External Links

Civil Law and Brainwave Data Commercial Exploitation Liability in Singapore

1. Introduction

Brainwave data commercial exploitation liability concerns the legal responsibility of companies, technology developers, healthcare institutions, employers, researchers and other organisations that collect, process, analyse, license, sell or commercially exploit information generated from an individual's brain activity.

Brainwave data is commonly obtained through technologies such as:

Electroencephalography (EEG).

Brain-computer interfaces (BCIs).

Neurofeedback devices.

Neural implants and wearable neurotechnology.

Cognitive monitoring and attention-tracking systems.

Artificial intelligence-based neurological prediction systems.

Neurotechnology used in gaming, advertising, education and workplace productivity.

Brainwave data can reveal or help infer highly personal information, including attention patterns, cognitive responses, neurological conditions, emotional reactions and behavioural tendencies. Commercial exploitation may therefore create risks beyond ordinary data privacy violations.

In Singapore, there is currently no comprehensive standalone statute specifically governing commercial exploitation of brainwave data. Nevertheless, several existing legal frameworks may apply, particularly:

Personal Data Protection Act 2012 (PDPA).

Common-law duties of confidence.

Contract law.

Negligence and professional liability.

Consumer Protection (Fair Trading) Act 2003.

Medical confidentiality and healthcare regulation.

Intellectual property and database-related rights.

Constitutional and public-law principles where government action is involved.

Central legal issue: Whether an organisation can lawfully convert brainwave information collected for healthcare, research, education or personal use into a commercially valuable asset without obtaining sufficiently informed consent, protecting confidentiality and preventing foreseeable harm.

2. Legal Nature of Brainwave Data

Brainwave data may have several overlapping legal classifications.

A. Personal data

Under the PDPA, information about an identifiable individual can constitute personal data, whether accurate or not.

For example, an EEG recording linked to a patient's identity, account, device identifier or identifiable profile may qualify as personal data.

The fact that the information is generated by a machine rather than directly supplied by an individual does not automatically remove it from the PDPA.

B. Sensitive personal information

Singapore's PDPA does not establish a separate comprehensive statutory category of sensitive personal data equivalent to the GDPR's special-category regime.

Nevertheless, neurological information may carry particularly serious privacy implications. Its sensitivity is relevant when assessing consent, reasonable purposes, security arrangements and the potential harm arising from unauthorised disclosure.

C. Confidential information

Brainwave data obtained during medical treatment, neurological testing or confidential research may also attract duties of confidence.

Commercial licensing or disclosure without proper authorisation may constitute a breach of confidence, depending on the circumstances.

D. Commercial information

Companies may develop valuable algorithms, analytical models, datasets and software using brainwave information.

However, commercial investment in processing technology does not automatically give an organisation ownership of an individual's underlying personal information or unrestricted permission to exploit it.

3. Singapore Legal Framework

A. Personal Data Protection Act 2012

The PDPA is the principal statutory framework governing the collection, use and disclosure of personal data by private organisations in Singapore.

Its major requirements are relevant to brainwave data in the following ways:

Example:

A Singapore neurotechnology company develops an EEG headset marketed as a concentration-improvement device. Users believe their brainwave recordings are being collected exclusively to provide personal feedback.

The company subsequently sells identifiable neurological profiles to advertising agencies.

Potential legal issues include:

Whether the original consent covered commercial advertising.

Whether the new purpose was properly notified.

Whether the use was reasonable and legally permitted.

Whether the company breached its security obligations.

Whether individuals suffered compensable loss or damage.

The organisation cannot automatically justify commercial exploitation merely because the user agreed to the initial collection of brainwave information.

B. Contract Act and contractual liability

The contractual relationship between individuals and neurotechnology companies may create enforceable obligations concerning:

Permitted purposes of data processing.

Confidentiality.

Data ownership and licensing.

Restrictions on onward disclosure.

Commercialisation of analytical outputs.

Data retention and deletion.

Security obligations.

Compensation for contractual breaches.

A company may be liable for breach of contract if it uses brainwave data contrary to an express contractual restriction.

For instance, a research participant may agree to provide EEG recordings for a university study. If the research institution subsequently licenses identifiable recordings to a private advertising company contrary to the agreed terms, contractual liability may arise.

C. Law of confidence

Singapore's equitable law of confidence is particularly important.

Brainwave data collected during medical consultations, neurological examinations, confidential experiments or private research may possess the necessary quality of confidence.

The claimant generally needs to establish that:

The information possesses the necessary quality of confidence.

