GDPR in a Metaversal Post-Digital World: the Law of Everything or the Law of Nothing?

This article critically examines whether the General Data Protection Regulation (GDPR),
presented as technologically neutral, provides a robust framework for the metaverse. The article critically assesses the GDPR as the 'law of everything', arguing that the GDPR applies too broadly, before addressing the counterargument of the GDPR as the 'law of nothing', whereby the GDPR fails to protect data subjects against the processing of their emotion or mental data. The article presents a critical evaluation of the traditional approach consisting in the creation of novel rights. It rather proposes a top-down approach whereby the EU lawmaker would forbid the processing of emotion and mental data for commercial purposes. Additionally, it proposes a redefinition of the material scope of the GDPR to address the pitfalls arising from the GDPR as the ‘law of everything’ and the ‘law of nothing’.