Safeguarding Consumer Rights in the Metaverse with Hannah Glass - Step into the Metaverse: EP04

Good day everyone and welcome to the Step into the Metaverse podcast. My name is Marc Vermenam and I'm also known as the Digital Speaker. I am a future tech strategist and I think about how emerging technologies change organizations and society. This podcast is part of my new book called Step into the how the Immersive Internet Will Unlock a Trillion Dollar Social Economy. The book is available as an ebook, hard copy and audiobook. As part of this book I did nearly 100 in depth interviews with the stakeholders involved in creating the open Metaverse, the investors, the developers, the artists, the collectors, etc. And I've turned a selection of these interviews into this podcast as I think that these conversations are too valuable to leave them on my computer. In this interview I interviewed Hanna Glass. Hannah is a Senior Associate in the Financial Markets team at leading Asian law firm King and Wood Mallisons, specializing in blockchain technology, fintech and payments. Hannah advises a broad range of clients on involving legal, regulatory and governance issues associated with the implementation and application of innovative technologies. During the interview we discussed the legal and regulatory issues surrounding the metaverse, NFTs and crypto. We talked about the challenges surrounding NFTs, for example when it comes to copyright and IP issues, but also how we can protect consumers when it comes to the massive amount of data extraction we can expect to happen in the metaverse. Enjoy the conversation.

What is the Metaverse according to you?

I think the metaverse, there are a few stages to it. So you could say the metaverse is what was described by Neal Stephenson in his book Snow Crash, which is quite dystopic and quite interesting. If we look at sort of what people are looking at now with the metaverse and that interaction between the real and the virtual, you could say the metaverse is really this combination of the real and the virtual. And actually perhaps we're already living in it with things like virtual backgrounds, filters on Instagram. All of this sort of thing is actually part of that same metaverse type world. Or you could say it's this link between the real and the virtual which actually combines our worlds and says what we are doing in real life and what we are doing online are actually one and the same. And then when you combine it with new technology such as AR&VR and perhaps even moving beyond the screen to some sort of headset, and then it's that whole virtual immersive experience. And I think it's kind of all of these together. And so to say we're about to get into the metaverse or the metaverse is coming, actually, to some extent, we may already be there. And I remember a few years ago when the game Pokemon Go came out, and the idea was you were playing this game on your phone and you could actually see these Pokemon, the monsters, on your phone, as if they were there in real life. Well, that is that virtual real interaction that typifies this whole world of the metaverse. I think we're now at the next stage of this, which is, okay, well, when you were playing Pokemon Go, if the system updated at the wrong time, you lost all the monsters, you lost all your points, and so you had to go back to square one. If we're talking about the infusion of, say, blockchain technology with this and particularly non fungible tokens, the idea is that you don't lose your monsters, you don't go back to level one. You actually can keep them because the record of ownership of that or the record that you've caught that particular Pokemon, you've got Pikachu, is actually recorded in multiple places at the same time. And therefore one server goes down, you can access the information from another.

Awesome. So basically what you say is that NFTs are vital for the metaverse to work.

If we're going to say that what we have and what we are working with in the metaverse has similar rights as what we have in the physical world. Yes.

Yeah, that makes a lot of sense. But of course, the NFTs, it's a massive hype at the moment. But are NFTs what they say they are, or are they more like an illusion to true ownership? How does this work when it comes to copyright and to other things that we think, do we actually own? You know, does the person who bought beeple for $69 million actually own the painting? How does that work?

