Unsettled Categories: Neurodata Processing in Occupational Safety and Health at the Boundaries of Data Protection

AI Regulation: ECRs’ Perspectives is a CREATe blog series featuring the work of early career researchers who are exploring the contemporary challenges of AI regulation. Based on research presented at the AI Regulation ECR Conference, each post provides a concise and accessible insight into emerging legal and policy debates around artificial intelligence.

The series continues with a blog post by José Miguel Diéguez Rodríguez.  José is a PhD candidate in Law at the University of Murcia and a researcher at the Fundación Integra Chair on Identity and Digital Rights. He has contributed to the White Book for the Development of the Spanish Digital Rights Charter in the Field of Neurotechnology, authoring a chapter on the impact of neurotechnologies in labour law. His research focuses on AI and neurotechnology governance.

The use of Smart Personal Protective Equipment is no longer a speculative prospect. Regulatory and standard-setting bodies have already begun to recognise both the feasibility and the potential value of these technologies in the field of Occupational Safety and Health (“OSH”). The European Agency for Safety and Health at Work, for instance, has highlighted the role that neurodevices may play in improving workplace safety.

At the same time, European standardisation efforts are moving forward. Work within CEN-CENELEC (in particular through the Joint Technical Committee 23) reflects a growing institutional commitment to establishing technical frameworks for these systems.

Taken together, these developments suggest that the relevant question is no longer whether such technologies will be introduced into the workplace, but how existing legal frameworks should respond.

• Two functional uses of workplace neurodevices

In broad terms, these tools can be deployed in two distinct, though related, ways:

MN8® and Brainwear® are registered trademarks of Emotiv

• • On the other hand, these systems may also be used for longer-term purposes through the collection and analysis of data at an aggregated level. Rather than focusing on individual workers, this second mode of use seeks to identify structural patterns within the workforce. The resulting insights may then inform the improvement of working conditions, for instance by adapting work rhythms, refining ergonomic design, or reconsidering certain managerial practices.

• Classifying neurodata under Article 9 GDPR

In light of these developments, the legal classification of “neurodata” becomes a central issue. Although neither the GDPR nor the UK GDPR provides an explicit definition of “neurodata”, the Information Commissioner’s Office has already emphasised that the term should encompass information relating to neural activity across the nervous system as a whole.

More specifically, the question of whether neurodata invariably fall within the special categories under Article 9(1) GDPR has been the subject of sustained academic debate in recent years.

In this regard, the European Data Protection Supervisor has observed, in its Neurotech Dispatch, that neurodata will “often” qualify as special categories. However, “often” should not be conflated with “always”. This interpretation is reinforced by the fact that several experts have called for the explicit inclusion of neurodata as a distinct special category within the GDPR.

The position, however, appears to shift in the specific context of OSH. If data relating to the current physical or mental condition of an individual are understood as “data concerning health” (as defined in Article 4(15) GDPR and interpreted broadly in Recital 35, as well as in guidance from the European Data Protection Board (“EDPB”)) then information indicating fatigue, stress, or similar physiological states falls within the scope of Article 9.

This remains the case even where the purpose of the processing is not to draw conclusions about a worker’s general health status, but rather to detect temporary conditions that may compromise safe task performance. In practice, therefore, while the classification of neurodata may appear conceptually open, its application in occupational safety contexts tends to converge towards their qualification as health data.

• Lawful deployment and regulatory gaps

The fact that neurodata processed in OSH are likely to fall within the scope of Article 9 GDPR does not in itself render their use unlawful. The Regulation provides for a number of exceptions under which such processing may be permitted, most notably where it is necessary for the purposes of employment and social protection (Article 9(2)(b)) or for preventive or occupational medicine (Article 9(2)(h)).

However, both provisions ultimately depend on the existence of a sufficiently clear legal framework at Union or Member State level. It is precisely here that the analysis reveals a structural gap: at present, no explicit rules govern the deployment of AI-enabled neurotechnologies in the workplace. As a result, it remains uncertain whether general obligations to ensure workers’ health and safety are, on their own, sufficient to justify their use in practice.

And yet, even if one accepts that existing OSH legislation may, in principle, provide a basis for relying on these exceptions, further complications may arise at national level. The case of Spain offers a particularly illustrative example.

Where the processing of neurodata is understood to fall within the domain of occupational medicine, access to medical information is strictly limited to health professionals. Under Article 22.4 of the Spanish Occupational Risk Prevention Law, employers may only receive the conclusions derived from medical examinations rather than the underlying data itself. In addition, occupational health activities may only be outsourced to accredited preventive services, which significantly restricts the possibility of relying on external providers.

By contrast, if such technologies are framed as instruments of workplace safety rather than occupational medicine, these constraints do not apply in the same way. From a teleological perspective, this latter interpretation appears more coherent in situations where the purpose of the processing is not to assess the worker’s health as such, but to prevent accidents by detecting temporary conditions incompatible with safe performance.

• Automated decision-making and the limits of Article 22 GDPR

A further issue concerns the potential application of Article 22 GDPR on automated individual decision-making. At first glance, certain uses of workplace neurodevices might appear to fall within its scope. In particular, where a system automatically requires a worker to interrupt a task due to the detection of a physiological condition it may be tempting to characterise this as a form of automated decision-making affecting the individual.

