Lindens Statements from Governance Meeting

[JacksonBollock]

58 minutes ago, Arielle Popstar said:

Guess I never thought of it and I do wonder if Europeans can't have those records expunged as it would be personal. Only leaves Americans and Canadians vulnerable to investigations.

To be fair,  by announcing on record the existence of special "internal tools" which will be used to substantively investigate this type of policy breach, Linden Lab might well have opened a big old can of "Dune" size worms - but again - Me Not a Lawyer.

Under European and UK GDPR we should be able to make a Subject Access Request despite the fact that Linden Lab is an American company. The key factor is not where the company is based, but whether it processes personal data of individuals residing in the European Union or the UK (which it does I believe).

This means that any data which can directly or indirectly identify a person within Second Life or its affiliates is covered under GDPR.

The interesting challenge with metaverse platforms like Second Life is determining when data associated with a virtual avatar crosses into the realm of personal data.

It might saliently be argued however, that a lot of the data used by Linden Lab within their "internal tools" might fall within the purview of GDPR and as such be eligible to a Subject Access Request:

1. Identifiability:
   If the avatar or the associated account holds any data that can link back to a real individual (like IP addresses, real names, payment details, or even unique identifiers), then that data falls under the protection of GDPR. This is often the case since most avatars are linked to an email address or payment account at the very least.
    
2. Behavioural Data:
   Information about an avatar’s movements, actions, and interactions within the metaverse can become personal data if it can be used to infer information about the user. For example, tracking an avatar’s movements in a way that reveals a user's habits, preferences, or social interactions could potentially be linked to a real person, especially when combined with other data.
    
3. Communication:
   Any communication via chat, voice, or text that involves personal data (even if through an avatar) is covered by GDPR if it can be traced back to an individual.
    
4. Anonymity and Pseudonymity:
   While avatars can provide a degree of anonymity, this doesn't automatically exclude them from GDPR. Pseudonymized data can still be considered personal data if the pseudonym can be linked to a specific individual with additional information that the controller possesses or could reasonably obtain.
    

Anyone fancy giving it a whirl?

All the Best
Jackson

Edited May 10 by JacksonBollock

[Alwin Alcott]

4 hours ago, BilliJo Aldrin said:

So what they are doing means nothing at all, because when a child wants to do the nasty with an adult, which is an instant perma ban anyway, they will (oh my god nooooo) replace the modesty patch skin with an older skin without the modesty patch, do it, then put the proper skin back on afterwards. 😂

I'm pretty sure the serverdata shows times of replacing outfits or parts.

[Love Zhaoying]

I am looking forward to new threads on the Forum showing more clothing for furries, especially ferals!

I see sweaters..no pants so far!  Mostly items for anthros (not ferals).  

Getting anthros to wear clothes shouldn't be too hard.

 

[Zalificent Corvinus]

7 minutes ago, JacksonBollock said:

Me Not a Lawyer.

So, basically, you admit that being not only a self confessed recent interloper with apparently little or no knowledge of SL (your term), but NOT a lawyer, your wall of text opinion is essentially worthless.

 

9 minutes ago, JacksonBollock said:

To be fair,  by announcing the existence of special "internal tools" which will be used to substantively investigate this type of policy breach, Linden Lab might well have opened a big old can of "Dune" size worms

No, not really. They are perfectly entitled to judge users according to the platforms internal rules without exposing that process.

 

10 minutes ago, JacksonBollock said:

Under European and UK GDPR we should be able to make a Subject Access Request despite the fact that Linden Lab is an American company. The key factor is not where the company is based, but whether it processes personal data of individuals residing in the European Union or the UK (which it does I believe).

You are correct, you can indeed do that, regarding "personal data" that is, data pertaining to your real world self.

That has nothing to do with your avatar's status in world, if any. And LL can restrict your avatar in their system, your avatar is not "personal data".

 

13 minutes ago, JacksonBollock said:

This means that any data which can directly or indirectly identify a person within Second Life or its affiliates is covered under GDPR.

Identifying a person, yes, identifying an avatar, no.

 

13 minutes ago, JacksonBollock said:

with metaverse platforms

There is no such thing a the metaverse. Sorry.

