Teng Changli is a doctoral candidate at Southwest University
The metaverse is a revolutionary, subversive, and new form of the future Internet that integrates multiple technologies, and personal information, as an important basic resource to support the development of the metaverse, needs to be continuously collected and updated. The main characteristics of the conflict between the right to collect information in the metaverse and the user's privacy right will inevitably arise, including the asymmetry of the conflicting subjects, the high sensitivity of the conflicting objects, and the transcendence of the spatial dimension of the conflict. In view of the characteristics of the conflict between the two, the root causes of the conflict between the two should be explored from three aspects: the change of power pattern, the lack of institutional design, and the dispute over privacy and security boundaries. Based on the trinity of "the perspective of national protection obligations, the perspective of proportionality principle, and the perspective of a community of common destiny", a metaverse privacy risk governance system is formed, and the rationality of legal regulation is continuously improved.
I. The subject concept of information collection rights and privacy rights in the metaverse era has emerged
(1) The connotation of the metaverse
So far, the metaverse has not formed a clear and unified definition, and people generally think that the metaverse refers to a new type of Internet application and social form that integrates virtual reality and reality through the integration of a variety of new technologies, including extended display, digital twin, blockchain, artificial intelligence, big data, cloud computing, virtual reality and other technologies. The metaverse is an organic expression of modern science and technology, and is a "highly experiential social network formed by the interconnection of software and hardware infrastructures" built on top of technology, with technology as the core. There are four main theories on the definition of the metaverse: "embodied network theory, social ecology theory, virtual space-time theory, and virtual and real integration theory", and "embodied network theory" reflects the characteristics of metaverse with embodied experience, virtual and real interaction, and immersive experience; The "social ecology theory" emphasizes that the metaverse reflects many elements such as interpersonal relationships, social relations, legal relationships, and economic systems in real society; The "virtual space-time theory" reflects that the metaverse is a collective shared virtual space, which can realize the digital space where the real space and the virtual space are intertwined; The "virtual and real fusion theory" reflects that the metaverse is a new form of Internet application and society that integrates multiple technologies to build a virtual and real integration. The metaverse concentrates multi-dimensional elements such as subjects, technology, capital, and innovation, among which metaverse providers and stakeholders are the core subjects of the metaverse; Capital, knowledge, data, and information are the key production factors of the metaverse; Providing diversified services is a fundamental function of the metaverse; Technology empowerment is the basic operating power of the metaverse. In the metaverse era, the metaverse has significantly changed the production and control mechanism of user data, and users' personal data, as the underlying data resources supporting the operation of the metaverse, needs to be continuously collected, used, and updated. While enjoying the technological dividends brought by the metaverse, the public is also constantly ceding their personal information rights and privacy rights, so the state needs to restrain the greed and exploitation of metaverse enterprises, build an appropriate privacy protection order, and help the metaverse information collection right and personal privacy in a balanced constraint mechanism.
(2) The connotation of information collection rights in the metaverse era has changed
The right to information collection refers to the right of individuals to collect and understand information on public affairs and matters related to or interested in them. The right to information collection has the characteristics of the right to know, which collects information about others and other things to meet its own economic and political development needs. As far as the mode of operation of the right to collect information is concerned, it still follows the prerequisite for informed consent. The information collection right of metaverse providers is not a unilateral right, but can only be exercised with the consent of users, because "the right to data collection is the right of data subjects to consent to or prohibit the collection of their data". However, if they want to enter the metaverse space, users often do not have the right to choose, and users need to agree that metaverse providers can reasonably collect, store, analyze and use their personal information before entering the metaverse space. Therefore, the informed consent collection model in the metaverse era is facing a crisis of hollowing out and formalization. In terms of changes in information collection methods, information collection methods in the metaverse era are more diversified, and information collection of metaverse enterprises can be realized in various ways such as smart cameras, wearable devices, and brain-computer interfaces. Most of these collection methods are carried out in situations where users are unaware and passive, and the impact of information collection methods on personal physical health, mental health and mental health is uncertain, and it is easy to cause ethical, moral and legal disputes. For example, Face⁃book's laboratory collects personal information data in an all-round way in the production of virtual avatars; VR and AR devices collect personal data through eye tracking, and decode individuals' thoughts and consciousness through eye tracking; Based on the information transmission technology of 5G/6G and brain-computer/brain-brain interface, collecting personal thinking and emotional data and continuously structuring the data, all of the above new information collection methods in the metaverse era have deep privacy concerns.
