Typically a jurisdiction’s data breach reporting laws turn on an impacted individual’s residency, the location of the incident, or the location of the relevant organization’s headquarters. This is a factual question which the complexity of dataflows within the metaverse can complicate. Platforms, operators and users can all be in different jurisdictions around the globe, VPNs may further obscure location, and users may not be required to register their physical location. It remains to be seen if existing laws will be adapted to meet this issue, or indeed if the metaverse itself will be further regulated to require, for example, geo-fencing of users based on their real-world jurisdiction.

Companies may also have to grapple with existing sector-specific incident/data breach reporting requirements (for example, where your services could be considered key pieces of national infrastructure, where they involve confidential communications services, or where you are providing certain financial, telco or health services). The key consequence being that even if a jurisdiction can be identified, any cybersecurity incident in the metaverse may give rise to reporting obligations to multiple regulators concurrently within that same jurisdiction.

In the absence of clarity in a revolutionary world populated by avatars and virtual spaces, regulators and courts are more likely to hold ambiguity against companies than against individuals who come forward and can demonstrate harm, just as they did in the early days of the Industrial Revolution with the steam engines that threw off flaming embers.

Mitigating risks

• work with the platform operator and relevant third parties to establish an agreed-upon approach for determining the legal jurisdiction applicable to a user
• if appropriate, consider developing contractual (e.g. “by entering this site, you agree that the laws of England and Wales will apply”) and technical controls/accompanying FAQs (e.g. by having users indicate their jurisdiction at time of registering their avatar or otherwise entering a metaverse experience) to help establish a clearer indication of a user’s jurisdiction
• to the extent possible, maintain an accurate map of the data flow of information relevant to your products/services, including detail of data flows between multiple entities/third parties and jurisdictions
• be mindful of additional sector reporting obligations which may apply