It was communicated in circumstances importing an obligation of confidence, or was accessed or acquired without the claimant's knowledge or consent.

Depending on the interest protected, the relevant requirements concerning wrongful gain or wrongful loss are satisfied.

The Court of Appeal's decision in I-Admin (Singapore) Pte Ltd v Hong Ying Ting [2020] SGCA 32 is especially significant.

Its modified approach recognises both the wrongful gain interest and wrongful loss interest. This is important because confidentiality may be compromised even before an organisation makes a profit from exploiting the information.

D. Negligence and civil liability

A neurotechnology company may potentially be liable in negligence where:

It owes an individual a duty of care.

It breaches the applicable standard of care.

The breach causes legally recognised damage.

The damage is not too remote.

Possible negligent conduct includes:

Inadequate cybersecurity.

Failure to secure connected EEG devices.

Inaccurate neurological predictions.

Failure to implement reasonable access controls.

Negligent disclosure of neurological profiles.

Failure to warn about foreseeable risks of commercial data processing.

The existence of a duty of care must be established on the facts; it does not arise automatically whenever a company processes brainwave data.

E. Consumer Protection (Fair Trading) Act 2003

The Act may apply where a neurotechnology business engages in unfair practices.

Examples include:

Misrepresenting the purpose of brainwave collection.

Advertising that data will never be sold when it is commercially licensed.

Concealing subscription-based data exploitation.

Misrepresenting the accuracy of neurological predictions.

Making misleading claims about the anonymity of EEG datasets.

Affected consumers may have statutory remedies where the applicable requirements are fulfilled.

F. Medical confidentiality and professional obligations

Where brainwave data is generated during healthcare services, professional confidentiality obligations become particularly important.

Medical professionals must respect the confidentiality of patient information, subject to recognised legal and professional exceptions.

A healthcare institution cannot assume that consent to neurological treatment automatically authorises unrelated commercial licensing.

4. Detailed Case Laws

Important distinction: Singapore has not yet developed a substantial body of reported decisions specifically addressing commercial exploitation of brainwave data or neural recordings. The following are actual Singapore decisions addressing analogous principles of confidentiality, medical information, personal data, unauthorised access and commercial exploitation. Their application to neurotechnology is analytical rather than a claim that the courts have already decided a brainwave-data dispute.

Case 1. I-Admin (Singapore) Pte Ltd v Hong Ying Ting and others [2020] SGCA 32

Court: Singapore Court of Appeal.

Facts:

The dispute involved former employees who had accessed and retained confidential business information belonging to their former employer.

The information included commercially valuable materials and client-related data.

Legal issue:

Whether possession and unauthorised acquisition of confidential information could constitute a breach of confidence even without proof of conventional commercial exploitation.

Judgment:

The Court of Appeal adopted a modified approach to breach of confidence.

It recognised two interests:

Wrongful gain: preventing another party from obtaining an improper benefit through confidential information.

Wrongful loss: preventing the loss of confidentiality itself.

Once the relevant confidentiality and circumstances of confidence are established, an action protecting the wrongful loss interest is presumed, subject to the defendant demonstrating that its conscience was unaffected.

Application to brainwave data:

Suppose a neurotechnology company's employee downloads thousands of identifiable EEG recordings without authorisation and transfers them to a commercial AI developer.

Even if the developer has not yet sold or monetised the recordings, the unauthorised acquisition may support a breach-of-confidence claim.

Legal significance: This is one of the most important Singapore precedents for protecting confidential neurological information.

Case 2. Adinop Co Ltd v Rovithai Ltd and another [2019] SGCA 67

Court: Singapore Court of Appeal.

Facts:

The case concerned confidential commercial information shared between business partners under a commercial relationship.

The dispute involved customer information and the permitted purposes for which that information could be used.

Legal issue:

Whether information provided for a defined commercial relationship could subsequently be used for an unauthorised collateral purpose.

Judgment:

The Court considered the obligations arising from the parties' confidentiality arrangements and the circumstances in which information had been shared.

It recognised that equity can impose obligations of confidence when information is received in circumstances importing confidentiality.

Application to brainwave data:

A neurotechnology research institution may provide a pharmaceutical company with neurological datasets for a specific clinical research project.

If the pharmaceutical company subsequently uses the information to construct commercial consumer profiles outside the authorised purpose, a breach-of-confidence claim may arise.

Legal significance: The decision demonstrates that receiving confidential information for one legitimate commercial purpose does not automatically authorise every subsequent use.

Case 3. Mykytowych, Pamela Jane v V I P Hotel [2016] SGCA 44

Court: Singapore Court of Appeal.