(3) The connotation of privacy in the metaverse era has changed
With the continuous development of technology, the types of privacy violations have become more hidden, seductive and diversified. In order to protect the right of individuals to choose the life they want, free from interference and intrusion from the outside world, the connotation of privacy also needs to be adapted to the times. In the metaverse, users obtain virtual identities through digital twins, and digitally map real subjects physically, psychologically, culturally, and spiritually through digital twin technology, and then obtain three-dimensional virtual avatars in the metaverse. However, the privacy disputes caused by the rise of the metaverse concept of virtual space and virtual avatars mainly have two aspects: First, the new disputes of privacy subjects. The behavior of the avatar is not only controlled by the real subject, but also continues to exist and develop internally while the real agent is offline. Therefore, the virtual avatar has a certain degree of autonomy, and whether the private behavior generated by it independently belongs to the scope of privacy protection, and whether the virtual avatar belongs to the protection category of personality rights and privacy rights is still controversial. The second is the new problem of privacy objects, mainly including private virtual space, private information, and private affairs. As the metaverse virtual space becomes an important part of personal production and life, individuals will have reasonable privacy expectations for the virtual space closely related to themselves. This makes individuals have new expectations for the privacy of virtual space. In addition, in order to ensure the basic data resources required for the development of the metaverse, it is necessary to fully reserve the power space for metaverse information collection, so the definition of personal private information and private affairs will be affected by the metaverse era, and how to accurately divide the sensitivity of personal privacy information, build an appropriate privacy protection order, and fully stimulate the innovation and development vitality of the metaverse will become an important influencing factor in the redefinition of the connotation of privacy.
II. Characteristics of the conflict between information collection rights and privacy rights in the metaverse era
(1) The status of the subject of the conflict is not reciprocal
As a data provider in the metaverse space, the privacy protection of individuals is often an individual right under the framework of private rights protection, while the purpose of information collection subjects such as metaverse enterprises and government agencies often reflects certain public interests, so the right to collect information usually has the mandatory characteristics of certain public power. Compared with the public interest, individuals are often in a weak position, and the two parties to the conflict reflect the asymmetry in their subject status. On the one hand, the pioneer organization and commercial subjects of the metaverse take the lead in mastering the design standards and design rights of the metaverse, there is a relationship between individuals and metaverse providers to manage and be managed, metaverse providers obtain the right to occupy the data of ordinary users, and the metaverse has the characteristics of technological superposition, which integrates a variety of emerging technologies. The depth of professionalism of the metaverse itself has far exceeded the scope of human cognition, and the current level of people's cognition is not enough to understand all the knowledge of the metaverse, and it is impossible to directly form a cognitive judgment of privacy risks in the process of collecting metaverse information, and it is difficult for individuals to fully understand the consequences of metaverse enterprises' collection of personal information, and individuals' right to make informed decisions is facing hollowing out and formalizing dilemmas. Even if in some cases, individuals do consent to the collection of certain information by metaverse companies based on their free will, it is difficult for individuals to fully understand the risks arising from the collection and aggregation of various information. Metaverse enterprises have an overwhelming advantage over individuals in terms of technology, resources, knowledge, etc., which has led to the asymmetry of power between the two sides, forming a new digital divide, and it will be difficult for users to have equal dialogue with metaverse giants. On the other hand, there are limited remedies for privacy violations against individuals in vulnerable positions. However, the implementation of this mechanism relies on the uncoordinated independent actions of many individuals, and it is difficult to form an effective constraint and synergy for metaverse enterprises that master massive information resources, and privacy protection laws and policies have highly professional and complex characteristics, making it difficult for individuals to effectively understand the content of privacy laws and policies, and it is even more difficult to fully use legal rules to protect their privacy rights and interests. Therefore, since the subject status between individuals and metaverse giants is in an unequal state from the beginning, it is difficult to hope that a benign data and information governance order will be spontaneously formed through repeated games between the two sides, and the state needs to play an important role in information protection and data governance regulators between the two.
