Identification without redundancy in the metaverse: balance between public interest and GDPR requirements

Abstract

This article examines the phenomenon of the metaverse as an evolutionary stage in the development of digital conditions and its impact on personal data protection, criminal evidence, and legal liability. Attention is paid to the role of avatars as digital representations of users capable of revealing and generating biometric and inferred personal data. The limitations of traditional approaches to investigating crimes in metaverse environments, especially those focused on end-device data are analysed, and the need to shift toward environment-oriented methods of evidence collection is substantiated.

Author examines the significance of the General Data Protection Regulation (GDPR) as a substantive limitation on the gathering of criminal evidence, as well as the challenges to the principle of informed consent under the environment of platform dominance.

Based on a comparative analysis of GDPR implementation practices in the Republic of Croatia, conclusions have been drawn regarding the need to adapt legal mechanisms to new forms of digital interaction in the metaverse. This approach entails considering the specifics of automated biometric data processing, ensuring the principles of data minimization and proportionality, and integrating effective transparency and accountability procedures for businesses and technology operators in public and commercial spaces.