Facts:

The proceedings involved the proposed use of a confidential medical report in litigation.

The dispute raised questions concerning the protection of medical information and the court's equitable jurisdiction.

Legal issue:

Whether confidential medical information could be protected against unauthorised use in legal proceedings.

Judgment:

The Court recognised sufficient grounds to restrain the use of a medical report that was confidential in nature.

Application to brainwave data:

A neurological testing organisation may possess EEG reports containing information about a patient's cognitive and neurological functioning.

If such information is subsequently used in commercial profiling, advertising or another unauthorised context, the decision supports the argument that medical information may warrant equitable protection.

Legal significance: Medical confidentiality is not restricted to conventional written medical records. The underlying principles may also apply to neurological recordings and reports.

Case 4. Soo See Toh v Singapore Medical Council [2019] SGHC 250

Court: Singapore High Court.

Facts:

The case involved a medical practitioner who disclosed confidential medical information after responding to a caller claiming to be a patient's husband.

The doctor issued a memorandum containing confidential information without adequately verifying the caller's identity and protecting the information against unauthorised access.

Legal issue:

Whether a medical practitioner had failed to comply with professional obligations concerning patient confidentiality.

Judgment:

The proceedings examined the doctor's obligations under the applicable Singapore Medical Council ethical requirements.

The judgment discussed the circumstances in which medical information could be disclosed without patient consent, including situations involving legal requirements and protection against harm.

Application to brainwave data:

A hospital collecting brainwave recordings should verify the identity and authority of parties requesting access.

A technology vendor should not receive unrestricted access to patient EEG information merely because it supplies software or technical services to the hospital.

Legal significance: The case demonstrates the importance of access controls, verification and professional confidentiality in healthcare-related information processing.

Case 5. Clearlab SG Pte Ltd v Ting Chong Chai [2015] SGHC 265

Court: Singapore High Court.

Facts:

The dispute involved confidential commercial information and the alleged misuse of information obtained through business and employment relationships.

Legal issue:

Whether confidential information could be protected against unauthorised acquisition and exploitation.

Judgment:

The High Court considered the nature of the information, the circumstances in which it was obtained and the obligations arising from confidentiality.

The decision is also relevant to the development of the broader Singapore approach later considered by the Court of Appeal in I-Admin.

Application to brainwave data:

A company that obtains proprietary neurological datasets through a commercial partnership cannot necessarily use those datasets for unrelated product development.

For example, an EEG software developer receiving confidential patient recordings to improve diagnostic accuracy may face liability if it exploits those recordings for an unrelated commercial profiling business.

Legal significance: The decision assists in understanding the protection of confidential information in commercial and employment relationships.

Case 6. PH Hydraulics & Engineering Pte Ltd v Intrepid Offshore Construction Pte Ltd [2012] 4 SLR 36

Court: Singapore Court of Appeal.

Facts:

The dispute concerned commercial and technical information exchanged in a business relationship.

The Court considered the requirements for establishing an equitable obligation of confidence.

Legal issue:

What circumstances create an enforceable obligation to protect confidential information?

Judgment:

The Court considered the established principles governing breach of confidence, including the nature of the information, the circumstances of communication and unauthorised use.

Application to brainwave data:

A BCI manufacturer may receive neurological datasets from a research institution under a confidentiality agreement.

If it uses the information beyond the permitted project, the institution may pursue contractual and equitable remedies, depending on the terms and circumstances.

Legal significance: The decision provides a foundation for enforcing confidentiality arrangements governing commercially valuable technical information.

Case 7. Priscilla Lim Suk Ling and another v Amber Compounding Pharmacy Pte Ltd and another [2024] SGCA 16

Court: Singapore Court of Appeal.

Facts:

The dispute concerned alleged misuse of confidential information and the scope of protection under the law of confidence.

Legal issue:

How should courts determine whether particular information possesses the necessary quality of confidence?

Judgment:

The Court emphasised that breach-of-confidence claims require a fact-sensitive assessment of the specific information involved.

The modified approach in I-Admin does not eliminate the requirement to identify information that genuinely possesses the necessary quality of confidence.

Application to brainwave data:

Not every EEG measurement will automatically be confidential.

A court would need to examine the nature of the data, its identifiability, the circumstances of collection, its sensitivity and the obligations surrounding its disclosure.

A raw neurological dataset, a detailed cognitive profile and a publicly available scientific finding may receive different treatment.

Legal significance: This decision is important in determining the boundaries of confidentiality protection for different forms of neurological information.