(2) The content of the object of conflict is highly sensitive
Among the information collected by the metaverse, the personal information of a single user, or the user's single-dimensional information, has a low value, unless it is collected and used in aggregate with other personal data. The high-fidelity, deeply immersive, virtual-real, and fully interactive virtual environment created by the metaverse needs to collect massive personal data of users and onlookers and the real-world environmental data of users, and in order to extend the sensory experience of users, the metaverse needs to collect a full range of modal data of individual users, such as attention data, emotional data, cognitive state data, etc. In order to improve the authenticity of users' avatars, the metaverse needs to collect users' personal information and behavior data more comprehensively and in a timely manner, so as to more comprehensively and accurately portray users' metaverse portraits. For example, the metaverse uses a series of motion tracking and perceptual interaction technologies to collect users' biometric data such as voice, movement, eye movement, and myoelectric. A user's biometric data is a "sensitive information" that requires special protection, and such sensitive privacy information involves the core area of personal privacy, and once disclosed, it will have a significant impact on the individual's life. In addition, the way metaverse enterprises collect users' personal information is also highly sensitive. The recently hotly debated way of brain-computer interface to enter the metaverse can directly collect the user's biometric information through the electrical signal conversion of neurons, directly obtain the signals of the human brain and analyze them, and convert the user's extremely sensitive information such as emotions and cognitive experience into specific digital information. This method of collecting information may affect human brain health and be rejected by people, and the way they collect personal information is also hindered by ethics and law. Therefore, the information collection of the metaverse is more diversified than that of the traditional Internet, the way of collecting personal information is more aggressive, and the content of collecting personal information is more sensitive.
(3) The spatial dimension of conflict is transcendent
The metaverse space, the world space, and the national sovereign space are in a situation of boundary interaction and integration. This cross-state character unites different countries and peoples into one, forming a virtual space that transcends different national and social frameworks, breaking through traditional national borders. For example, personal information collected by the metaverse will flow across borders in the form of data. The data flow behavior of the metaverse across national boundaries makes its conflict with personal privacy rights spatially reflect the characteristics of crossing countries. Data resources, algorithms, and various technologies in the metaverse space are often mastered by the technical communities of different countries and are not under the jurisdiction of one country. Traditional and closed domestic laws are difficult to effectively deal with transnational privacy infringements, which will severely test the jurisdictional scope, jurisdictional capacity and degree of jurisdiction of the state to protect citizens' privacy rights. In addition to the characteristics of crossing countries, the metaverse space also has the characteristics of spanning physical space and virtual space. The metaverse space hosts the metaverse infrastructure equipment in the physical space, such as virtual reality equipment, cloud computing data centers, 5G communication facilities, etc., which has become a virtual space of its own. The metaverse space straddles both through data, algorithms, digital twins, and more as a medium. This makes the privacy governance of the metaverse space have the characteristics of cyberspace structure, which can mainly distinguish three layers, namely the reality layer, the interaction layer and the virtual layer. As the reality layer of the infrastructure in the collection of users' personal information shows a tangible, traced state in the real world, such as the wearable device as the entrance to the meta-universe exists in the physical world, the privacy leakage, personal information infringement and other behaviors caused by it belong to the traditional privacy protection category, users can directly sue wearable device designers, producers, sellers and other subjects to protect their rights, but the interaction layer and virtual layer of the meta-universe space are intangible and complex. The collection of users' personal information has a certain degree of concealment, and often collects relevant personal information without the user's knowledge, and it is difficult for individuals to use the privacy rights granted by the state to carry out litigation and rights protection actions in different spatial dimensions and different national sovereign scopes.
