I know everything you did over the last two years. I know where you went, who you were with and everything you thought about, down to each second of the day. I know this because I hacked into the brain-computer interface (BCI) that records your memories and stores all of your thoughts. To make matters worse, you weren’t even aware that most of this data was collected by your BCI.

The technology to read minds is already in the lab and will soon be commercially available. The broader policy debate we have today on privacy and security issues related to data must include BCIs and the neural data they generate. In fact, there is an urgent need to do this.

Neural data is a unique biometric marker, like fingerprints and DNA, that can accurately identify unique individuals. What is worrisome is that biometric data privacy is mostly non-existent in the United States. Often, it is collected without consent or knowledge. For instance, people living in 47 states can be identified through images taken without their consent, using facial recognition software.

As neural data is increasingly incorporated into each person’s biometric profile, any notion of privacy will go flying out the window. In contrast to other biometric markers that mostly describe physical characteristics, neural data can give precise insight into the most intimate details of our minds. Allowing this information to become an engine for profit threatens our fundamental right to privacy.

To remedy this issue, I propose that Congress enact a Neural Data Privacy Act (NDPA).

The central premise of NDPA is that individuals must have a fundamental right to cognitive liberty. This means that people must be free to use or refuse BCIs without fear of discrimination and consent is always required for the collection of any neural data. Furthermore, strict limitations will be imposed on the type of neural data that can be collected and for what purposes. For instance, businesses and employers will be prohibited from profiting off neural data by selling or leasing it to third parties.

As this legislation will establish a fundamental right to cognitive liberty, a violation of this right will result in severe penalties. Language criminalizing invasion of cognitive liberty will be included in the NDPA, with a mandate for law enforcement agencies to enforce it. We can define violations of cognitive liberty under a few broad categories: accessing neural data without consent, distributing neural data without consent and compelling an individual to use of a BCI against their will.