The Metaverse and the processing of sensitive personal data

The Metaverse, a term coined in 1992 by Neal Stephenson in the science fiction novel Snow Crash, has come into the spotlight in recent months, although it is not a new phenomenon.  The first experiences with the Metaverse occurred at the beginning of the 2000s in the videogames sector (e.g. Second Life, Roblox and Fortnite) and recently Microsoft announced a mixed reality platform that will allow users to interact and develop collaborative content remotely.

By its very nature, the Metaverse involves personal data processing. Virtual reality glasses, equipped with earphones, sensors, and microphones, may allow biometric data (such as facial expressions, eye movements, body language, voices, real time vital signs, and brain activity patterns) to be collected from which individuals' characteristics can be inferred.

Certainly, the Metaverse will revolutionize the relationship between businesses and people, giving businesses a much better understanding of their customers so that they can meet their needs in an exceptionally personalized, directed way.

In this scenario, one of the main concerns related to the Metaverse is data protection, given the quantity and type of data that can be collected. The concern arises when the personal data collected in the Metaverse falls into the category of sensitive personal data as defined in article 5(II) of the Brazilian General Data Protection Law ("LGPD" – Lei Geral de Proteção de Dados Pessoais), since sensitive personal data processing is subject to specific conditions, in light of its discriminatory potential.

According to article 11 of the LGPD, sensitive personal data may only be processed in eight different situations, which include protecting life or physical integrity of the data subject or third parties, and preventing fraud and ensuring the data subject's security in processes for identification and authentication on registration in electronic systems. This means, for example, that biometric data could be processed to verify the identity of users in the Metaverse, as long as the LGPD's principles are respected. Marketing activity, however, is not one of the cases in which the law allows the processing of sensitive personal data.

The main legal bases for processing personal data for marketing purposes are consent and legitimate interest. Legitimate interest, however, is not a legal basis for processing sensitive personal data. How can freely-given, express, specific consent to the processing of their sensitive personal data for marketing purposes be obtained from users in the Metaverse?

The validity of providing users with a consent form that describes what personal data will be processed and the purposes of that processing, so that they consent to various processing activities at the same time, is questionable, since consent must be granular, so that users can choose for which purposes their personal data may be processed.

Aside from the challenges associated with the legal bases for personal data processing in the Metaverse, another concern relates to the principle of necessity. Collection of certain personal data, including sensitive data, seems to be inherent in enabling users to enjoy the complete experience of the Metaverse, which promises to be a hyper-realistic reproduction of the real world. Metaverse developers will have to study how to limit the use and sharing of data for the most varied of purposes, to ensure that excesses in data processing do not occur.

Contrary to what many people once believed, the Metaverse is not another dystopia but a reality that will generate innumerable opportunities and new business models. What remains to be seen is how the law will adapt to this new reality, and how organizations will overcome the enormous challenges posed by the very nature of the Metaverse.