 

15 minutes ago, JacksonBollock said:

f the avatar or the associated account holds any data that can link back to a real individual (like IP addresses, real names, payment details, or even unique identifiers)

Wrong. IP addresses are not "personal data" as they can and do change, and can and are shared. Payment details are stored by tilla, not in your avatar. And every avatar (and asset in SSL) has a unique identifier, but that contains NO links to your real world self and again is not "personal data".

 

17 minutes ago, JacksonBollock said:

within the metaverse

There is no metaverse.

 

18 minutes ago, JacksonBollock said:

Information about an avatar’s movements, actions, and interactions within the metaverse can become personal data if it can be used to infer information about the user. For example, tracking an avatar’s movements in a way that reveals a user's habits, preferences, or social interactions could potentially be linked to a real person

Wrong again, an avatars actions in world are not connected directly to real world personal data. So, no, your teleport history, or you buying a sex toy on the MP isn't "personal data".

 

20 minutes ago, JacksonBollock said:

Any communication via chat, voice, or text that involves personal data (even if through an avatar) is covered by GDPR if it can be traced back to an individual.

Voice isn't logged at all, and local and IM chat is logged but again it can't be traced to a real world identity unless you give away your data your self, in which case its a you problem not an LL problem.

 

22 minutes ago, JacksonBollock said:

Anyone fancy giving it a whirl?

If you want to waste money on two sets off lawyers, one in the UK/EU, and one in the US, to demand that LL erase your blank SSL profile, go for it. We really don't care.

 

And all this pseudo-intellectual are waffle has exactly what to do with the topic of the thread? Nothing.

 

 

[Alwin Alcott]

23 minutes ago, JacksonBollock said:

To be fair,  by announcing on record the existence of special "internal tools" which will be used to substantively investigate this type of policy breach, Linden Lab might well have opened a big old can of "Dune" size worms - but again - Me Not a Lawyer.

Under European and UK GDPR we should be able to make a Subject Access Request despite the fact that Linden Lab is an American company. The key factor is not where the company is based, but whether it processes personal data of individuals residing in the European Union or the UK (which it does I believe).

This means that any data which can directly or indirectly identify a person within Second Life or its affiliates is covered under GDPR.

The interesting challenge with metaverse platforms like Second Life is determining when data associated with a virtual avatar crosses into the realm of personal data.

It might saliently be argued however, that a lot of the data used by Linden Lab within their "internal tools" might fall within the purview of GDPR and as such be eligible to a Subject Access Request:

1. Identifiability:
   If the avatar or the associated account holds any data that can link back to a real individual (like IP addresses, real names, payment details, or even unique identifiers), then that data falls under the protection of GDPR. This is often the case since most avatars are linked to an email address or payment account at the very least.
    
2. Behavioural Data:
   Information about an avatar’s movements, actions, and interactions within the metaverse can become personal data if it can be used to infer information about the user. For example, tracking an avatar’s movements in a way that reveals a user's habits, preferences, or social interactions could potentially be linked to a real person, especially when combined with other data.
    
3. Communication:
   Any communication via chat, voice, or text that involves personal data (even if through an avatar) is covered by GDPR if it can be traced back to an individual.
    
4. Anonymity and Pseudonymity:
   While avatars can provide a degree of anonymity, this doesn't automatically exclude them from GDPR. Pseudonymized data can still be considered personal data if the pseudonym can be linked to a specific individual with additional information that the controller possesses or could reasonably obtain.
    

Anyone fancy giving it a whirl?

All the Best
Jackson

perhaps i miss something, but what has the gdpr  to do with this? It's not connected to any publication or privacy breach, just internal use. If you'r a client of a company they cán use your info for everything that you agreed on and is reasonable within the limits of normal use as required for their business. 

[Sid Nagy]

5 hours ago, Persephone Emerald said:

Reminder: The new TOS is about child-presenting avatars, not about art.

Declare all avatars as being art.... and there you go.
Then rename Second Life in Second Art Life. Done.  🤔

[Love Zhaoying]

Assuming some of the chatter is about "why won't LL tell us their process for handling AR's"? 

This actually comes up quite often.

The general consensus is:  If LL details the process of their AR's, it enables people to find ways to get around the rules.

This is similar to my understanding of why discussing Forum "moderation" is mostly disallowed (besides Forum "moderation" being off-topic).

