1. Good morning and thank you for inviting me to open The Metaverse Conference. This is a realm of growing importance in our digital economy. I wish to take this opportunity to share an analytical frame on emerging personal data protection and related issues in the metaverse, to provoke thoughts and foment discussion.

From Fiction to Fact: The Rise of the Metaverse

2. From a technical perspective, the emergence of the metaverse is not new. The metaverse leverages on underlying technologies such as virtual reality (VR), augmented reality (AR), and mixed reality (MR) (collectively called “XR”) technologies that have been in the market since the 1990s but that have struggled to achieve mass adoption mainly due to high costs. However, Facebook’s rebranding into Meta in 2021, and similar Big Tech companies announcing their strategies to gain a competitive edge in the metaverse, have recently thrust the concept into the limelight and helped it gain momentum.

3. Today, the metaverse is a fast-growing space with huge potential. Bloomberg estimates the market will reach $800 billion by 2024, up from $500 billion in 2020 at a CAGR of 13.1%.¹ Despite its rapid growth accelerated by the pandemic, there is no universal definition of the metaverse yet. While efforts have been made by industry leaders, academia, governments, and international bodies² to clarify and define the metaverse, the ever-evolving landscape will entail changing definitions and perspectives.

What is the Metaverse?

4. Nonetheless, a common understanding of the metaverse among academic and industry leaders refer to it as a connected life where the physical and virtual worlds converge.³ It is the convergence of different online and offline services into a seamless interoperable and shared experience.⁴ There appear to be a few defining characteristics that distinguish metaverses from the underlying technologies.⁵ I will highlight 3 such characteristics.

5. A metaverse must have persistence — it should exist and continue to be accessible independently from individuals’ activities. Even after our avatars leave, the metaverse should remain accessible for the other participants, where they can continue interacting and making things happen. This is why having a VR video call with an immersive meeting room experience and photo realistic avatars of fellow participants is not a metaverse. Once the video call concludes, the meeting room ceases to exist. But if we have a digital twin of an office building, it is possible that we can have persistent meeting rooms where our avatars can meet.

6. A metaverse must be synchronous – it should allow for common, shared experiences that occur in real-time.

7. A metaverse must be immersive — it should replicate a “hyper-real”, virtual environment that allows us to enter, and interact with others. Of course, this is dependent on the state of technology.

What the Metaverse is Not

8. With these features, we can safely exclude some concepts that often get rolled up into discussions about metaverses.

9. For example, while NFTs often have a role to play, and have the potential to link real world and metaverse interactions, the presence of NFTs in an environment does not mean that that environment is a metaverse. Thus, an NFT marketplace, such as OpenSea, is not a metaverse.

10. Similarly, XR technologies are important technologies at the presentation layer that will enable more immersive interactions in the metaverse. But again, these technologies can be used independently of metaverses. For example, they are used in many training simulations in high-risk industries such as medicine,⁶ construction, and fire safety.⁷

11. The maturity of XR technologies, along with rapid developments in network and compute technologies, experiential products and services, and virtual worlds, will fuel the next stage of developments in the metaverse. Just like the evolution of the internet, the rise of the metaverse will revolutionise the way we live, work, and play when blended with the right technology, business strategy, and governance principles.

Data Protection in the Metaverse: 3 Archetypes and 3 Topics to Consider

12. Now that we have a common understanding of what a metaverse is, I wish to propose for your consideration a tentative analytical frame for examining some of the emerging and evolving issues. I would like to emphasize that this frame should not be seen as PDPC’s policy position on these issues. What I hope this frame will achieve is to help us distil the issues clearly and provoke us to think about them differently — hopefully — and ultimately encourage discussion and debate at today’s conference.

13. Moving on to the frame proper, I first wish to propose 3 different archetypes of metaverses. Next, I wish to examine the following 3 issues: (a) digital identity (how you participate); (b) digital things (what you own) and; (c) activity data.

14. We can identify 3 archetypes of a metaverse today. First, the enterprise archetype, where the metaverse seeks to replicate the real world. The use cases are largely to support business activities. For example, the UAE's Ministry of Health and Prevention (MOHAP) has launched the world’s first Metaverse Customer Happiness Centre where customers can make enquiries, request services, and settle administrative tasks in a 3D digital space. Or, like in the case of Accenture, creating digital twins of its offices to onboard new staff members, conduct training activities and host corporate events.