However, a closer reading of Article 22 suggests that this initial intuition is misleading. As clarified by Recital 71 and by the EDPB, the provision is limited to decisions that produce legal effects or similarly significant effects on the data subject.

This threshold has been consistently understood as requiring a sustained and substantial impact on the individual’s situation, typically involving exclusion from employment, denial of access to services, or other forms of serious disadvantage. The rationale underlying Article 22 is therefore to address decisions that meaningfully alter a person’s legal or socio-economic position in a durable manner.

By contrast, the types of interventions associated with smart personal protective equipment operate at a different level. Measures like temporarily interrupting a task, issuing a warning, or requiring a short pause in activity are aimed at preventing immediate harm, including avoiding potentially lethal accidents in high-risk sectors, rather than producing lasting consequences for the worker.

From this perspective, such interventions do not meet the threshold required to trigger the application of Article 22. They do not entail the kind of sustained and adverse impact that characterises decisions falling within its scope, but rather constitute context-specific safety measures embedded within the operational environment of the workplace.

• The Digital Omnibus Act as a limited functional solution

Against this background, the proposed Digital Omnibus Act (“DOA”) introduces a further dimension that deserves attention. The proposal has attracted significant criticism, much of which is well-founded, and this is not the place to enter into a broader assessment of its overall merits. Yet, for the specific purposes considered here, it may operate as a relatively agile tool for alleviating some of the legal difficulties surrounding the use of workplace neurodevices.

Its relevance becomes clearer when one considers the proposed clarification of the notion of personal data. At its core lies a relational understanding of that concept: whether information qualifies as personal data is not absolute but depends on the position of the entity processing it. In other words, information may fall outside the scope of personal data for a given actor where that actor does not possess means reasonably likely to enable the identification of the data subject, even if another entity does have such means.

This position is broadly consistent with the logic reflected in recent case law of the Court of Justice of the European Union, according to which pseudonymised data may be treated as non-personal for entities that lack realistic means of re-identification, particularly where identification is prohibited by law or would require disproportionate effort.

If adopted, the reform lends itself to illustration through vendor-mediated processing models in the context of workplace neurodevices.

In the case of real-time applications, the proposed framework would facilitate the use of external service providers for smart personal protective equipment. Where such providers operate exclusively with device-level identifiers and do not have access to information enabling the identification of individual workers, the data they process may fall outside the scope of personal data. Under these conditions, no transfer of personal data would arise within the meaning of the GDPR.

A similar logic applies to the use of neurodata for workforce-level analysis. Where data are collected and processed for purposes such as ergonomic optimisation or the adaptation of working rhythms, external providers may operate solely on device-linked identifiers without access to worker identities. The resulting datasets can then be aggregated and anonymised, with only these outputs being shared with the employer.

In such a configuration, neither the external provider nor the employer would be “processing personal data.” The provider would handle only non-identifiable data at the level of device identifiers, while the employer would receive exclusively aggregated and anonymised information.

From this perspective, the approach outlined above offers a way of structuring the implementation of these technologies so that their use does not necessarily entail the processing of personal data at all. In doing so, it creates the conditions under which safety-enhancing systems may be implemented while reducing the regulatory constraints that would otherwise arise under the GDPR.

Conclusion: legal uncertainty at the point of highest practical value

The analysis developed above shows that the use of OSH neurotechnologies remains legally unsettled precisely in those contexts in which their practical value may be greatest.

A first source of difficulty concerns the classification of the data involved. While it is possible to anticipate the likely position of supervisory authorities in many cases, sufficiently clear and stable criteria are still lacking. As a result, the qualification of neurodata under Article 9 GDPR remains, to a significant extent, context-dependent and open to interpretation.

A second difficulty emerges when moving from classification to lawful introduction in the workplace. The application of the exceptions provided for in Article 9(2) ultimately depends on the existence of a sufficiently clear regulatory framework at Union or Member State level. At present, such a framework is largely absent. This creates a situation in which the legal conditions for deploying these technologies remain uncertain, even where their potential contribution to OSH is widely acknowledged.

The result is a structural tension. Technologies capable of preventing accidents, reducing fatigue, and improving working conditions may, in practice, face significant barriers to their integration within the framework of preventive measures available to the employer, not because their objectives are incompatible with data protection law, but because the legal system has not yet developed sufficiently precise rules to accommodate them.

In this context, the DOA may alleviate some of the pressure points identified above, particularly by clarifying the notion of personal data and enabling certain processing models to fall outside the scope of the GDPR. However, even if adopted, it cannot by itself provide the normative architecture required in this field.

What remains necessary is the development of a more explicit and coherent regulatory framework capable of defining the conditions under which these technologies may be used. Without such clarification, data protection law risks generating a chilling effect not only on innovation, but also on the deployment of technologies that may play a key role in safeguarding workers’ right to fair and just working conditions.

Next week, the series continues with the blog post “Copyright protection of prompted generative AI outputs in the United Kingdom: A preliminary taxonomy” by Cody Rei-Anderson, in which he analyses how  copyright law treats works produced by or with the assistance of generative AI. In this post, he proposes three possible routes to copyright protection for prompted AI works.