Case 8. Tan Tung Wee Eddie v Singapore Health Services Pte Ltd [2025] SGHC 10

Court: Singapore High Court.

Facts:

The dispute involved a healthcare employee's access to medical records of patients who were not under his care.

The case examined whether the employee had justification for accessing those records and whether patient confidentiality had been respected.

Legal issue:

Whether healthcare personnel may access patient information without appropriate authorisation or justification.

Judgment:

The High Court rejected the claimant's justification for accessing the records of patients outside his care.

The judgment emphasised the importance of patient confidentiality and the limits of access to medical information.

Application to brainwave data:

A hospital employee, AI engineer or external contractor should not access identifiable EEG recordings simply because the technical system makes them available.

Access must be justified by the individual's responsibilities and the applicable legal permissions.

Legal significance: The decision is relevant to internal access governance and the protection of neurological information held by healthcare institutions.

5. Major Forms of Commercial Exploitation and Potential Liability

A. Sale of brainwave datasets

A company may sell EEG recordings to pharmaceutical companies, AI developers or advertising businesses.

Potential liability arises where:

Consent does not cover the commercial disclosure.

The original collection purpose does not justify the new use.

Confidentiality obligations are violated.

The organisation fails to implement adequate security.

The information is re-identifiable despite purported anonymisation.

Example: A company sells identifiable brainwave recordings collected from students to an educational analytics provider without an appropriate legal basis.

B. AI-based neurological profiling

AI systems can analyse brainwave patterns to infer attention, emotional responses, cognitive performance and behavioural tendencies.

Potential civil claims may arise from:

Inaccurate neurological predictions.

Misleading representations about predictive accuracy.

Unauthorised processing of identifiable information.

Discriminatory or harmful commercial decisions.

Negligent design or deployment.

For example, an employer may use EEG-based productivity assessments to rank employees and determine promotions. If the system produces materially misleading assessments, contractual, consumer or negligence issues may arise depending on the circumstances.

C. Brainwave-based targeted advertising

Commercial companies may analyse neurological responses to advertisements to identify consumer preferences.

This creates several issues:

Whether consumers understood that their neurological responses were being analysed.

Whether the processing purpose was properly notified.

Whether the information was disclosed to advertising partners lawfully.

Whether the advertising claims were misleading.

Whether sensitive inferences were used to manipulate consumer decisions.

D. Commercialisation of medical research

Universities and hospitals may collaborate with pharmaceutical and neurotechnology businesses.

Commercialisation can include:

Licensing research datasets.

Developing diagnostic algorithms.

Selling access to analytical platforms.

Developing neurological prediction products.

Licensing machine-learning models trained on patient data.

Research consent must be distinguished from commercial exploitation consent. Whether further consent is required depends on the original permissions, applicable PDPA provisions, research-related exceptions and other legal obligations.

E. Workplace brainwave surveillance

Employers may introduce brainwave monitoring for safety, concentration or productivity assessment.

Potential legal problems include:

Excessive collection.

Lack of transparency.

Unauthorised sharing with recruitment agencies.

Inaccurate performance evaluation.

Unfair contractual practices.

Negligent handling of neurological information.

The fact that an employee uses employer-provided equipment does not automatically give the employer unrestricted rights over the employee's brainwave information.

6. Civil Remedies Available in Singapore

Individuals and organisations may have different remedies depending on the legal basis of their claims.

A. Injunctions

An individual may seek an injunction to prevent continuing unauthorised disclosure or commercial exploitation.

For example, a court may be asked to restrain a company from distributing confidential EEG recordings while a dispute is being determined.

B. Damages

Compensation may be available for legally recognised loss caused by the defendant's conduct.

Potential losses may include:

Financial loss.

Commercial licensing losses.

Consequential losses.

Other legally recoverable damage.

However, a privacy violation does not automatically establish entitlement to damages under every available cause of action.

C. Account of profits

Where the requirements of an equitable claim are satisfied, an account of profits may be considered.

For instance, if a company improperly exploits confidential neurological datasets to generate commercial revenue, an account of profits may be relevant.

D. Deletion and delivery up

A court may grant appropriate orders requiring the delivery up or destruction of unauthorised copies of confidential information.

Such relief may be particularly important where neurological recordings have been distributed across multiple commercial platforms.

7. Cross-Border Commercial Exploitation

Brainwave data frequently moves across international boundaries.

A Singapore company might collect EEG recordings locally but transfer them to:

AI processing centres in the United States.

Pharmaceutical research facilities in Europe.

Cloud storage providers in Japan.