III. The reasons for the conflict between the right to collect information and the right to privacy in the metaverse era
(1) Changes in the power structure under the empowerment of technology
With the development of technology empowerment and technological innovation, metaverse space providers will continue to take advantage of information asymmetry and control and access rights in metaverse space, and constantly go beyond the equal contractual relationship with individual users, and the relationship between them and individual users is no longer a simple service relationship, but also a coercive relationship that occupies a large amount of user data. Metaverse providers who have access rights, behavior management rights, and standard-setting rights in the metaverse space will continue to be forced to give up their basic rights such as freedom, privacy, and information in exchange for the basic rights to enter and use the metaverse space. Based on this, metaverse space providers can collect users' personal information more conveniently, forming a control ability over users' personal information, and enhancing the power of metaverse providers' information collection rights. This makes the originally fragile privacy protection pattern show a one-sided trend. The individualized and ex-post private rights protection framework relies on individuals to protect their rights through litigation, which is difficult to cope with the information collection behavior of large-scale, knowledgeable and professional metaverse giants. The traditional "rights-power" balance pattern will undergo tremendous changes, and the top-down power pattern that originally took the state as the center will gradually evolve into a new power pattern of the state, technology giants, and individuals in the metaverse space. Pioneer technology organizations and metaverse enterprises have further strengthened the power of information collection rights in the process of gradually enriching the amount of user data by providing various technical dividends to attract users to surrender their privacy rights. However, power often has a tendency to break free, and the right to collect information in the meta-universe is no exception, when the state power is unbalanced in the constraints on the right to collect information in the meta-universe, there will be a phenomenon that the right to collect information in the meta-universe is out of control, and the capital behind it will expand disorderly, taking people as objects and tools to achieve capital appreciation, arbitrarily infringing on citizens' rights to personal information, privacy, and the right to know, and excluding the control of national politics and morality. From a global perspective, the technical specifications of the metaverse space are mainly in the hands of a small number of metaverse giants, and they are strongly intervening in the state-led privacy and security order, and personal strength is not enough to prevent the infringement of personal privacy by the right to collect information in the metaverse. As the mediator of this conflict, if the state power fails to make timely and sensitive judgments, it will exacerbate the crisis of privacy protection at the root.
(2) Lack of institutional design for privacy risk prevention in metaverse space
The public function of the privacy protection order was previously the exclusive power of the state, but the personal data, social behavior, and metaverse activity data in the metaverse space are controlled by a small number of metaverse giants, and metaverse providers gradually have the power to influence the privacy security pattern, which gradually infiltrates the design, maintenance, and law enforcement procedures of the privacy order. At present, there are two main protection models for the conflict between the state's coordination of the right to collect metaverse information and personal privacy, one is excessive protection of privacy. Emphasizing the absolute and worldly nature of privacy, classifying the vast majority of personal information as sensitive information, and prohibiting the free collection of personal information in the metaverse space, which will lead to excessive suppression of information flow and data flow in the metaverse space, which is not conducive to the innovation and development of the metaverse space. The second is the lack of privacy protection. At present, the metaverse space is in a free and disorderly generation stage, and many countries maintain an open attitude to the metaverse space, and the privacy protection system in the metaverse space is not perfect and the protection is low. In the new virtual space of the metaverse, when individuals try to use civil rights such as privacy rights and personal information rights to fight against metaverse giants with obvious asymmetric advantages, they often fall into a situation of powerlessness. Taking the "informed-consent" principle as an example, the personal data legislation of many countries in Europe and the United States grants the right of informed consent when collecting personal data. However, at the feasibility level, granting individuals the right to informed consent does not necessarily respond well to the technical advantages of metaverse giants, for example, privacy protection policies entering the metaverse space will be highly complex, professional, and lengthy, difficult for ordinary readers to understand, and it will take a lot of time to read carefully. In this situation, the effect of using informed consent to restrain the excessive expansion of metaverse information collection rights will be very limited or even useless. Therefore, in the absence of protection and support from the state, it will be difficult to form an effective joint force to protect privacy by relying only on the private rights protection framework and carrying out individual rights protection actions, and it is urgent to build an institutional design for the state to appropriately intervene in the privacy risks of the metaverse.
