“WE, THE PEOPLE OF INDIA,” through the Preamble of the Constitution, apart from solemnly resolving to constitute India into a SOVEREIGN SOCIALIST SECULAR DEMOCRATIC REPUBLIC vowed to secure to all its citizens, among others, “liberty of thought, expression…” The sanctity of liberty of thought and expression is inviolable regardless of any development including unprecedented technological innovations taking place during the last two decades. Therefore, privacy, integrally associated with liberty of thought, has now been reckoned with as key aspects of right to life, dignity and freedom.
It is well documented that privacy has always changed with technology. As new tools make it easier to observe, record and analyse and surveil people, the law must reconsider the limits of that access. The internet changed privacy from a concern about physical space to a concern about personal information. Smartphones, biometric systems, facial recognition and artificial intelligence have expanded that concern even further.
Neurotechnology takes the issue to a deeper level. Traditional surveillance usually observes what a person does or says. Neurotechnology may go further by recording or analysing neural activity and drawing conclusions about attention, memory, emotions, cognitive abilities and, perhaps one day, intentions. This raises a difficult question: If privacy protects a person’s private life, should it also protect the mind from unauthorised technological access and influence?
This question is particularly important in India. In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court recognised privacy as a fundamental right connected with dignity, liberty and personal autonomy. Privacy is not limited to secrecy or physical seclusion. It includes bodily privacy, decisional freedom and control over personal information.
The decision in Selvi v. State of Karnataka is also significant. While considering involuntary narco-analysis, polygraph tests and Brain Electrical Activation Profile tests, the Supreme Court recognised that privacy includes the realm of mental processes. The fact that a technology exists does not mean that the State may automatically use it. Its use must respect autonomy, dignity and the protection against compelled disclosure of personal knowledge.
These decisions provide a constitutional foundation for neuro-privacy. Even though the Constitution does not expressly use that term, Articles 14, 19, 20(3) and 21 contain principles that can protect people from unjustified interference with their neural information and mental processes.
What Neuro-Privacy Means
Brain data or neural data can include raw information recorded directly from neural activity, such as electrical signals collected through an electroencephalogram or an implanted device. It can also include conclusions produced when artificial intelligence analyses those signals.
The concern is therefore not limited to what a device directly records. A system may try to infer whether a person is tired, distracted, anxious, emotionally distressed or likely to behave in a particular way. The person may never have consciously revealed this information. An algorithm may nevertheless attempt to construct a profile from neural or related physiological signals.
This makes inference as important as collection. A person’s neural signals can become the starting point for creating new information about their mental and emotional life. A legal framework that protects only information deliberately disclosed by an individual would not be sufficient.
Neuro-privacy can therefore be understood as the right to control access to, collection, analysis, inference, sharing and use of information connected with neural activity and mental processes. It need not initially be recognised as a completely separate constitutional right. It can develop as a specific application of existing protections relating to privacy, dignity, bodily integrity, personal liberty, decisional autonomy and freedom of thought.
Why Brain Data Is Different
Brain data deserves special care not simply because it is sensitive, but because of what it may reveal. An address can show where someone lives. A purchase history can suggest economic preferences. A medical record can reveal a physical condition. Neural information may reveal how a person thinks, remembers, feels, reacts and makes decisions.
The brain is not merely another source of biometric information. A fingerprint mainly identifies a person, and a photograph records their appearance. Neural data may expose or generate conclusions about a person’s inner life. That creates a direct connection between data processing and mental autonomy.
Artificial intelligence makes this risk greater. A neural signal that seems meaningless on its own may become significant when processed by a sophisticated model. Such conclusions could affect employment, education, healthcare, insurance, criminal investigation, political communication and consumer decisions.
The issue is not only “brain reading”. It is also “brain inference”: the creation of a probable picture of a person’s mental state without a conscious statement from that person. The law must address both.
Article 21 and Mental Autonomy
Article 21 offers the strongest constitutional basis for protecting neuro-privacy. The Supreme Court has understood Article 21 as protecting dignity, liberty and the freedom to develop one’s personality. Privacy makes meaningful choices possible. If the Constitution protects the body and intimate personal decisions from unjustified interference, it should also protect the mental sphere.
