Applying a layered approach to data protection in an emerging metaverse

Our online environment is changing rapidly. As a result, much attention is being directed at a development referred to as the "Metaverse". This Metaverse may, somewhat crudely, be described as digital platforms that offer immersive environments. Such platforms present a combination of new and well-known data privacy challenges. This article seeks to provide an accessible and useful starting point to form an understanding of those data privacy challenges. To uncover the true nature of personal data regulation for users of such platforms, we ought to recall both the role of law, and the role of contracts. Consequently, this article begins by providing a solid overview of what is meant by the "Metaverse". It then proceeds to examine the extent to which data privacy laws claim to apply to an immersive platform that has the features of a Metaverse. The paper further examines whether a layered approach could address data protection issues arising out of a metaverse. In this context, the paper considers the data privacy laws of Australia, the European Union, and Singapore that may apply to immersive platforms.