15. The second archetype is the immersive environments like Decentraland and (from a few years ago) Second Life. These environments allow us to interact with others but there is no intention to replicate the real world. In fact, the point is not to be confined by laws of physics and nature. Here, our avatar can have wings and we can be a landlord of virtual real estate.

16. The third archetype is the gaming environments that we already see today. Some may question if this is a metaverse, or whether they should be folded into the second archetype. However, I put this forward as a third archetype for the purpose of provoking discussions as it allows us to identify some of the upcoming issues around interoperability in a more defined context.

17. Underlying the different use cases are 3 key topics that may determine the level of protection needed on our personal data and other things we might own in the metaverse. I will now delve into each of the topics around digital identity, digital things and activity data using these 3 archetypes to help us tease out the issues.

Topic 1: Digital Identities & Digital Personas – should Intentions determine Rights?

18. As we move into the metaverse and take on more digital personas, the pertinent issue of digital identity in the metaverse has led many to ask - who do we want to be? Depending on the different metaverse archetypes, our intentions may differ. Leaving aside discussions about impersonation, the key question is whether we intend to be ourselves, or intend to be an alter ego.

19. My working hypothesis is that in enterprise types of environments, we usually intend for our digital personas to mirror our real-world identities (i.e. be our actual selves) to facilitate and achieve authentic connections at the workplace. We will want our avatar to be a close approximation, if not a photo realistic version of us. In this case, our avatar is probably some sort of 3D photo or video of us, which we can control. Should it therefore follow then that protection of avatars in such circumstances should be akin to protection of personal data? If so, then existing rules on personal data, such as the PDPA, and identity rights, should apply.

20. In immersive environments, the situation is different. We may not want to be constrained by the laws of physics or nature, but rather to be able to maximise the tools that the metaverse provides for the creation of our avatar. At the same time, we may wish to retain some link to our real-world identities. This could result in hybrid personas that combine elements of our real-world identities with imagined characteristics. Further, when we replicate our avatar across different immersive metaverses, and build up its personality, reputation, and behavioural characteristics, should the avatars we have invested in building up be viewed as characters that we have created, or as our alter egos?

21. If the former, then we should look to protect these avatars with character rights, such as by using copyright law. But we need to keep in mind that the metaverse provider may, through their terms of use, have a claim to any intellectual property rights we may hope to have! And if our avatar is the latter, then we should be looking at our avatars as something akin to aliases, and possibly personal data.

22. The potential interoperability of metaverses will likely compound these challenges by allowing us to invest in our character or alter ego across different platforms. However, it is still unclear how such interoperability will operate.

23. As for gaming environments, the personas we adopt will usually be completely imaginary. It is not uncommon for gaming platforms’ terms of use to claim intellectual property rights in our gaming characters. There is likely no expectations for identity rights in these environments. It is probably unlikely at this time that a character in a game can appear in another game. Further, the ability to customise your character is also more limited in gaming environments. Issues surrounding character rights will be further pronounced when interoperability does kick in.

Topic 2: Digital Things – Ownership Rights in the Metaverse

24. Let us now look at digital things in metaverses. The rise of the new creator economy and increase in objects and digital assets created in the digital realm have brought about questions of ownership rights across different environments. Issues surrounding ownership are especially important in enabling interoperability and portability of assets between platforms in the metaverse, for which existing rules may fall short. Given the broad scope of this area, I shall focus on issues relating to interactions between the real world and the metaverse.

25. In an enterprise environment, this interaction occurs in how the metaverse is created. Using AutoCAD blueprints as an example, when you take the blueprint files and create a 3D model, this is covered by copyright law as the 3D model is no more than an expression of the 2D blueprint. However, in other instances, mapping data may be used to create the enterprise environment. To do so, video and measurement equipment, such as 3D laser scanners, are used to capture and map the real-world environment and convert it into a 3D environment. In these instances, the level of copyright protection is still unclear. For example, if I were a photographer taking a photo of a landscape, city scape or stills portrait, I know that copyright protects my composition of the photo — the subject I chose, how I framed the shot, and how I made use of lead in lines and the rule of thirds to focus the viewer’s eye. But if we use equipment to take measurements and photographs to recreate the physical environment for our enterprise metaverse, I do query whether we have achieved the requisite level of creativity to warrant copyright protection. The objective is accuracy, not creative flair. How then should we protect ownership of these digital things? Nonetheless, this provides opportunity for innovation and is therefore worth protecting. Digital twins have been used for modelling and simulations to improve predictions and monitoring systems and aid in data-driven decision-makings.