Neurotechnology developers in China.

Advertising analytics companies in other Asian jurisdictions.

Section 26 of the PDPA is relevant to overseas transfers.

Organisations must ensure that applicable transfer requirements are satisfied, including the requirement for comparable protection under the statutory framework.

Cross-border exploitation may also create questions involving:

Applicable law.

Contractual jurisdiction.

International enforcement of judgments.

Confidentiality obligations.

Overseas data processors.

Conflicting regulatory requirements.

A contractual choice-of-law clause cannot necessarily eliminate Singapore statutory obligations.

8. Important Legal Challenges

9. Hypothetical Singapore Case Study

Facts:

NeuroSense Pte Ltd operates a Singapore-based brain-computer interface platform.

Its users wear EEG headsets for concentration training. During registration, users agree to provide neurological information for personalised training recommendations.

The company subsequently:

Collects identifiable EEG recordings.

Develops AI-based cognitive profiles.

Licenses those profiles to advertising companies.

Shares neurological predictions with recruitment businesses.

Transfers datasets to an overseas AI research partner.

Several users discover that their neurological information has been used for purposes they did not expect.

Legal analysis:

Issue 1: Unauthorised commercial use

The company must establish whether its commercial processing is supported by valid consent or another applicable legal basis under the PDPA.

Issue 2: Breach of confidence

If the recordings were received in circumstances importing confidentiality, unauthorised acquisition or exploitation may support a claim under the principles in I-Admin and Adinop.

Issue 3: Misrepresentation

If the company expressly promised that recordings would only be used for personal concentration training, contrary commercial representations may create contractual and consumer protection issues.

Issue 4: Negligence

If the company fails to implement reasonable security arrangements and this causes foreseeable and legally recoverable harm, negligence may be relevant.

Issue 5: Overseas data transfers

The company must satisfy the applicable requirements of section 26 of the PDPA when transferring personal data overseas.

Issue 6: Remedies

Affected users may seek appropriate injunctions, contractual relief, equitable remedies or statutory remedies where the relevant legal requirements are satisfied.

Conclusion: NeuroSense cannot treat its technical ability to collect and analyse brainwave data as an unrestricted legal entitlement to commercialise that information.

10. Proposed Regulatory and Corporate Governance Framework

Singapore could strengthen protection of brainwave data through a dedicated neurotechnology governance framework.

The following measures would be useful.

1. Specific consent requirements

Separate consent should be considered for healthcare, scientific research, AI training, advertising and third-party commercial licensing.

2. Neurodata classification

Neurological recordings and sensitive neurological inferences should receive enhanced safeguards proportionate to their potential impact.

3. Commercial licensing controls

Contracts should clearly specify:

Permitted uses.

Prohibited uses.

Commercial licensing rights.

Third-party access.

Retention periods.

Deletion obligations.

Audit rights.

4. AI transparency

Companies should explain the principal purposes and significant limitations of neurological prediction systems.

5. Independent auditing

High-risk neurotechnology systems should undergo appropriate privacy, cybersecurity and algorithmic assessments.

6. Stronger research safeguards

Research institutions should distinguish scientific research consent from subsequent commercial exploitation.

7. Individual control

Individuals should have appropriate mechanisms to exercise their rights under applicable data protection law and to challenge unauthorised uses.

11. Conclusion

Civil liability for brainwave data commercial exploitation in Singapore is principally governed by existing privacy, contractual, equitable, negligence and consumer protection principles rather than a dedicated neurodata statute.

The eight decisions discussed provide a useful legal foundation:

I-Admin establishes the modern approach to breach of confidence.

Adinop addresses misuse of information supplied for a defined purpose.

Mykytowych demonstrates the protection available for confidential medical information.

Soo See Toh highlights professional medical confidentiality.

Clearlab addresses commercial confidentiality.

PH Hydraulics explains the foundations of equitable confidentiality.

Priscilla Lim clarifies the boundaries of confidential information.

Tan Tung Wee Eddie reinforces restrictions on unauthorised access to medical records.

The central principle is that commercial value does not automatically create ownership, unrestricted access or an unrestricted right to exploit another person's brainwave information.

Singapore's existing legal framework provides several avenues for protecting neurological information, although specific statutory recognition of neural privacy, cognitive liberty and brainwave-data commercialisation would provide greater legal certainty.

Exam-oriented observation: Brainwave data should be treated as a particularly sensitive form of personal and potentially confidential information. Its commercial exploitation should be assessed through the combined principles of informed consent, purpose limitation, confidentiality, accountability and prevention of foreseeable harm.