30-23-101. Short title -- legislative findings and declaration of purpose. (1) This part may be cited as the "Genetic Information Privacy Act".

(2) The legislature finds and declares that:

(a) (i) the people of Montana regard their privacy as a fundamental right and an essential element of individual freedom; and

(ii) Article II, section 10, of the Montana constitution protects individuals' privacy, and fundamental privacy rights have long been, and continue to be, integral to protecting Montanans;

(b) ongoing advances in technology have produced exponential growth in the volume and variety of personal data being generated, collected, stored, and analyzed, and these advances present both great promise and potential risks;

(c) technology that collects data about the user's bodily and mental functions is transforming the volume and sensitivity of personal data collected from individuals and stored by companies;

(d) neurotechnologies, including devices capable of recording, interpreting, and altering the response of an individual's central or peripheral nervous system to its internal or external environment, raise particularly pressing privacy concerns given their ability to monitor, decode, and manipulate brain activity;

(e) data concerning the activity of the human brain and wider nervous systems, or "neurotechnology data", is extremely sensitive and can reveal intimate information about individuals, including information about health, mental states, emotions, and cognitive functioning;

(f) each human brain is unique, meaning that neural data is specific to the individual from whom it is collected. Because neurotechnology data contains distinctive information about the structure and functioning of individual brains and nervous systems, it contains sensitive information that may link the data to an identified or identifiable individual.

(g) the collection of neurotechnology data involves the involuntary disclosure of information. Even if individuals consent to the collection and processing of their data for narrow use, they are unlikely to be fully aware of the content or quality of information they are sharing.

(h) neurotechnology users cannot decide what specific neurotechnology information they would like to disclose, and they are unlikely to understand the extent to which their neurotechnology data can be decoded, currently or in the future. Neurotechnologies can collect and process information about an individual that the individual did not even know existed.

(i) neurotechnologies that are deployed in medical settings or otherwise utilize the surgical implantation of invasive devices are typically regulated as medical tools that produce health information. Both invasive and noninvasive wearable neurotechnologies used in medical settings are also regulated by health data privacy laws. However, when noninvasive neurotechnologies are used outside of medical settings, they are generally considered consumer products and operate without regulation or data protection standards.