Montana Enacts Senate Bill 163, Expanding Genetic Information Privacy Act to Include Neurotechnology Data

Strategic Insights -

In a growing recognition of the sensitivity of neural data, Montana has amended its Genetic Information Privacy Act (MGIPA) with Senate Bill 163 (SB 163), effectively protecting neurotechnology data alongside genetic data. This law mirrors similar amendments in California and Colorado, emphasizing the need for entities handling neural data to obtain consent, provide notice, and respect consumer rights. Effective on October 1, 2025, SB 163 introduces new compliance obligations, particularly around consent, notice, and research uses, impacting companies operating in this evolving space.

Key Takeaways:

  • SB 163 expands the MGIPA to cover neurotechnology data, including data collected from the activity of the central or peripheral nervous system, and devices that can record, interpret, or alter an individual's neural activity.
  • Entities handling neurotechnology data must obtain consent from consumers, provide two privacy policies (a high-level overview and a prominent publicly available notice), and respect consumer rights, including access, deletion, and revocation of consent.
  • Deidentified genetic data obtained from third parties is excluded, provided it is used for internal, medical, or scientific research and meets specific requirements.
  • Key exceptions include protected health information collected by HIPAA-covered entities, entities conducting scientific or clinical research with consent, and government agency uses.
  • Montana, California, and Colorado require consumers to provide consent before collecting and processing neural data, but offer varying definitions of neural data and exceptions.

Statistics:

  • Effective date of SB 163: October 1, 2025.
  • Number of states protecting neural or neurotechnology data: 3 (Montana, California, and Colorado).
  • Exclusions under SB 163: Deidentified genetic data, protected health information, and government agency uses.

Sources:

  • Senate Bill 163 (SB 163), Montana Enacted Judicial Branch (no date available).
  • California Consumer Protection Act, California Online Privacy Protection Act (Cal. Civ. Code § 1798.140) (no date available).
  • Colorado Revised Statutes, article 10, section 1 (no date available).