(3) Boundary disputes over national legislation to ensure the privacy and security of metaverse space
The traditional privacy protection system is based on national legislation, but the closed nature of national laws conflicts with the cross-national nature of the metaverse space. Each country's attitude, strength and scope of privacy protection are not consistent, and each country's privacy protection system is boundary, based on national sovereignty, beyond the scope of sovereignty, it will lose the effectiveness of privacy protection. However, as far as the metaverse space is concerned, all countries share a metaverse space, and the cross-border flow of data, the transnational implementation of infringement of personal information rights and privacy rights will make it difficult for the state to protect and enforce the right to privacy. On the one hand, the first mover countries of the metaverse try to reduce and exclude other countries from substantially participating in the governance of the metaverse space, and the first-mover countries of the metaverse actually control the key infrastructure, important technologies and key talents of the metaverse. At present, the first major countries in the world to enter the meta-universe field are mainly the United States, and international giants such as Microsoft, Facebook, and Robles Games have announced their entry into the meta-universe market. The sovereign jurisdiction of the United States extends to the shaping of the metaverse space by American companies, thereby forming a set of metaverse space governance order that serves its own security, continuing to maintain and continue its hegemonic position, treating other countries' information collection rights and privacy rights unequally, and reducing or even excluding other developing countries from participating in metaverse space governance. On the other hand, within the scope of individual national sovereignty, there are also situations where the national sovereign order conflicts with the autonomous order of the metaverse space. The concept of spatial information autonomy in the metaverse, represented by "freedom of speech", advocates abandoning state intervention and further expanding the right to collect information in the metaverse, but information freedom is deeply influenced by politics and the state, and the flow of information in the metaverse space requires the state to continue to provide order guarantees. Information of national concern includes information involving privacy, intellectual property rights, pornography, violence, endangering national security, and so on. The country needs the innovation of metaverse enterprises to promote national prosperity, and the development of metaverse enterprises is inseparable from the good business environment provided by the state, while the people enjoy the technological dividends brought by metaverse enterprises, they need to transfer part of their own privacy rights and personal information rights, and provide the necessary data foundation for the development of metaverse enterprises, which makes the people put forward new needs for their own privacy and personal information rights, and how can the state effectively respond to the new privacy protection needs of the people in the metaverse era. Actively build a privacy order boundary that meets people's needs, so as to balance the development needs of metaverse enterprises in collecting personal information and the new demands of personal privacy protection.
IV. Governance path for conflicts between information collection rights and user privacy rights in the metaverse era
(1) Resolve conflicts between information collection rights and users' privacy rights from the perspective of state protection obligations
The self-protection model is difficult to effectively deal with the infringement of personal information in the metaverse space, and the information asymmetry between individuals and metaverse providers has formed a huge digital divide. The existing private rights protection framework is difficult to effectively balance the strong information collection rights of metaverse enterprises empowered by technology. Based on this, the legal order pattern of rebuilding and maintaining privacy security in the metaverse space still requires the intervention of the state. In order to correct the asymmetric structure of the right to collect information in the metaverse space and the privacy of individuals, and prevent the infringement of personal privacy, the state needs to make a series of institutional arrangements. Under the framework of the state's protection of personal privacy, the legal norms of metaverse space privacy protection can be divided into "management law, promotion law, right law, and protection law". First, in the privacy and security protection of the metaverse space, the state mainly maintains the privacy and security order through strong punishment. Representative legislation includes the Cybersecurity Law, the Data Security Law, the Provisions on the Administration of Internet Information Services and the Provisions on the Administration of Blockchain Information Services. Second, the "Promotion Law" means that the government promotes the gradual improvement of the privacy order in the metaverse space through incentives and guidance. Representative practices include the "Metaverse Alliance" initiated by South Korea, which unites a number of local enterprises to deploy the metaverse industry, and the People's Government of Huangpu District, Guangzhou City, Guangdong Province issued the Measures for Promoting the Innovative Development of the Metaverse. Third, the "Rights Law" mainly grants citizens private rights, and the state respects the autonomy of individuals, and hopes that individuals will actively carry out rights protection actions for personal information rights and privacy rights. Fourth, legal norms such as the Protection Act target the asymmetry of power between individuals and metaverse providers, with the state acting as a supporter for the vulnerable party, thereby protecting vulnerable individuals from privacy violations. Representative legislation includes the mainland's Personal Information Protection Law and the EU's General Data Protection Regulation. The state intervenes in the formulation of metaverse space privacy policies, establishes rules and regulations for information collection, and conducts regulatory patrols through the establishment of privacy security protection institutions, so as to coordinate the asymmetric structure of power between metaverse information collectors and individuals.
