as emerging standards both in the field of artificial intelligence development.

The second major commitment in both regulations, and expressly in the RIA, is what we can define as product orientation. That is, in both cases the two standards define a  clearly articulated set of process engineering that must accompany the development process:

• Within the scope of the GDPR, it will be necessary to deploy a risk analysis or, in the most significant cases, a data protection impact assessment . This type of process will provide us with a clear identification of all types of risks. The most important, the primary ones, are those that refer to the rights of people. This is without prejudice to the fact that we can identify risks with respect to the data protection principles. Of particular importance here are those related to the quality of information and the principle of minimisation, information security, as well as any type of risk inherent to the organisation, including the training needs of personnel.
• In the design of high-risk systems in the RIA , practically all variables are addressed. As with the GDPR, it is essential to develop an impact assessment here on fundamental rights. On the other hand, as in the design of any AI-based application, it will be essential to monitor and manage risks, ensure data governance, adopt specific measures to guarantee robustness and resilience, deploy human supervision strategies, guarantee the training of the teams that will use the tool and ensure that, thanks to compliance with transparency in the deployment,  The technology is implemented in complete safety.

Both standards are subject to controls. In the GDPR, these controls are specific to the organization and are based on the establishment of periodic controls, the development of regular audits and the implementation of incident management methodologies. In the field of high-risk RIA systems, in addition to implementing procedures equivalent to those of the GDPR, it is important to note that, as it requires the authorisation of a notified body, the documentation requirements are very high. On the other hand, these are products subject to post-commercial surveillance.

Therefore, it can be said that there is a regulatory framework that can perform essential functions when it comes to guaranteeing our neurorights. Any additional regulation that requires the conditions for the development and deployment of neurotechnology will always be welcome. And we must not forget an essential aspect: the two standards we have mentioned are relevant in that they offer a set of processes that allow us to guide our strategy for the development and implementation of these techniques. However, in the constitutional systems of the Member States of the European Union and in the Union itself, the fundamental rights that are guaranteed for all people are already legal norms and apply directly: there are no excuses for their violation.

Content prepared by Ricard Martínez Martínez, Director of the Chair of Privacy and Digital Transformation, Department of Constitutional Law, University of Valencia. The contents and views expressed in this publication are the sole responsibility of the author.