Extended Reality, Enhanced Protection: A Case for Strengthening the Data Privacy Framework

Abstract

Extended reality (XR) has gained substantial attention in recent years, encompassing a range of technologies such as augmented reality, virtual reality, and mixed reality. While XR technologies are still evolving, they are already used in a variety of sectors, including healthcare and medical training. Yet, they pose a variety of data privacy risks due to the variety and volume of data collected and processed by XR devices and applications, including sensitive biometric user data. This article identifies these key data privacy issues and analyses their legal consequences, primarily focusing on compliance with the European Union’s General Data Protection Regulation (GDPR). While compliance with the GDPR is a sensible starting point, the article argues for the development of an enhanced framework for data privacy protection combining law, policy and better practices in XR. In doing so, it contributes to the ongoing debates surrounding the future of these technologies.