CHALLENGES OF THE METAVERSE FOR OUR PRIVACY

CHALLENGES OF THE METAVERSE FOR OUR PRIVACY

In recent times, and as the main project for the coming years of the company “Meta” -formerly known as Facebook-, the concept of the metaverse continues to reverberate in the popular imagination and, although it is still at an early stage of development, companies from all over the world are betting on carving out their own niche in what is possibly the future of the internet. Its almost unlimited potential has led to the start of a new stage of technological developments that, although they bring with them their counterpart of economic, social and, very particularly, cyber risks, affecting privacy and information security in a very intrusive way.

By now you may be wondering, but what exactly is the metaverse? Although there is no canonical definition of the metaverse, we can define it as the virtual space, arising from the union between the physical world and the internet through the use of various technologies (virtual reality glasses, augmented reality glasses, gloves and others). garments or haptic devices, etc.) where the user immerses himself and interacts with other people and elements replicating the real world with consequences and repercussions in both spheres. This, as stated by one of its main promoters, Mark Zuckerberg, is the goal of the metaverse, the achievement of a new reality comparable to the physical world, where users can carry out any of the activities of the everyday world and innovate and discover new areas of human development. The different possibilities only run into our own imagination (e-commerce, finance, art, work, video games, health, social interaction, teaching…)

This concept is not a novelty, science fiction or video games have been glimpsing this possibility for decades, as we find in examples such as Ready Player One, Second Life or World of Warcraft, however, its practical application in full development is something that every day we observe closer in time.

Threats and challenges to privacy and data protection

As indicated by the Spanish Agency for Data Protection in its article about the Metaverse, this reality involves the user in almost all dimensions (social, economic, political, physical or emotional) “until virtualizing all aspects of the individual’s development, extending the data collected to non-verbal and biometric information” translating, therefore, in a huge amount of personal data that we could transfer, both voluntarily and involuntarily, to all the companies that operate in one way or another in the metaverse. As an example, we find from the “real” identification data, such as the unique digital identity that we will have, economic, technical, emotional, biometric data obtained from the use that we give to the accessories, metadata, tastes, hobbies… in such a way that the profiling of our identity will reach almost unimaginable heights, revealing data that we ourselves do not know or would like to reveal and enabling any possessor of these a very significant competitive advantage thanks to the ultra-personalization of campaigns, whether marketing, social or policies.

We can now break down, based on the AEPD article, some of the technologies involved in the metaverse in order to get an idea of ​​the difficulties that arise for both users and legislators trying to govern this future world:

• Virtual reality (VR), augmented reality (AR) and mixed reality (MR) technologies, or extended reality (XR) as a whole.
• Virtual currencies, cryptocurrencies and tokens, with an enabling ecosystem.

Digital identity techniques.

• Digital entity techniques or avatars, and their realistic interaction projecting users’ movements and facial expressions.
• NFTs (non-fungible tokens), which are digital assets: stocks, art, games, tickets for digital events, property, land…
• The Internet of Things, IoT, wearables (glasses, helmets, haptic gloves, joysticks, smart watches, sensors, etc.) and neural interfaces (Brain-Computer Interfaces, BCI), as sources of information for physical-virtual interaction, allowing the processing of biometric characteristics.
• Artificial Intelligence (AI), essential for responding to real-world behaviour, enabling intelligent interaction between users and avatars, and decision making and profiling.
• Distributed and decentralised data network infrastructure such as blockchain, 5G, cloud or edge computing.

All these technologies, which allow immersive interaction in virtual spaces, a digital identity and even asset ownership with an exchange market, already pose a challenge today with their own risks for the rights and freedoms of users and, therefore, their interrelation in the metaverse opens the door to new threats such as mass surveillance, loss of autonomy, discrimination, identity theft, data trafficking or even physical risks to health and personal integrity.

For its part, another of the risks to be taken into account is its special penetration among the younger population, even minors, who are more vulnerable due to their lesser capacity to identify all the risks and the relevance that the use of these technologies implies. .

In addition, the design of the metaverse, aimed at being interoperable, without borders, persistent and scalable, added to the extremes seen, allows even new categories of data to be treated with greater granularity and precision. Neural interfaces, iris or skin information extracted by wearables, proxemic analysis of our non-verbal or postural communication can yield data about our physical and emotional health. Processing carried out in an ecosystem where responsibilities are blurred, making it very costly to identify who plays the role of data controller or data processor, with a significant increase in international data transfers and mechanisms that make it difficult both to provide the necessary information to interested parties such as the collection of their consent for each specific purpose.

Finally, the governance that arises in the metaverse, quite possibly based on the decentralized technology of the blockchain, also presents problems and, as is the case with those known as “smart contracts”, the execution of the rules will be carried out automatically. , applied by algorithms, which almost entirely displaces human intervention.

Given all this, international organizations and national legislators have to get down to work to try to mitigate the risks that this new technology presents for all Internet users, reinforcing current regulations that, although they largely cover these technologies, it may lag behind what is new. As an example of this work we can already find some first approaches by the European Institutions towards the problem of the metaverse.