Speaker card for Lily Li, Founder & President of Metaverse Law Corporation. Enter the Metaverse event will take place 2nd-3rd December 2021. Sponsored by: Alien Worlds and Tafi.

Metaverse Law to Speak at TechCircus’ Enter the Metaverse event.

Metaverse law is set to speak at the world’s premier metaverse online event – Enter the Metaverse!

This brand new exciting event will unpack the technologies that underpin the #metaverse, and the myriad of possibilities unlocked. The online event will take place December 2 & 3. Day one will focus on creating the metaverse and day two will look at the impact of the metaverse. Metaverse Law will speak as part of a panel at 6am PST (2:00 pm – 3:00 pm GMT) on December 3. The panel will discuss IP, Licensing and the Legalities of the Metaverse.

Check out the Enter the Metaverse website now to find out more and register https://www.enterthemetaverse.io/

European Jurisdictions outside GDPR

European Jurisdictions with Lesser Known Internet Privacy Laws Outside of GDPR

Privacy has long been recognized as a fundamental human right in many societies. And in this new age of global interconnectivity enabled by the Internet, a growing number of countries are regulating the massive data collection and privacy of its residents.

The rules governing data privacy vary from one country to another. Some particular privacy laws are noted for their stringency or wide breadth of application to most businesses. While most are aware of the comprehensive privacy laws passed in the European Union (EU) and California state in the United States, many are unaware of other jurisdictions with privacy laws. For instance, the General Data Protection Regulation (GDPR) is not applicable law in all European countries. Some countries have implemented their own version of GDPR or have otherwise passed a data privacy law heavily based on GDPR principles.

The following are some European countries where the EU GDPR does not apply, but nevertheless has some data privacy law in place:

United Kingdom

The United Kingdom is no longer a member of the European Union. It left the EU on December 31, 2020. The GDPR no longer applies domestically to the UK, as it had since May 2018, while the UK was still a member state.

While the GDPR has been repealed for the UK after Brexit, this does not mean that the UK no longer has a data privacy law. The UK has its version of the EU’s GDPR that took effect on January 31, 2020. It governs all personal data processing by individuals within the United Kingdom, along with the Data Protection Act of 2018 and the Privacy and Electronic Communications Regulations (PECR).

The EU has now classified the UK as a “third nation” outside the scope of GDPR, for which transfers of data to the UK must be examined for legitimacy. However, the EU issued an adequacy decision for the UK on June 28, 2021. This decision maintains that personal data can continue to flow freely from the EU to the UK. It is a limited four-year process and will need to be renewed after expiration in June 2025.


Iceland has had data privacy legislation in place for quite some time. Although it is not a member of the European Union, Iceland’s legislation has been updated to largely meet the GDPR’s standards, such that its citizens are likely to get the same degree of protection as their European counterparts.

To implement the GDPR, Act 80/2018 on Privacy and Processing of Personal Data (the “Act”) was passed by the Icelandic Parliament in July 2018. The Data Protection Authority oversees compliance by companies with the Act and looks for ways to improve data policies.


Norway is another country that values privacy. Like the UK and Iceland, Norway is not a member country of the EU, but a member state of the European Economic Area (EEA) where GDPR also has jurisdiction.

The GDPR was made part of Norwegian law in July 2018 by the Law on the Processing of Personal Data (Personal Data Act) of 15 June 2018.

The Norwegian Data Protection Authority (“Datatilsynet”) is an independent public authority that protects individual privacy. Datatilsynet enforces data protection regulations such as the Personal Data Act and holds organizations and others to comply with them. It can impose financial sanctions and penalties for non-compliant entities.


Switzerland has a well-deserved reputation for protecting the privacy of its residents’ information.

Switzerland protects its citizens’ privacy through its constitution and regulations. The Federal Act on Data Protection 1992 (FADP) was passed to protect people’s privacy. It prohibits the processing of personal data without consent from the person to whom it relates. These regulations are similar to GDPR and have been deemed adequate by the EU.

According to FADP, personal data is protected and cannot be processed unless the subject or the law allows it to be done so.

