Transparency, data privacy and the metaverse
One of the central aspects shared by many of the most important laws on data privacy around the world is a concern with the transparency offered to data subjects in connection with personal data processing carried out by data controllers.
Brazil's General Data Protection Law (LGPD – Lei Geral de Proteção de Dados Pessoais) also gives particular attention to transparency, which can be found in article 6 (VI) as one of the Law's guiding principles, and in various other provisions as an express obligation. Under the LGPD, transparency means ensuring that data subjects have clear, accurate and easily accessible information on data processing.
Among the requirements under the LGPD that are directly linked to the principle of transparency, article 9 requires that processing agents provide privacy notices containing specific information regarding the purpose, form and duration of data processing, the data controller's name and contact information, any sharing of data with third parties, and data subjects' rights.
The focus given by the LGPD (and other legislation such as the GDPR) to transparency has one overriding motive: it is only possible to guarantee informational self-determination, enabling data subjects to make choices about processing of their data, if they are aware that their data is being processed, and how that processing is being done. Without transparency, data subjects cannot exercise the rights provided for under article 18 of the Law, such as the right of access. Ensuring effective transparency on data processing, however, is not an easy task. In the Metaverse, the task tends to be even more complex.
Imagine the following scenario: you are walking along a street in the Metaverse lined with various shops. The Metaverse platform you are using necessarily has the means to process a significant amount of your personal data, including information about when you enter a shop, when you look at a shop window, how much time you spend looking at the window, and what accessories your avatar is using and the brand of those accessories, among many other pieces of information.
Similarly, the shops along that street in the Metaverse will be able to process the same data or, at least, to opt to receive the data from the platform or to carry out marketing activities based on data processed by the platform. In this hypothetical scenario, what is the best way to guarantee transparency as to the shops' data protection and privacy practices?
Or the practices of the platform itself? After all, in addition to the data mentioned above, the platform will be able to process absolutely all the personal data that is related to your life in the Metaverse, in all your interactions in that virtual world.
In these circumstances, it is important to assess what is the best strategy for providing clear, accurate and easily accessible information to data subjects in light of the specific context of the Metaverse.
One possibility is to create specific, standardized icons, symbols or signs representing precise information on personal data processing practices by processing agents, which could be put up near the entrance of each shop located in the Metaverse, so that users would be aware, even at a distance, of the details concerning how their personal data is processed by each organization.
Another option to consider is presenting information on data privacy practices on a just-in-time basis, so that details are shown precisely when users have some kind of interaction with each shop, whether by passing close to the shop entrance or looking at its display window. And instead of information supplied all in a single document, a layered notice could be beneficial to users.
Whatever option organizations choose, one thing is certain: long and complicated privacy notices should definitely be avoided in the Metaverse.
>>> This article is part of the e-book "Metalaw: Reflections on Law in the Metaverse".
Click here to access more articles.