A person should not be treated merely as an object to be watched, predicted, classified or influenced. Unauthorised access to neural information may affect how people form beliefs, make decisions and exercise their freedom. Mental privacy should therefore include the right to decide whether, when and why another person or institution may access and interpret information about one’s mental processes.
This may be described as mental or cognitive autonomy. It means having control over one’s thoughts, mental experiences, cognitive responses and psychological information. It also includes protection against systems designed to predict or influence mental states without genuine authorisation.
The related idea of mental integrity is equally important. Physical integrity protects the body. Informational integrity protects personal information. Mental integrity protects the cognitive and psychological sphere. A device that enters the body, records neural activity and influences brain function may threaten all three forms of integrity at once.
Article 19 and Freedom of Thought
Freedom of speech and expression depends on the freedom to form, change and communicate beliefs. People need an internal space where they can think without feeling that every reaction is being measured.
The danger is greater when governments, political parties or companies use neural and behavioural data to identify mental vulnerabilities and target people through them. Persuasion can become manipulation when it relies on hidden information about a person’s emotional or cognitive susceptibility.
Democracy requires citizens to form political opinions independently. Protecting an unmonitored mental sphere supports dissent, independent judgment and the freedom to develop unpopular or unconventional ideas.
Why Consent Is Not Enough
Consent is important, but it cannot be the only protection. Consent may not be meaningful when there is a strong imbalance of power.
For example, an employer may ask workers to wear a device that measures attention, fatigue or emotional engagement. An employee may technically agree, but economic dependence may make refusal unrealistic. A school may similarly require children to use attention-monitoring technology, leaving families with little genuine choice.
Consumers face another problem. They may accept long privacy policies without understanding how neural information could later be used for artificial-intelligence training, health predictions, behavioural profiling or targeted advertising. People also cannot reliably predict what future technologies may infer from information collected today.
Consent should therefore be supported by clear limits on purpose, necessity, proportionality, data collection, retention and harmful inference. It should be specific, informed, voluntary and revocable. It must not become a legal fiction through which people permanently surrender control over information about their minds.
Artificial Intelligence and Inference
Artificial intelligence can identify patterns in large amounts of data and produce predictions that human observers may not be able to make. As these systems improve, the value of neural data may increase. More data may lead to better models, better models may produce more detailed inferences, and those inferences may create pressure to collect even more data.
The law should not assume that information may be collected simply because it could be useful in the future. Technological possibility is not the same as legal necessity. Purpose limitation and data minimisation should apply to the original collection as well as to later model development, profiling and inference.
Should Brain Data Receive Enhanced Protection?
Brain data should receive enhanced protection under Indian law. However, merely adding it to a list of sensitive personal information would not solve the entire problem. The Digital Personal Data Protection Act, 2023 uses a broad framework for personal data and does not follow the earlier model of separately classifying sensitive personal data. Neural information may therefore fall within personal data generally, but information capable of revealing or predicting mental processes deserves more focused safeguards.
Protection should cover at least: Raw neural signals and recordings; Information about neurological or cognitive conditions; Data concerning emotional and mental states; Neural biometric information; AI-generated conclusions about cognition, emotion, memory or intention; Behavioural or multimodal data capable of producing similar mental-state inferences.
The law should be technologically neutral. If protection applies only to information collected through a brain sensor, organisations may use other forms of data to reach similar conclusions. The sensitivity of the inference and the consequences of its use should matter as much as the source of the data.
The Right Not to Know and Mental Silence
Neurotechnology may create a new form of autonomy: the right not to know. Suppose a system predicts that a person may develop a neurological condition in the future. Should that prediction automatically be disclosed ? The answer is difficult, especially when the prediction is uncertain.
Such information may affect employment, insurance, family relationships and mental well-being. It may create fear or stigma even if it later proves wrong. People should therefore have a say in whether they receive certain predictions about their own neurological or mental condition.
Neuro-privacy is not only about keeping information secret. It is also about controlling one’s relationship with information about oneself.
The right to mental silence is similarly important. If people know that their attention, emotions or cognitive responses are constantly monitored, they may change their behaviour and even their thoughts because they expect to be observed. This could create a new chilling effect. Freedom of thought requires an inner space where people can explore ideas, question beliefs and experience emotions without fearing that every response will become data. Mental privacy is therefore necessary not only for individual dignity but also for intellectual freedom and democracy.