Final Thoughts

It is becoming more common for governments and business organizations to move services to the Internet to enhance efficiency and accessibility. However, these improvements will likely have a significant impact on data privacy.

More and more countries are passing some version of a comprehensive or omnibus data privacy law, while others have no such data privacy regulations. Although it is impossible to provide 100 percent security online, business owners can take initial steps to improve the secure collection and processing of information, such as first determining which laws may apply to them.

Banner for PrivSec Global: A Global Live Stream Experience. 22-23 September 2021. The Largest Data Protection, Privacy and Security Event of 2021. Businesspeople smiling in the background of the banner.

Metaverse Law Speaks at PrivSec Global

On September 23, 2021 attorney Lily Li spoke at PrivSec Global: The Largest Data Protection, Privacy and Security Event of 2021. The Global Live Stream Experience was a two day event from September 22 to September 23, 2021.

The topic of discussion was “Why Most CCPA Cases Will Fail: Five Hurdles Plaintiffs Must Clear.” For more details on the topic and to watch the presentation on-demand, click here.

Human hand holding a smartphone. AI machine in the background working on the phone.

Guidance on Artificial Intelligence and Data Protection

Image by geralt from Pixabay.

For many of us, Artificial Intelligence (“AI”) represents innovation, opportunities, and potential value to society.

For data protection professionals, however, AI also represents a range of risks involved in the use of technologies that shift processing of personal data to complex computer systems with often opaque processes and algorithms.

Data protection and information security authorities as well as governmental agencies around the world have been issuing guidelines and practical frameworks to offer guidance in developing AI technologies that will meet the leading data protection standards.

Below, we have compiled a list* of official guidance recently published by authorities around the globe.


  • 1/17/2022 – Government of Ontario, “Beta principles for the ethical use of AI and data enhanced technologies in Ontario”
    The Government of Ontario released six beta principles for the ethical use of AI and data enhanced technologies in Ontario. In particular, the principles set out objectives to align the use of data enhanced technologies within the government processes, programs, and services with ethical considerations being prioritized.


  • 12/12/2022 – Cyberspace Administration of China, Regulations on the Administration of Deep Synthesis of Internet Information Services
    http://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm (in Chinese) and
    http://www.cac.gov.cn/2022-12/11/c_1672221949570926.htm (in Chinese)
    The Regulations target deep synthesis technology, which are synthetic algorithms that produce text, audio, video, virtual scenes, and other network information. The accompanying Regulations FAQs state that providers of deep synthesis technology must provide safe and controllable safeguards and conform with data protection obligations.
  • 9/26/2021 – Ministry of Science and Technology (“MOST”), New Generation of Artificial Intelligence Ethics Code
    http://www.most.gov.cn/kjbgz/202109/t20210926_177063.html (in Chinese)
    The Code aims to integrate ethics and morals into the full life cycle of AI systems, promote fairness, justice, harmony, and safety, and avoid problems such as prejudice, discrimination, privacy, and information leakage. The Code provides for specific ethical requirements in AI technology design, maintenance, and design.
  • 1/5/2021 – National Information Security Standardisation Technical Committee of China (“TC260”), Cybersecurity practice guide on AI ethical security risk prevention
    https://www.tc260.org.cn/upload/2021-01-05/1609818449720076535.pdf (in Chinese)
    The guide highlights ethical risks associated with AI, and provides basic requirements for AI ethical security risk prevention.


  • European Telecommunication Standards Institute (“ETSI”) Industry Specification Group Securing Artificial Intelligence (“ISG SAI”)
    The ISG SAI has published standards to preserve and improve the security of AI. The works focus on using AI to enhance security, mitigating against attacks that leverage AI, and securing AI itself from attack.
  • 4/21/2021 – European Commission, “Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts”
    The EU Commission proposed a new AI Regulation – a set of flexible and proportionate rules that will address the specific risks posed by AI systems, intending to set the highest global standard. As an EU regulation, the rules would apply directly across all European Member States. The regulation proposal follows a risk-based approach and calls for the creation of a European enforcement agency.



Continue Reading Guidance on Artificial Intelligence and Data Protection
1 2 3 4 5 14