Data PrivacyThe Interplay between Data Privacy and Metaverse

INTRODUCTION

With the evolution of the Internet, cyberspace has also evolved, and we can expect it to continue growing and transform our lives to a great extent in the near future. With the changes in several virtual environments, such as augmented reality, social networks, or virtual worlds, technological advancements are at new heights.  One such advancement is the evolution of metaverse.

The metaverse may be viewed as a“digital universe” where users interact, play, socialize, create, explore, and engage with each other, through their digital avatars. By utilising technologies like augmented reality (hereinafter referred to as “AR”), virtual reality (hereinafter referred to as “VR”), blockchain, and more, real-world activities can be performed in the metaverse.

Despite its clear benefits, the metaverse is likely to face privacy-related bottlenecks. These complicated privacy concerns include regulating data generated by avatars, identity theft, data transit, and more. The massive volume of user-provided personal data collection is one of the primary facets of the metaverse that raises major privacy issues.

Metaverse and the technologies associated therein, may follow and keep a track of people much more closely than the traditional social engagement platforms. In the metaverse, it is possible to track physiological responses, biometric data like facial expressions, vocal inflections, and vital signs in real-time.

Further, such data may fall under the category of “sensitive” information that calls for rigorous restrictions since, if left unprotected, it may violate privacy through social engineering or other cyberattacks. Additionally, unlicensed groups or intermediaries may abuse it to promote their businesses such as health or insurance policies, through untargeted advertising. Therefore, despite the technology’s promise, metaverse poses serious privacy risks, unless appropriate policies on data consent, collecting, and transfer are developed.

METAVERSE – NOT SO PRIVATE?

The metaverse has evolved from a concept to a looming reality. An idea that debuted on a science fictions is already on the verge of revolutionising how businesses, organisations, and the Internet run. While the idea of the metaverse has been met with enthusiasm by tech and marketing giants, it has become a cause for concern for privacy experts.

Metaverse is set to function through next-gen technologies like virtual reality, augmented reality, machine learning, and Artificial Intelligence (hereinafter referred to as “AI”). These behavioural-learning technologies often collect massive amounts of data based on user personal information, threatening privacy. Therefore, using such technologies within the metaverse can become a significant danger to data privacy.

Here are a few ways the metaverse may affect how users’ data is protected:

• Phishing attacks: Cyberattacks, particularly harmful ones like phishing-as-a-service, can be created specifically to steal user information. In phishing attacks, the hackers usually send messages or communications as trusted persons and thereafter attack the system once the recipient opens such messages or communications.
• Targeted device attacks: Targeted devices such as vulnerable AR/VR devices might open the door for malware incursions and data breaches.
• Absence of paperwork in the metaverse: The lack of paperwork and legal instruments in the metaverse make it easier for the hackers to penetrate into the systems. Hackers can employ virtual avatars that operate through virtual identities to easily launch targeted assaults to steal user information.
• Unauthorized data collection: Advertisers are easily able to gather user information merely by seeing how users interact with other avatars and by gathering personal information. As the metaverse develops to resemble reality, it is likely to gather a wealth of personal data, including preferences, health information, biometric data, brainwaves, and more.

REGULATING METAVERSE

The metaverse will connect the person to their “avatar” (or other digital representations). Therefore, regulators around the world would likely consider information collected about a metaverse user’s activities to be personal data, subject to existing privacy and data protection laws.

Regulation of a digital interaction may involve the engagement of privacy rules in some countries based on physical location of the organization or the individual; the type of organization or individual; the type of data collected; and the purpose for collecting the data.

However, it is unclear how organizations could navigate legal compliance in a persistent, live, synchronous, interoperable digital environment. Organizations operating under the umbrella of the privacy rules of the European Union’s General Data Protection Regulation (hereinafter referred to as “GDPR”) may fare better here, but this raises another issue –privacy rules of which country apply in the metaverse?

Further, who will be held responsible for privacy in the metaverse? We don’t know what or who will own or control some or all of it. Possibly, it will operate with single-organization ecosystems (similar to today’s social media platforms), centrally operated platforms hosting different organizations offering their goods and services, but alternatively, it will be characterized by interacting access points and multiple controllers.

CHALLENGES AND WAY FORWARD

With the advancement of technology, the discussion around protection and safety of data has arisen to alarm the world. Sensitive personal data of users is at the risk of exploitation and misuse and thus, Governments across the globe are advocating for protection of user data.

Although at the present, the GDPR is the only regulation that governs data protection extensively,  it needs to be modified or a fresh, comprehensive and uniform regulation should be tabled in order to successfully govern the metaverse. To enable users to conduct transactions securely, there needs to be greater accountability for metaverse owners and third-party service providers like crypto platforms.

Technologies like “Confidential Computing”, which allow for the protection of data in transit, may be used for cross-border data security. Furthermore, practices like data privacy impact evaluations and transfer risk assessments could be helpful in reducing data privacy risks.

From the standpoint of contractual due diligence, there needs to be clear and recorded clauses between stakeholders. Well-drafted and explicit anti-money laundering clauses must be included in contracts between the metaverse developers and virtual asset service providers, so that parties will cooperate with the regulatory bodies in the case of a data breach. Similar to this, because blockchain does not permit data deletion, information on NFT transactions may end up being preserved permanently.

After transacting with virtual assets, users may not be able to use their “right to be forgotten”. Through a combination of technical and legal solutions including privacy-by-design, architectural security, and permission, advertisements in the metaverse must be rigorously managed. It should be forbidden to exploit personal information for invasive advertising.

If a customer engages with a brand through an avatar, the Personal Identifiable Information (hereinafter referred to as “PII”) gathered cannot be used to identify the actual customer for the purpose of making a physical sale without that customer’s express permission. Blockchain might demand superior designs in the metaverse. Despite the fact that smart contracts support both secured and permission-less transactions, more regulations regarding parental approval may still be necessary.

A distinct plan is also required for the protection of data related to virtual assets and cryptocurrencies. Each participant is required to confirm that user PII has not been hacked.

However, usage of cryptocurrencies in the metaverse could lead to a problematic scenario. Thus, in order to address it, metaverse developers must actively work with Governments and other international organisations to design globally accepted standards and make them legally binding in order to reduce any hazards. Despite the decentralisation and pseudonymity that blockchain technology offers, problems could arise if data is shared with investigating authorities.

Last but not the least, managing real-time data will require careful technical and legal consideration. While real-time data anonymization may be accomplished via AI and confidential computing techniques, regulatory scrutiny may be achieved through carefully crafted legal and privacy frameworks. After taking into account the interests and concerns of users and stakeholders, such approaches may include identifying the privacy fundamentals in the early stages of design and development.

AMLEGALS REMARKS

A new era of innovation has begun with the advent of Web 3.0. The numerous capabilities of organisations, including social networking and automation, have been quickly made public. The metaverse, an immersive cyberspace that offers real-time virtual experiences of social exchanges via interoperable platforms, is the next development in the Internet transformation.

The metaverse is quickly becoming a privacy nightmare for many stakeholders, including metaverse platform developers, hardware, software, crypto service providers, regulatory authorities, and end users themselves, despite its potential.

In the beginning, privacy should be handled with the utmost prudence. It is pivotal to understand why privacy is crucial in the metaverse, the difficulties associated with potential metaverse technologies, data that may be collected from sources, laws or regulations that are likely to address these issues, and best practises that businesses should adhere to in order to minimise privacy risks.

– Team AMLEGALS assisted by Mr. Rishav Kumar (Intern)