Yeah, that's a really good question. I think when we think about NFTs, we need to think about what are we actually talking about. This concept of an NFT is really a non fungible token, and the devil's in the name, actually. So it's non fungible, meaning one cannot be exchanged for another and token, which really is anything. And it's that second bit that is really important because what this means is a non fungible token is a means of recording something that is unique or is something that is unique. And that record is on a distributed ledger. And when we actually think about this as simply a means of attaching a unique record to a distributed ledger, we actually start to think about this as a technology that can be used for. For something else. And that's where it becomes really important. Because when we're thinking about non fungible tokens and for example, art, well, the question is, what have you actually acquired when you've acquired this artwork? Is it the JPEG as it is with people? Is it copyright, which is effectively the right to take that image and put it on a T shirt and sell it to other people, which could also be a right to commercialize, which it doesn't always mean you have copyright, you just have a license over that. And there's also the example of where you say, okay, well actually I have a share in this particular piece of artwork. And then actually, what does it mean to have a share of the artwork? Do you physically have a corner of that? You know, you've got a quarter of the image and that's what you own and that's what you have the right to keep, and that's your jpeg, or is it that actually you've got to write in the whole? And if you have a right in the whole, well, then that's probably something else. Even if you say that's one of four. But if you've got a right to the whole thing, perhaps all four of you together actually have a right to the whole of it. And then you may actually have created something like a trust where you're holding the artwork and someone's operating, managing it on your behalf. And then we get into a completely different realm from a legal perspective. So the most important thing to think about is NFT or non fungible token is that record. But what gives it effect? What makes it valuable? What are the rights that you've provided by means of that?

But in that regard, the $69 million Beeple JPEG, it's not that JPEG. The ones and zeros of that particular JPEG are on the blockchain as well. It's just a jpeg. Yes, you buy an asset, but of course there's so many different components to what came with the asset. And isn't that problematic for when we want to have mass adoption in the metaverse, where we have NFTs to portray ownership. But it needs to be very, very clear for everyone what it is that you buy. If I buy a car, and it's a physical car, I know it's mine because I can drive it. But that's different in the digital world, obviously. So how do we go about that?

So, so the example of a car is a brilliant one, because if you say if I buy a car, I can drive it, but you can also let someone else drive it. In fact, you could be driving a car that isn't your car. You could have loaned it perhaps from a car rental company, you could have even loaned it from a dealership which gives you a long term lease. All of these give you the same right to drive the car. Or indeed your friend might have given it to you and said, hey, you can borrow it for the weekend. All of these give you the same right to drive the car, but the right that you actually have to own the car, to use the car to the exclusion of others is very different. If you own it outright, anything that happens to the car, that's yours, that's your property. That's also your problem. You need to maintain it. If it's your friend's car and you have a little bit of an accident and you may scratch the car, your friend may say to you, hey mate, you got to pay for that. But technically speaking, the person who owns owns the car is not you. Similarly, if you say, okay, well actually I've leased the car from a rental company, well, they're the ones that need to go out and repair the car to repair the scratch. But unit may need to pay for that. Or you might have bought insurance to pay for that. The insurance is of course another right, that's another contract that means someone else is paying for it. And then if it's actually one of these long term leases, perhaps there's even a right to at the end of the three year period or whatever it happens to be, buy the car yourself. Again, completely different contracts indeed, even with your friend, there's a contract which is I'll let you buy the car, you give me a case of beer for it. But if you scratch it, you've got to pay all of these. There are rights, there's a contract, and it's that contract that matters. Same thing with an nft. You can have an NFT which allows you to have and perhaps even display the jpeg. But what you actually have in terms of the rights behind that are completely different and will depend on what you've actually received from someone else at the time that it was acquired. And there's another wrinkle to this, which is a pretty legalistic one, which is if someone says to you that you actually have a right to own the painting and perhaps display it on your wall or in people example, you have a right to own own that JPEG and sell it on to someone else. If in fact you were not the person who paid $69 million. And you were simply someone who took a screenshot of that, a very good screenshot, and you then tried to sell that screenshot onto someone else. You can probably sell the screenshot. Except, and this is the important thing, you probably don't have a right to sell that, and you certainly don't have a right to that blockchain based record of it. And that's the key difference here, is what you're buying is not just that jpeg, it's not just the image, it's actually the right to the record that sits behind it. And that's where people say that there is value here, because you can see when this thing was created, who it was created by, who it was provided to, and then every transaction along that chain. But you can also and should also be able to see exactly what those rights are. So, for example, if it includes copyright, if it includes a license to commercialize, that should be there too. And actually if it's not there, you don't have that right. And in fact, if it wasn't there, three people down the chain of title and they tried to give it to you, you never had that right in the first place. So you can't put that image on a T shirt and you can't sell those T shirts.

Yeah, but it's quite challenging in terms of all the things that are attached to it. And that brings to me, I think it's the challenge for the Metaverse for mass adoption is how people don't read terms and conditions. How are they going to know what they're buying? Will this be a problem for the Metaverse and for mass adoption of the Metaverse?