(2) Resolve conflicts between information collection rights and users' privacy rights from the perspective of the principle of proportionality
The issue of privacy and security in the metaverse space is both a legal issue and a technical issue, which requires the appropriate intervention of the state to protect the right to privacy, and is also inseparable from the research and development of core technologies. In recent years, in order to actively participate in technological innovation and lead the prosperity and development of the metaverse space, it is an important foundation to ensure the security of the mainland metaverse space. To maintain the privacy security of the metaverse space, the country needs to grasp the following principles. First, the proportional relationship between the innovation and development efficiency of the metaverse and the protection of personal privacy rights and interests. The innovation and development of the metaverse is inseparable from the collection of citizens' personal information in large quantities, and the state's protection of personal information rights and privacy needs to accurately classify citizens' personal information, and promote the use of general information by metaverse enterprises that does not involve sensitive privacy; Further improve the informed consent protection system for citizens' general information, with citizens independently deciding and disposing of whether their own information is collected by metaverse enterprises; Strengthen the protection of absolutely sensitive information, such as criminal information, genetic information, medical records, biometrics, and other information, and establish prohibited areas for the collection of absolutely sensitive information. The second is the proportional relationship between metaverse space autonomy and national legislation. Due to the high degree of uncertainty in the development of the metaverse space, the positioning of metaverse enterprises, research institutions, technical communities, industry organizations, etc. is uncertain, which may lead to the disorderly development of the metaverse industry, so it is necessary for national legislation to intervene so that the metaverse space develops in accordance with the expected development set by national laws to ensure the privacy and security of the metaverse space, but it is also necessary to be wary of excessive intervention in national legislation, the law has a lagging and conservative side, and sets higher privacy protection standards. It may lead to limited information collection in the metaverse and inhibit the innovative development of the metaverse space. Therefore, metaverse space autonomy and state intervention should abide by the principle of proportionality. The third is the principle of proportionality between morality and legality of metaverse space privacy protection. Privacy protection is not only a legal issue, but also a moral issue. While promoting the construction of the rule of law for privacy security in the metaverse space, the state should also promote the moral construction of the metaverse space, improve the construction of the self-discipline committee for the ethics and morality of the metaverse space, and let metaverse enterprises assume certain social responsibilities to protect citizens' privacy rights.
(3) Resolve conflicts between information collection rights and user privacy rights from the perspective of a community of common destiny
The metaverse space is the same as the cyberspace, which is interconnected, interconnected, and interactive. Therefore, the privacy and security governance of the metaverse space relies solely on domestic laws, and it is incapable of jurisdiction, jurisdiction, and jurisdiction. Closed domestic laws are difficult to effectively deal with the metaverse privacy and security crisis that crosses national borders. How to promote sovereign countries to jointly build a secure, peaceful, open and cooperative metaverse space will become an important basis for coordinating the conflict between information collection rights and privacy rights. The concept of a community with a shared future in cyberspace will help countries enhance communication, reach consensus and strengthen cooperation in the development of the metaverse space. The metaverse space community with a shared future requires all sovereign countries to jointly promote a metaverse space with equal participation, open cooperation and people-oriented. First, the principle of equal participation. The metaverse space is the living space of all mankind, not the space exclusive to a large country or powerful country. Equal participation means that countries enjoy the same right to information collection and privacy rights, regardless of differences in political, economic, social systems and technological capabilities. Metaverse pioneer countries cannot arbitrarily expand their own information collection rights through technical means, or force other countries to comply with international treaties through coercion and other means, and each country has the right to participate in the governance of metaverse space privacy. Second, the principle of openness and cooperation. Openness means that countries need to reserve a certain amount of space for information collection rights to promote the metaverse to absorb the massive data resources needed for prosperity and development. The premise of cooperation is the principle of good faith, and in the field of cross-border data flow, developed and developing countries should pay attention to the principle of equality in the protection of privacy. The third is the principle of people-oriented, sovereign countries need to reach a consensus to respect individual privacy, the development of the metaverse space ultimately needs to be based on promoting the comprehensive free development of people, people cannot become the object and tool of the development of the metaverse space, in the virtual space of the metaverse still need to reflect the social and political nature of human subjectivity, state power needs to be vigilant against the power offside of the metaverse provider, and coordinate the right to collect information and the right to privacy by building an appropriate legal system in a balanced constraint.