From Neuro-Reading to Neuro-Manipulation
The debate should not stop at reading or inferring information from the brain. The more serious future concern may be the ability to influence neural activity. Neuro-reading involves extracting or interpreting information from neural signals. Neuro-writing involves influencing, modifying or stimulating neural processes. Neuro-writing raises difficult questions about identity, responsibility, consent and autonomy that ordinary data-protection law cannot fully answer. If technology moves from observing the mind to changing it, the law will need to protect both informational access to the mind and freedom from unwanted technological influence.
Developing an Indian Framework
India should develop a comprehensive neuro-privacy framework within constitutional law and data-protection law. It should treat neural information as high-risk personal information and cover both directly measured signals and AI-generated mental-state inferences.
The framework should provide for: Specific, informed and revocable consent; Strict limits on secondary use and repurposing; Data minimisation and short retention periods; Impact assessments for high-risk processing; Tight limits on workplace monitoring, except in narrowly defined safety-critical settings; Prohibition or strict control of routine neural monitoring in schools; Protection against discrimination by employers, insurers, schools and political organisations; Judicial or independent authorisation for highly intrusive State uses; Rights to access, correct and delete information; Clear explanations of automated conclusions about mental or cognitive characteristics; Effective remedies, compensation and institutional accountability.
The law should also consider the consequences of processing. Recording neural activity may create one level of risk. Using an inferred emotional or cognitive profile to deny employment, change insurance terms or influence political behaviour creates a much greater risk. Protection should reflect both the sensitivity of the information and the importance of the decision affected by it.
Cognitive Liberty
Cognitive liberty means the freedom to govern one’s own mental processes and remain free from unjustified interference with thought and cognition.
Indian courts need not immediately declare it to be a completely separate fundamental right. A cautious approach would develop it from the combined values of Articles 14, 19, 20(3) and 21, including privacy, bodily integrity, freedom of thought, freedom of conscience, decisional autonomy and personal liberty. This approach would allow constitutional law to respond to new technology without creating unnecessary categories of rights. If future developments make existing protections inadequate, Parliament and the courts may later consider more explicit recognition.
From Data Protection to Human Protection
Neuro-privacy should not be treated as merely another part of data protection. Data protection asks how information should be collected, processed, stored and shared. Neuro-privacy raises an earlier question: should certain forms of access to the human mind be allowed at all, even when a person has formally consented?
Ordinary compliance procedures and financial penalties may not always be enough. A violation of mental privacy can be irreversible. Once information about a person’s mental processes has been extracted, analysed or shared, deleting the original file may not restore the person’s previous privacy. The individual is not merely a data subject. The individual is a constitutional person whose dignity and autonomy place limits on what technology may extract from the body and mind.
Conclusion
One of the most important privacy questions of this century may be who can access the human mind. Neurotechnology challenges the old boundary between what people voluntarily communicate and what technology can infer without any word uttered by them. India’s Constitution has strong principles for responding to this challenge. Puttaswamy supports privacy, dignity, autonomy and control over personal information. Selvi is especially relevant because it recognises the constitutional importance of mental processes and limits compelled access to them.
Together, Articles 14, 19, 20(3) and 21 support protection against arbitrary classification, covert manipulation, compelled neural evidence and unjustified interference with mental autonomy. Brain data should therefore receive heightened legal protection in India.
But the goal should be greater than simply adding brain data to a statutory list. The deeper goal is to protect mental privacy, cognitive liberty and mental integrity.
Neurotechnology can serve valuable purposes, including restoring communication, treating disease and assisting persons with disabilities. It can also enable surveillance, discrimination, coercion and manipulation. The right response is neither to ban innovation nor to leave it unregulated. It is to build a rights-based framework that permits responsible uses while protecting human freedom.
The real question is not whether technology should help us understand the brain. It is whether the power to understand the brain will become the power to control the person.
Technological ability does not create a legal right to enter someone’s mind. protecting the individual’s ability to remain an autonomous human being.
The Constitution protects more than what people own, say or do. It also protects the conditions that allow people to think, choose, believe, dissent, imagine and become who they are. As technology approaches the mind, protecting that inner freedom may become one of the most important constitutional tasks of our time.
Privacy should not end where the skull begins…!