Well, it's already something that we're starting to grapple with is how do you make sure that when you buy an nft, you A, know what you're buying and B, you're able to enforce those rights, and C, if you're an artist, you're able to protect your own rights to your own artworks. And we're coming up with all sorts of ways of doing this. Some of them is through, of course, terms and conditions, which as you say, very few people read. Some of it is in a way of saying, okay, well, we know that people don't really read the terms and conditions, but in fact, they don't need to read all of these terms to understand what they've acquired. They just need to know the license of what they've acquired, what are the rights that they've got. And perhaps what it means is when you're Selling this, you actually need to also provide the information that is that particular right, that particular license, and then that is what you're able to provide going forward. So we need to find ways of making sure people understand what they're buying without saying you've got to read all the T's and C's, not that they're not important. And of course, that is where your rights will always sit. But you'll also find that if you've said in the license on the actual UX, when you've bought this, that you have a right to actually commercialize this thing, and the person who sold it to you also had that right. But the terms and conditions say, no, no, no, no, no. You've just got a right to hold the jpeg, to display it in your private home, but you can't even use it on as your Twitter avatar. Well, actually, you may find that if you were to try and go to court and enforce your rights, court may turn around and say, hold on a second. In the fine print, you said you don't have this, but when you bought it, it would clearly stipulated that you had many, many more rights. And actually, putting it all together, we may say that that small print was overridden by the information that was apparent up front. And so this is where you get into a question, not really of what, what are the terms and conditions, but actually legal interpretation of contractual terms. Now, this is hardcore law. This doesn't change whether you're in the Internet or whether you're looking at a physical contract. It's actually what happens when things go wrong and you end up going before a judge and trying to sort this mess out. And we're going to find that the same mess will have to be sorted out in probably quite a similar way, whether it's an NFT and a right to a jpeg, or whether in fact you're dealing with a fraudulent painting. It will be the same.

Wow, that is a lot of work to be done in that space. There is.

It's what makes it fun.

Yeah, yeah, definitely. But I can imagine that from a sort of, as you mentioned, sort of a UX perspective, what you want is sort of a clear table that comes with the purchase. You have these rights, abcd. You don't have these rights abcd. And then at least it makes it clear for everyone to understand what's going on. So how important do you think is tokenization to the metaverse and what are the legal challenges that we can expect here? We already talked about NFTs, but NFT is only one type of token. Can you elaborate a bit more that?

So NFTs, again, that's that particular standard. You can have real world assets that are recorded or the ownership of those is recorded in an nft. And what I mean by that is, for example, if we were to take real property houses and have a record of ownership of those which was held on a distributed ledger, well then what we might find is that the record of ownership of that particular property from a technological perspective actually involved those same token standards. It would indeed be an nft. But it's not the NFT that matters again, it's the rights that you've acquired. And the reason why it would need to be an NFT is because each property is unique and the transfer of title of that property will only be one. As in, you will only ever find that that property gets transferred from one person to another to another. And even if you were going to say, fractionalize the rights to that property, well then what you'd usually be doing is transferring that title from one person to perhaps a company. And people would have shares in that company which owns the property or to a trust, and people would have interest in the trust that owns the property. So tokenization itself doesn't change the nature of the assets. Tokenization changes, again, the record of ownership. If we look beyond NFTs to tokenization as a concept more broadly, again, it's the same thing. We're simply talking about changing the record of ownership of this particular asset from perhaps a paper record into something which is digital. It just so happens that the digital record is is held in the distributed ledger. And the best example of this is if you think about a record of ownership of shares, we rarely have a physical record of ownership. You may be able to print it out. You probably can print out and provide that record to someone else. But most likely it may, for a small company, be held in an Excel spreadsheet. It could be on a SQL Server database. It could be held by a corporate registration company who actually operates and manages that on behalf of a large corporation. Indeed, it may even be held in an exchange. Everything except for that physical paper copy is electronic. If you suddenly say, okay, well, instead of holding this on some sort of centralized database, we're holding it on a decentralized database. Yes, technically there are some people who will say that, well, that's tokenization. It's not. It's changing the record of ownership from one digital format, most likely to another digital format. And yes, it may make it easier Easier to transfer if that's built into that record that you've actually used. So if it's built into that underlying distributed ledger, but you haven't changed the asset, you haven't changed what you've acquired, you just changed the way that it can be transferred. And perhaps you've also changed the speed at which it can be transferred, or at least the transparency with which you can check who owns what. And even perhaps the beneficial ownership is in if someone's holding it on behalf of someone else. All of these are incredible benefits that we get from using this technology. But realistically, you've changed the tech, not the asset.

