Risk-calibrated sharing of human brain data

Investigators collecting human brain data are under growing pressure to share data widely to accelerate scientific discovery and improve outcomes in neurological and psychiatric disorders, while at the same time facing increasing concerns about potential misuse of brain data and threats to mental privacy. Several commentators have therefore called for clearer ethical guidance on brain data sharing. This article reviews the bioethics and neuroscience literature on the risks of sharing individual-level human brain data and adds to it using insights from a National Institutes of Health (NIH) workshop and normative analysis. The substantial burden of brain disorders creates a strong ethical imperative to share data. We argue that the risks of sharing brain data are not uniform and depend on both the likelihood of re-identification and the range of inferences that can realistically be drawn from the data given scientific capabilities. Certain types of brain data are more likely to be re-identifiable and to enable sensitive inferences-such as those related to current and future health, behaviour, or identity-relevant traits-and thus could be misused to harm individuals or communities. In these cases, brain data may pose greater risks than many, though not all, other forms of biomedical data. At the same time, strategies to mitigate these risks-such as restricting access or reducing data granularity-may limit the scientific value of shared data. We argue that responsible brain data sharing requires calibrating protections to the specific risks associated with sharing a dataset, enabling data sharing that maximizes scientific and clinical value while protecting participants and maintaining trust. To support this, we propose categories of lower-, medium-, and higher-risk data based on inferential sensitivity and the likelihood of re-identification or linkage to harm-relevant groups. We suggest safeguards to consider across these risk levels, including data collection and sharing practices that limit access to data, informed consent approaches, and data-use governance.