If you disagree with this, I'm sorry! I think it is a reasonable theory.  Plus, I do remember discussing it a lot in the past.

 

[Katherine Heartsong]

6 hours ago, Coffee Pancake said:

You probably don't want to search the marketplace for feral with only adult enabled then. It's more common in world and it's not getting anyone 'yeeted'.

Pretending this isn't a thing is not protecting anyone.

I was about to say "OMG, this is a thing?" but it's SL so a) not gonna look, and b) nothing surprises me anymore.

[Sid Nagy]

1 minute ago, Love Zhaoying said:

Assuming some of the chatter is about "why won't LL tell us their process for handling AR's"? 

This actually comes up quite often.

The general consensus is:  If LL details the process of their AR's, it enables people to find ways to get around the rules.

This is similar to my understanding of why discussing Forum "moderation" is mostly disallowed (besides Forum "moderation" being off-topic).

If you disagree with this, I'm sorry! I think it is a reasonable theory.  Plus, I do remember discussing it a lot in the past.

 

There are always people who make it their goal to stretch the rules as much as possible. Everywhere, at schools, in sports, at work, in art, you name it. So I would be very surprised if SL eh SAL would not have a fair share of them too.
So it really is best, to not tell all procedures.
 

[Love Zhaoying]

3 minutes ago, Katherine Heartsong said:

6 hours ago, Coffee Pancake said:

You probably don't want to search the marketplace for feral with only adult enabled then. It's more common in world and it's not getting anyone 'yeeted'.

Pretending this isn't a thing is not protecting anyone.

I was about to say "OMG, this is a thing?" but it's SL so a) not gonna look, and b) nothing surprises me anymore.

Yeah, just in my own feral search just now, most of what came back was sexy "feral human" outfits and skins, etc.

[JacksonBollock]

1 minute ago, Zalificent Corvinus said:

So, basically, you admit that being not only a self confessed recent interloper with apparently little or no knowledge of SL (your term), but NOT a lawyer, your wall of text opinion is essentially worthless.

 

No, not really. They are perfectly entitled to judge users according to the platforms internal rules without exposing that process.

 

You are correct, you can indeed do that, regarding "personal data" that is, data pertaining to your real world self.

That has nothing to do with your avatar's status in world, if any. And LL can restrict your avatar in their system, your avatar is not "personal data".

 

Identifying a person, yes, identifying an avatar, no.

 

There is no such thing a the metaverse. Sorry.

 

Wrong. IP addresses are not "personal data" as they can and do change, and can and are shared. Payment details are stored by tilla, not in your avatar. And every avatar (and asset in SSL) has a unique identifier, but that contains NO links to your real world self and again is not "personal data".

 

There is no metaverse.

 

Wrong again, an avatars actions in world are not connected directly to real world personal data. So, no, your teleport history, or you buying a sex toy on the MP isn't "personal data".

 

Voice isn't logged at all, and local and IM chat is logged but again it can't be traced to a real world identity unless you give away your data your self, in which case its a you problem not an LL problem.

 

If you want to waste money on two sets off lawyers, one in the UK/EU, and one in the US, to demand that LL erase your blank SSL profile, go for it. We really don't care.

 

And all this pseudo-intellectual are waffle has exactly what to do with the topic of the thread? Nothing.

 

 

Hi again Zalificent.

Yep - Not a lawyer, but I have hired a few to look at this specific topic - does that count? (Rhetorical obviously, since I already know your answer  )

Regarding Linden Lab's right to judge users according to internal rules, I agree they have this prerogative. My point was simply that by publicly acknowledging the use of "internal tools" for investigations, they may open themselves up to increased scrutiny under data protection laws. It's a complex issue and "reasonable" minds may differ.

On the question of whether avatar-related data constitutes "personal data" under GDPR, I maintain that there are real and substantive arguments for this in certain contexts.

While an avatar identity is distinct from a real-world identity, data protection law is concerned with identifiability and linkability. If data associated with an avatar can be reasonably linked back to a specific individual - internally within Linden Lab if not externally, even indirectly, it may qualify as personal data. This could include IP addresses, unique identifiers, payment information, or behavioural patterns, depending on how they are collected and processed.