Yeah, that's a brilliant way of explaining it, because in the end, yeah, it's just like the Metaverse is a different channel of reaching consumers. It's a different tactic you use to display or store the same type of thing.

Exactly. And if we're going to say tying this back to the Metaverse, what you then say is, if this is on a system that is interoperable with that Metaverse system, that's when you say, instead of just trading this on one exchange, you can trade it on multiple exchanges all around the world. There are a whole lot of legal issues around that, financial services and markets, licensing and regulation, and appropriate propositions to ensure that the market is efficient and fair. But that's different. What we're talking about here is once we've changed the record of ownership, not the thing itself, perhaps you can then implement it into this new fully virtual or hybrid virtual, real life metaverse.

Yeah, I want to shift a little bit away from the NFTs and then talk a little bit about privacy issues, because those are, you know, the Metaverse comes with tons of privacy issues. At least I think, you know, you've seen Meta Facebook, who probably want to use all the. The motion capture data from their Oculus headset, which collects tremendous amount of data that very few people know. Biometrics from your eye movements, how your hands look, how your house looks, the stuff in your house, the people in your house. And probably they're going to use it to sell advertising. How do we ensure data privacy and how do we protect consumers in the Metaverse?

So look, I mean, not to speak to what any company is doing, because really, who knows? I think the idea of, you know, we're already giving away a lot of our data and people don't really know or understand the data that we're giving away. Every time you click on, let's say, a newspaper online, there are cookies that follow You. And they probably provide information to the provider of that newspaper. So they can say, well, it's clear that you're clicking on a lot of articles related to the Metaverse and crypto assets. Maybe we'll make sure that those are displayed at the top of the news cycle. So. So that you're constantly having this feedback loop and you're going to engage more, and you clearly aren't clicking on anything to do with food and restaurants. So we're going to display those right at the bottom of the page for you. We're already in a world where we are giving up all sorts of data in all of our activities. Yes. Once we're in this metaverse, we're possibly giving away more of that information. For example, you give away. Every time you're using your phone, you're giving away location data. Now, I don't want to really get into privacy specifically because there are requirements that are quite jurisdiction specific. And we do know that in particular, the European requirements are actually being adopted around the world simply because that's very much the high watermark. And anytime anyone in Europe has an interaction with you, you need to comply with those obligations, which is quite interesting. And we may see that happening more and more around the world, that people are complying with the high watermark of wherever that happens in to be provided it also meets the rights in your own jurisdiction. And we'll probably see that becoming more and more relevant is not because these systems will be accessible globally. It won't just be a matter of saying, I'm okay under Australian law, so that's all I need to meet. It's actually, I've got a system that's built in Australia, but accessible from anywhere. And so you may need to comply with a whole raft of laws and obligations simultaneously. This is something we are already seeing people grapple with outside the metaverse because we are constantly living our lives increasingly even more so online. So I think it will simply be an extension of what we're doing now, and the problems that we're already starting to solve will be adapted and implemented once we go beyond the Internet and into Web 3.0.

Yeah. So I think the challenge here is of course, as well, because you have, you know, but I guess it's the same thing with the current Internet is, you know, in which jurisdiction are you in? Is the metaverse in a particular jurisdiction? If you move from one metaverse space to another metaverse space? But you could argue that it's the same thing as with the Internet, when you move from one website to another website which is hosted or owned by a company in a certain jurisdiction. So I guess that will be pretty much the same. So if we look at some of the dangers with the Metaverse, you know, you're in web 2.0, you have imposters, you have hackers, you have scams, you have malware, you have the fakes. Obviously, that's also going to happen in the Metaverse. And if I can create a digital avatar myself, I can create one of you and I can act like if I am Hannah in the Metaverse, that is, of course, quite problematic. How can we go about that? How can we protect against consumers here?

