What will happen if the Metaverse comes to life?

Metaverse talk has seemingly died down when just a few months ago it was a popular topic on the internet. This is no surprise since Mark Zuckerberg – the CEO of Meta Platforms, formerly ‘Facebook’ – has stopped discussing the Metaverse after a period of actively promoting it.

The Metaverse is still, however, relevant as large enterprises are investing in the Metaverse and although it may be a long way before people are heading to their virtual office, as we know these things tend to progress quite quickly, which is what we are seeing elsewhere, with AI for example.

What is the Metaverse?

As a reminder, the Metaverse is a virtual world accessed via a headset, where people can supposedly do most things that can be done in the real world, such as work, socialise, engage in forms of entertainment and meet up for coffee. We previously considered the employment law implications of the Metaverse in our article here.

In this article, we focus on the data protection implications of this virtual world.

Data protection concerns in the Metaverse

New categories of personal data?

The Metaverse will hold a huge amount of personal data, the most obvious being users’ names, interactions and health related information. The platform will therefore hold highly sensitive intelligence on individuals. Worryingly, it is not yet known how well this data will be protected.  For example, companies who transfer personal health information onto the Metaverse workplace  may or may not be subject to safeguarding regulations. 

The avatars and interactions of users, which are said to include ‘facial’ expressions, body movements and voices, are likely a form of personal data which we are not yet familiar with. These avatars are likely to be classified as personal data  in the workplace because employees could become identifiable from characteristics created and the Metaverse owners will know who created each avatar.

On a more alarming level from a data protection perspective, the use of a headset may allow the Metaverse to record and analyse a user’s eye and facial movements, which in turn could lead to identifying several other private traits of an individual. It has been said that the dilation of a person’s pupil can lead to inferences being drawn about a person’s personality and culture.

How will the processing of personal data take place?

In order for the Metaverse to work, it is necessary for there to be a continuous flow of data between individuals and entities alike.

The Metaverse provides a space for buying and selling products. If a purchase is made in the Metaverse and payment is provided, then the seller regardless of identity (business or individual), is likely to hold the buyer’s personal information. This automatically promotes them to become a data controller forcing them to abide by rules relating to the processing of personal data.

Alternatively, as the Metaverse is a new emerging concept, there is yet to be any definite guidance released on which regulations or jurisdictions will apply to the Metaverse. This being a virtual world may mean that a number of different laws and regulations from around the globe can apply. If the UK GDPR and the Data Protection Act 1998 were to regulate the Metaverse, this legislation will likely need to include new sections specifically drafted to apply to the virtual world.

Lack of privacy?

The Metaverse has many data privacy implications that businesses and governments need to consider. These privacy challenges are similar to those arising from social media platforms, however, they differ in extent because users in the Metaverse are able to interact with their (virtual) environment on a much deeper level than on any other current platform. Companies operating in the Metaverse may need a whole new privacy policy in this respect. It is particularly concerning that the regulation of such activity is currently lagging behind such technological advances.

We will continue to monitor any updates relating to the Metaverse.