Also sorry if my use of the term "metaverse" caused confusion. I was using it as a general term for immersive virtual worlds like Second Life, not referring to a specific platform or project. Regardless of terminology, my core arguments about the potential applicability of GDPR remain.

At the very least we're still in the realms of an embryonic legal framework in all these areas, but cool heads and a gracious exchanging of opinion - a bit like ours - will definitely contribute to the discussion.

All The Best
Jackson.

 

 

[Love Zhaoying]

1 minute ago, Sid Nagy said:

There are always people who make it their goal to stretch the rules as much as possible. Everywhere, at schools, in sports, at work, in art, you name it. So I would be very surprised if SL eh SAL would not have a fair share of them too.
So it really is best, to not tell all procedures.

I wish others could understand that.

It really is as easy as, "just follow the rules then there is no reason to worry about it".

[JacksonBollock]

10 minutes ago, Alwin Alcott said:

perhaps i miss something, but what has the gdpr  to do with this? It's not connected to any publication or privacy breach, just internal use. If you'r a client of a company they cán use your info for everything that you agreed on and is reasonable within the limits of normal use as required for their business. 

I think it's related, because the means of testing the policy are critical, and were addressed explicitly.

It's like trying to address the legality or otherwise of any activity, without specifying the legal context. Historically that sort of thing doesn't end well  

[Love Zhaoying]

1 minute ago, JacksonBollock said:

I think it's related, because the means of testing the policy are critical, and were addressed explicitly.

Sorry if other people including myself seem confused, at least "some of us" are used to seeing the GDPR mentioned mostly in conjunction with "privacy" (protecting your data), and "the right to be forgotten", etc.

Anyway, good luck with your idea! 🙂

 

Edited May 10 by Love Zhaoying

[Sid Nagy]

1 minute ago, Love Zhaoying said:

I wish others could understand that.

It really is as easy as, "just follow the rules then there is no reason to worry about it".

One can even try to change the rules by discussing, sometimes even protesting.
But one should pick the targets one wants to accomplish carefully and above all realistic. Just like the way of discussing and protesting.
"I demand this, I demand that..." is not the best way 99.9% of the time.

[Zalificent Corvinus]

2 minutes ago, JacksonBollock said:

I think it's related, because the means of testing the policy are critical, and were addressed explicitly.

It's like trying to address the legality or otherwise of any activity, without specifying the legal context. Historically that sort of thing doesn't end well  

The legal context is specified, it's called the Terms of Service, and you agreed to it when you logged in.

End of discussion.

LL's way or the Highway.

 

[Innula Zenovka]

41 minutes ago, JacksonBollock said:

To be fair,  by announcing on record the existence of special "internal tools" which will be used to substantively investigate this type of policy breach, Linden Lab might well have opened a big old can of "Dune" size worms - but again - Me Not a Lawyer.

Under European and UK GDPR we should be able to make a Subject Access Request despite the fact that Linden Lab is an American company. The key factor is not where the company is based, but whether it processes personal data of individuals residing in the European Union or the UK (which it does I believe).

 

Anyone fancy giving it a whirl?

All the Best
Jackson

Since it's clearly something that worries you, why don't you make a such a request?

If you're in the UK, here's a walk-through of how to do it.    I imagine the process is similar for EU residents, but your local Information Commission office should be able to help. 

 

 

[Jaylinbridges]

9 minutes ago, Sid Nagy said:

"I demand this, I demand that..." is not the best way 99.9% of the time

Revolutions are more effective than demands too.  Surely you are familiar with European and American revolutions throughout history.  Pixel worlds are just not big enough for revolutions yet.  The Nudity For Tweens Revolution, it was a bloody mess when it was over, in 2084.

Edited May 10 by Jaylinbridges
Upped my prediction to this century

[JacksonBollock]

1 minute ago, Zalificent Corvinus said:

The legal context is specified, it's called the Terms of Service, and you agreed to it when you logged in.

End of discussion.

LL's way or the Highway.

 

The ToS isn't the legal context, Linden Lab's ToS exists within a legal context.

 

 

[Keira Linden]

Hi Everyone!