26. In immersive environments, ownership rights of digital things created in the metaverse depend on the terms of use of the respective platforms. While interoperability between platforms is still difficult to implement, immersive environments have proven the convergence of the real and virtual worlds, most notably through fashion. For example, Dolce & Gabbana (D&G) has issued a collection where you can purchase a physical dress along with an NFT. Purchasers can then request for a digital recreation of their dress in one open metaverse of their choice within 2 years of purchase. This means that your avatar can wear the same dress in the immersive metaverse as you do in the real world. In this example, the asset behind the NFT is probably the dress that you bought as opposed to the design that the designer label owns.

27. In the gaming metaverse, ownership of gaming items provides us with an interesting context for discussion of the challenges of interoperability. The technical formats for interoperability is just one set of challenges — and NFTs help us ensure uniqueness of individual items. But as gaming items cross games, we also have to contend with business rules, even after surmounting technical interoperability challenges. Will your level 10 magic sword occupy the same tier in the new gaming environment, and will all its properties be replicated in the new gaming environment? I expect that business rules will be more challenging to resolve than technical interoperability requirements. Nonetheless, that is not to say that these cannot be overcome. Gaming currencies that can be used in different games have overcome such challenges, representing a first step in the path towards interoperability.

Topic 3: Activity Data – Stronger Security needed for Burgeoning Data

28. Technologies fuelling the interactive metaverse rely on huge volumes of data to customise experiences. By participating in the metaverse, data is generated in the form of activity data from both hardware and software devices (e.g., body-based data such as sensors tracking your eye-movements, biometrics). As more time is spent in the metaverse, increasing volumes and variety of data will be generated and tracked at increasing velocity.

29. While new data protection issues are unlikely to arise, the increased scale of data being generated and collected will see an expansion of impact of existing issues. Firstly, data collection and sharing will still require consent and companies will still be able to rely on the relevant exceptions for secondary use of data. Secondly, proper collection, processing and disposal of data is still important. Thirdly, data security and protection requirements will need to strengthen to meet the demands of burgeoning data in the metaverse.

30. Looking at interactions between the real world and the metaverse again, one interesting aspect to dive further into is personalised advertisements. In the present online environment, our behavioural or usage patterns and interactions with websites and apps are used to push more accurate recommendations and advertisements to us. When using the same platform’s app, they can use our profile, match it with geolocation information — all properly covered by consent, of course — to make recommendations based on where we are. Imagine — and this is not to say that it is already happening — how this might be replicated using data from our interactions in the metaverse. I should expect that one day, having visited a designer shop and tried on a trendy pair of sneakers in the metaverse, I might be tempted by their mobile app, when they detect that I am near one of their physical boutiques, with a discount code!

Conclusion

31. I hope that my proposed analytical frame, and the issues that I have identified, will achieve their purpose of provoking our thoughts and spurring discussions for the rest of today. At this early stage of metaverse developments, expert discussions will help policy makers and regulators sharpen our thinking in this area. This helps us make adjustments to our data protection rules to ensure balance between consumer privacy and business innovation.

¹ Bloomberg Intelligence
²The WEF recently launched Defining and Building the Metaverse at the Annual Meeting in Davos 2022, the world’s foremost multistakeholder initiative to develop and share actionable strategies for creating and governing the metaverse.
³ Reed Smith. (2022). Reed Smith Guide to the Metaverse – 2nd edition.
⁴ Accenture. (2022). Going beyond with extended reality.
⁵ Norton Rose Fullbright, (2021). The Metaverse: The evolution of a universal digital platform
⁶ During the pandemic, Stanford University faculty leveraged VR and AR technologies to teach anatomy and emergency preparedness to students at Kenya’s Masinde Muliro University of Science and Technology (MMUST).
⁷ Kurve XR is a VR company that offer training modules to train people in First Aid and Fire Safety.