So I think what we're getting to here is it's not so much consumer protection, but it's what is your right to your own image. And we're in an interesting world now where your name has become your identity. And in fact, your name has always really been your identity. But now we've found that people who perhaps had two names, maybe they might have changed their last name because they got married because something happened, but they were born with another name, they would usually, at law, actually probably have both identities. Now we're moving to a world where you can almost only have one, and it's quite an interesting space to be in. And this is nothing to do with the metaverse. This is actually to do with how we are interacting in our increasingly digitally enabled world. We could also say that actually it's not your name, but your email address, which might be your identity, because that's what you use to sign into so many different applications, regardless of which realm you're operating in. But again, you can have more than one email address. And in fact, yes, I can have an email address, which is my name, but I can also have one that is linked to a particular business, and it's just Hannahrypto.com well, actually, probably not necessarily because it's the company, but it's Hannah cryptomail.com, perhaps. And not that I'm about to do that, but what we're actually seeing there is, well, perhaps you've created another identity, or I could create one which is/Cryptomail.com. and that doesn't mean I've stolen your identity, that just means I've created another identity. If you're talking about using someone's image, though, we already have things that protect that. And in the same way that you might say, okay, well, I've got an image of a famous footballer, and if I start making deep fakes of that particular footballer, you can be pretty certain that I'm about to get a letter from their management and possibly several other people who may sponsor them are in charge of their contracts. Perhaps even the sporting club themselves, who actually come and say, you do not have a right to use that, that is potentially fraudulent. It may be defamatory. All of these raft of laws will still apply. So just because you've created this avatar and just because it's possible, doesn't mean you should and doesn't mean it's legal.

But you would almost argue then that it becomes easier to enforce these kind of rights, because if I make an exact copy of you, a digital Hannah, you can enforce it based on your portrait rights. But if I create an email address to Hannah crypto at Gmail, that's much more difficult to enforce. So actually you could almost say that it will make life easier to enforce your own rights. Or am I seeing it wrong?

No, perhaps you could. But if even now, if you created that Hannah cryptomail.com identity, if you then went onto Twitter and used my profile picture and were then making statements that, you know, misrepresented what I was actually saying, or statements about perhaps the law and tried to say, well, that's what KWM thinks, well, actually, it's probably not going to fly. Indeed, of course, even the statements that I'm making here are made in my personal capacity. But what you would find then is if you started making those statements, you may get a letter from me, you may get a letter from the firm that I work for saying you need to cease and desist and that you do not have a right to do that. So yes, creating that email in and of itself may be something that is very difficult to police and almost impossible, but it's that next step, not of the email, but of the use of that in a way that impinges on someone else's rights. That is where you find the rubber hits the road both now and will continue to in the metaverse.

Yeah, that makes sense.

One of the great things that we do is we recognize that this is so complex. And so in order to actually tackle this legally, we need the whole team. We need technically or traditionally banking and finance and financial services and payments. So we need all of that as well as the current practice, which is really blockchain crypto, NFTs as well as, of course, copyright, as well as if we're starting to talk about land rights or what are land rights in this world, perhaps even corporate teams become involved too, because you're Creating companies, because you've got trusting set up. You know, all of these different areas of practice become very, very relevant very quickly. And you have to work with the experts in all of these areas together, because no one person knows all of this.

So in relation to that, and one final question, you know, you have, of course, the daos and creating communities, and communities can have their own dao within the metaverse, and they can create their own rules and regulations. How can we enforce those rules and regulations? How will that work in the metaverse? And will that be like a constitution in the metaverse? Because it's regardless of jurisdiction, maybe. Do you have anything to say in this regard?