I just wanted to pop in here really quickly to thank everyone who attended yesterday and to apologize to those that were not able to get into the regions (we may have set a record for largest user group attendance!). I also wanted to let you all know that if Tommy and I did not get to your question yesterday, it did not go unnoticed. The volume of questions and concerns you all brought to that meeting spoke volumes to your dedication to and admiration of Second Life and the various communities you represented. And, although it felt a little warm up on that stage, it was extraordinary to see this outpouring of concern and I was happy to have been in that hot seat. 

It's going to take us a bit to go through the questions we were not able to answer right away, and I have a few ideas on how to continue conversations that I will be working through in the next few weeks.  Mostly, I wanted to say that even though Tommy and I weren't able to address every question they were seen and will be considered with updates made to the FAQ page as we are able. I only ask that you extend the same patience you showed with us yesterday while we work through these questions and concerns.  I promise you, we are listening, we are reading and we are focused on doing what is right to protect all of our communities.

[Ceka Cianci]

I wish they did it with voice, but I understand  that probably adds to the lag for many..

I'll live.. hehehe

 

 

 

[JacksonBollock]

6 minutes ago, Innula Zenovka said:

Since it's clearly something that worries you, why don't you make a such a request?

If you're in the UK, here's a walk-through of how to do it.    I imagine the process is similar for EU residents, but your local Information Commission office should be able to help. 

 

 

It's not necessarily something that concerns me, I was responding to another post - the one I quoted.

Thanks for the link by the way, various firms that I work with are registered with the ICO and yep, they can be very helpful  

[Scylla Rhiadra]

4 hours ago, Love Zhaoying said:

But it could mean Scylla can't make that art now in Second Life. 

Hah. 

While I in fact have produced images that are thematically related to all of this -- one on RL child sexual abuse, and another very explicitly on a*eplay in SL -- neither employed nudity or explicit visual sexual imagery.

I can't imagine a context in which I'd require a naked child avi, in or out of a sexual context, for an image, so fortunately I'm pretty sure none of this will be restricting my creative freedom.

Putti are cute, but not really my style!

[Zalificent Corvinus]

1 minute ago, JacksonBollock said:

The ToS isn't the legal context, Linden Lab's ToS exists within a legal context.

 

 

The context is YOU agreed to a legal contract, you violate that contract, they can terminate your access to the service, they don't have to explain why, this isn't like being fired from a job, you can't go to a tribunal for unfair dismissal.

You have NO rights within SSL, other than what LL currently choose to allow you.

More specifically, you have NO right to any information regarding their reasons for terminating your access, or how they made that decision.

 

They don't tell you which avatar filed the AR or AR's, to prevent revenge attacks, they certainly won't tell you any RL info about your accuser. This isn't a court, you have NO right to "face your accuser".

They also won't tell your accuser how the investigation turned out, or what action was taken.

 

Stop overthinking everything ass-backwards from the wrong starting point. This isn't n RL justice system, there's no public trials or accountability, no right to know.

 

Log in, enjoy being amongst the "Batsh*t crazy" inhabitants of this "Bag of Spanners" ( again your chosen descriptions that won't endear you to SecondLifers ) in a ToS compliant way, or don't and sod off back to where ever you came from.

 

[JacksonBollock]

Just now, Zalificent Corvinus said:

The context is YOU agreed to a legal contract, you violate that contract, they can terminate your access to the service, they don't have to explain why, this isn't like being fired from a job, you can't go to a tribunal for unfair dismissal.

You have NO rights within SSL, other than what LL currently choose to allow you.

More specifically, you have NO right to any information regarding their reasons for terminating your access, or how they made that decision.

 

They don't tell you which avatar filed the AR or AR's, to prevent revenge attacks, they certainly won't tell you any RL info about your accuser. This isn't a court, you have NO right to "face your accuser".

They also won't tell your accuser how the investigation turned out, or what action was taken.

 

Stop overthinking everything ass-backwards from the wrong starting point. This isn't n RL justice system, there's no public trials or accountability, no right to know.

 

Log in, enjoy being amongst the "Batsh*t crazy" inhabitants of this "Bag of Spanners" ( again your chosen descriptions that won't endear you to SecondLifers ) in a ToS compliant way, or don't and sod off back to where ever you came from.

 

And there's the rub... the legality or otherwise of a contract is almost always open to question.

That's what expensive lawyers are for