The arrival and development of the metaverse into our lives necessitates the need for updating our laws to deal with the legal complexities and challenges that will almost certainly be posed by the metaverse, write SIDDHARTH CHATURVEDI and PRIYANSH BHARADWAJ.
————–
RECENTLY, multinational technology company Meta's founder Mark Zuckerberg remarked at an event that 'India will hugely contribute in building Metaverse.' This statement raises hope that India is on the cusp of bringing a new revolution of the Internet to the world. However, not much attention has been paid to the fact that India is largely a consumer of technological services that are offered to it, and must therefore get a say in how a particular technology will be operated in the country.
Till now, trends suggest that India has for most of the time drawn on inspiration from foreign countries in order to make laws related to technology. For example, the Personal Data Protection Bill [PDP Bill] has largely been drawn from the European Union's General Data Protection Regulation. It is argued that India needs to be active in making laws in relation to new technologies, and specifically focus on the 'Metaverse.'
While India may have been largely relying on foreign laws in order to update its own digital laws, the Metaverse provides a breakthrough. Recently, law professor Ashit Kumar Srivastava, writing in The Statesman, had rightfully argued that "the gradual process of law making and leeway this allows technology to get entrenched in the society, in turn making application of law harsher." Various important provisions which govern the data protection laws such as profiling, data localisation and cross data transfer are likely to undergo significant changes. For example, if one goes through the website of Oculus, it clearly mentions that it collects data such as "information about environment, physical moments and dimensions when you use an XR device." A brief perusal of the definition of sensitive personal data under the PDP Bill suggests that it falls under the category of sensitive personal data as it contains biometric information (for example – one's hand movements).
Most importantly, the education sector in India is likely to undergo a significant transformation as the Central Board of Secondary Education and Meta recently announced a tie-up to cover 10 million students who will be provided curriculum in Augmented Reality experience. The current Information Technology Act [IT Act] does not have a provision in relation to handling sensitive and personal data of children. Though the same has been provided in the PDP Bill (Section 16 of the Bill), the bill does not take into account the effect of virtual reality and augmented reality. Therefore, in the present legal framework, there is no protection of sensitive and personal data of the children over metaverse platforms.
Also read: Data Protection Bill expands privacy framework, but prioritises State over individual consent
With the advent of Metaverse, the amount of data being stored will increase significantly. This means that a lot of new data centres will be needed. According to computer engineer and Intel executive Raja M. Koduri, these data centres will also require a significant amount of restructuring in order to provide additional capability to compute, store and network. There is a need for a specific law which will help in enabling the formation of data centres and increasing their capacity smoothly, and at the same time, requires that these data centres adhere to environmental protocols.
“The current IT Act does not have a provision in relation to handling sensitive and personal data of children. Though the same has been provided in the PDP Bill (Section 16 of the Bill), the bill does not take into account the effect of virtual reality and augmented reality. Therefore, in the present legal framework, there is no protection of sensitive and personal data of the children over metaverse platforms.
Considering the interest in metaverse shown by tech giants like Meta and Google, ordinary people have started making investment in buying digital assets. Recently, virtual land was sold in the sandbox for 4.3 million dollars, the costliest land ever sold in the metaverse. Moreover, one of the conditions mentioned in the site from where the said land is purchased is that the land can be bought in cryptocurrency only and moreover, if the company's server fails to operate, the land will no longer exist. This raises the legitimate concern that people can use virtual assets as a means to commit fraud on innocent people. Since cryptocurrency is not a legal tender money and no legal registration deed is provided when a person buys a virtual asset, it will be an onerous task for the investigating agencies to bring the culprits of such a crime to book as the evidence against the culprits will be extremely weak.
“The Metaverse has greatly increased the demand for the virtual assets, thereby providing criminals who indulge in money-laundering a safe harbour to hide their proceeds of crime. The criminals can convert their illegal proceeds into cryptocurrency, and can purchase virtual assets with the cryptocurrency.
The Metaverse has greatly increased the demand for the virtual assets, thereby providing criminals who indulge in money-laundering a safe harbour to hide their proceeds of crime. The criminals can convert their illegal proceeds into cryptocurrency, and can purchase virtual assets with the cryptocurrency. Since the cryptocurrency works on blockchain technology, the real identity of the criminals will remain anonymous, and the law enforcement agencies will face a tough challenge to discover all the proceeds of the crime.
In December last year, Meta had opened a metaverse platform known as Horizon Worlds. On this platform, the incident of the groping of a female avatar by a male avatar had come into limelight. Later that month, a woman avatar revealed that she was gang raped by four male avatars in Meta's Horizon Venues metaverse. This leads to the question as to whether the virtual body is legally the same as the physical body, and will it be appropriate to use words like 'rape' in relation to offences against the virtual body. For example, Section 354 of Indian Penal Code punishes a person for outraging the modesty of a woman. The essential ingredient to punish a person under this section is that a woman must possess modesty that has been outraged by a man.
The grey area arises as to whether the woman avatar possesses modesty or not. There is no firm law according to which it can be said that a virtual female avatar possesses "modesty". The present IT Act that regulates cybercrimes against women is not drafted keeping in view the crimes that can occur in the metaverse. Moreover, there is no law presently that penalises sexual assault done in online mode. It is also difficult to identify the culprit who engages in such criminal acts as each individual is provided with a separate identity in the metaverse.
One of the features of the Metaverse is that the user has the option to choose clothes for their avatar. Whenever the user picks a particular attire for the avatar, data regarding it will be stored in the server of the company that provides metaverse services. The company can use this data to build the fashion profile of the user. On analysing the data of many users, the company can get to know what the preferences of the users in the fashion industry are. The company can use this information to produce its own brand of clothes, thereby having a dominant position as compared to the other competitors in the fashion industry. This could severely hamper the efforts of the governments to have a fair and competitive economy. This is something that the Competition Act must be updated to deal with.
“There is no firm law according to which it can be said that a virtual female avatar possesses "modesty". The present IT Act that regulates cybercrimes against women is not drafted keeping in view the crimes that can occur in the metaverse. Moreover, there is no law presently that penalises sexual assault done in online mode.
There are a lot of concerns regarding the technology of Metaverse and what kind of legal implications it will have. From the issue of the groping of a female avatar to selling of assets in millions, Metaverse has thrown a plethora of challenges. At the same time, this is just the beginning of the revolution of the internet, and full implications of the technology of Metaverse will be realised only in 10-15 years. However, lawmakers will have to be active in ensuring that the technology of Metaverse is in sync with the norms of data protection. This calls for an early draft of the law for Metaverse so that technology also evolves with boundaries set by law.
(Siddharth Chaturvedi and Priyansh Bharadwaj are undergraduate law students at the Dharmashastra National Law University, Jabalpur. The views expressed are personal.)