I'm going to start with that last point and then go back to the first. So this isn't regardless of jurisdiction. You'll probably find it encompasses all jurisdictions. Again, if we go back to what we were talking about before in relation to the Internet, you'll find that, yes, you have an Internet browser that may be hosted in one country, which is in relation to a company that is hosted in another country, but it is viewed and accessed by someone somewhere else. And what you'll find is the laws of all of those places apply at the same time, and we're going to find the same thing in the metaverse. Now, it's not to say that you're going to have to consider the laws of 198 countries when you're actually creating something like this, but it means you're definitely going to consider, who are you targeting, what are the laws in your jurisdiction, what are the laws in their jurisdictions, plural? And then what are the other key jurisdictions which you need to be concerned about and you probably want to take account of as well. And so you may find that there are certain places in the world that you're not allowed to provide access to this in for one reason or another. You may find that there are certain areas where you can provide access to certain images, but not the payment mechanism. So you can walk around that part of the metaverse, but you can't buy and sell things. And what you'll see is a lot of this will be an adaptation of existing laws into this new world. We're not going to necessarily throw everything that we have out. We're probably going to incorporate everything that we have in, and that's probably going to require some new interpretation, but it's not necessarily going to mean nothing matters. In fact, everything matters in relation to daos. I think we're going to find something similar, too, if we look at what A DAO is now, we would probably say, well, it depends on what are the rights that you have, and it depends on the responsibilities that each person has within that to one another. The reason why people seem to be calling for this to be recognized as a legal entity is particularly due to concerns about liability and responsibility of anyone who has potentially contributed some sort of crypto asset or is participating in the governance of this. But the fact that you have a new legal entity doesn't necessarily, or even if it was to be created, doesn't mean that you have no liability. In fact, what you'll find and what you find with other areas is it's not that no one's responsible, there's always someone. It's just, you know, who is responsible for this. And the question always in terms of legal recognition is, do we need legal recognition of something new, or can we just adapt and update something that already exists? And so you may see different, and I think we will see different approaches in different places around the world, depending on their legal systems. And even indeed, if a DAO is or was to be recognized as a legal entity, you may find that it's slightly different in different places because of their existing legal system. And ultimately you'll also find that if you need to comply with other laws, you're probably going to need to know who is responsible, because, for example, if you're operating a payment system, you need to be able to know who's responsible for operating and managing that from a regulatory perspective. So you're going to need to find the human, and the human is probably going to need to have conversations with a regulator. And that's not a bad thing. That's how the world operates. And perhaps this might provide greater certainty. But we won't find that if these were to be, and I say if, because we may find things are simply reinterpreted, we may find that if they are adopted and adapted as a different form of legal entity, that it's not going to mean that no one's responsible, it's going to mean that we know who is responsible quite easily. And I think we also need to remember that these sorts of distinctions exist now. Trusts and trust law in places like Australia and the uk, England and Wales, really, from a legal perspective, are quite different to trust and trust law in the US and indeed in each different jurisdiction in the US or somewhere, perhaps like Singapore or somewhere else, where they may or may not even exist, depending on the country that you're in. And so all of this is going to be relevant and yes, of course, when you say in one place we've recognized this illegal entity, you then need to think about what it means elsewhere. But it doesn't necessarily mean that because in one place they say no one is responsible, that that's actually going to fly somewhere else in the world. And in fact, it probably won't.

Wow, there is so much to this topic, and I think you can talk for hours on end because there literally so much to it.

I do think this concept of. And again, this isn't really my area, but I do think this concept of rights is really fundamentally important and for people to understand what they are actually getting as part of those rights. And from a legal perspective, I would say one of the key distinctions is between contract and property. Contract being something that is enforceable against the person who provided it to you, and property being enforceable against anyone. Because if we are in the metaverse and we're looking at this in the same way that we look at the real world, you need to understand the difference between your right to your car, which if someone steals it, they still don't have a right to your car, you still have a right to can then should be recovered, and the difference between the right that you've been given by your friend to drive that car and they are very, very different. And you may have been given the right by your friend to drive the car, but not to give it to a third party for them to drive. And that's the difference between the property right and the contractual right. And the same thing will happen and is relevant in the metaverse. We're just at the cusp of starting to think about this, but I think in order for this to really work, that distinction is going to be quite important.

All right, Dan, thank you so much for your time. I really appreciate it.

Absolute pleasure. It's been great talking to you.

And that wraps up the conversation with Hannah Glass. If there's one thing that stands out for me from the conversation, it is how many open issues there still are from a legal and regulatory perspective when it comes to NFTs and the metaverse. I couldn't agree more, which is why in my new book, Step into the Metaverse, I discuss the NFT challenges at length, as well as some of the dangers that will be lurking in the corners of the metaverse. If you enjoyed this conversation, don't forget to hit the like and subscribe button on your favorite podcast platform, so you will be notified when any of the other interviews will become available. Thank you and see you in the metaverse.