[co-author: James O'Reilly*]
Montana recently revised its Genetic Information Privacy Act to address neural data. The law went into effect in 2023, and applies to both entities that offer genetic testing services as well as entities that use genetic data.
Under the current law, covered entities must provide notice and also have choice obligations. This includes getting consent about collection, use and sharing of genetic data. Covered entities must include specific content in the consent request. They also need to give separate notice in several circumstances. This includes if they want to share genetic information with non-vendor third parties, or use it for marketing purposes. There are also data security obligations under the law, as well as access obligations.
The Montana governor signed SB 163 on May 1 to amend the Genetic Information Privacy Act. As a result, beginning October 1, 2025, there will be several changes to the law. They include:
- Neural data will be covered by the law: As revised the law will cover “neurotechnology data.” This is information capable of “recording, interpreting, or altering the response of an individual’s central or peripheral nervous system” to its external environment. (This definition is slightly different than that which California and Colorado added to their comprehensive privacy laws.)
- De-identified neural data out of scope: As modified, the law will also except from coverage deidentified neural data that is used for research purposes. To be deidentified, among other things, the information cannot be reasonably linked to the individual, and measures must be taken to ensure that the data cannot be reassociated with an individual.
- Exceptions added to right of access: Also as modified, the law will provide for exceptions to the obligation to give individuals access to covered data, including if express consent was obtained from an individual participant in a clinical trial which was obtained following the provisions specified in the law (these include content and font size obligations, among other things).
*James O'Reilly is a Cybersecurity and Privacy Fellow in the firm’s Chicago office.
Putting it Into Practice: This modification to Montana’s Genetic Information Privacy Act reflects regulators’ concerns with uses of neural data, which companies might use when offering wearable technology or engaging in advertising that measures emotional engagement. This modification is a reminder for those who engage in these activities to review their notice process, and consider whether consent might be needed under this or similar laws.
