Introduction – the law-technology pace
It is a common fact that law and regulations cannot keep up with the fast pace and sophistication of technology. The introduction of Virtual Reality (VR) in certain parts of the Danish health sector is testament to this. The Danish tech company Khora[1] has developed a VR technology to be deployed specifically in the treatment of severe and long-term mental health issues. Khora states that ‘The potential for using Virtual Reality and Augmented Reality to improve people’s mental health is immense and we are pushing the boundaries of what the technology can do.’ However, without even collecting or storing personal data, companies like Khora are simultaneously pushing the boundaries of data categories, as in the wake of VR, a new type of personal data, ‘co-lab data’ (for lack of a better word) has emerged.
Technology affecting data categories – avatar GDPR
With the introduction of Virtual Reality[2] in the Danish mental health sector, the interaction between patient and health professional has fundamentally changed. So has the nature of data utilized, generated, and harvested during a VR facilitated treatment. The nature of data, the deployment, and the definition of data as we know them are all impacted by VR. Ultimately, this applies further pressure on the framework of the GDPR.
The implementation of VR technology creates simulated, visual realities inhabited by avatars and equipped with audio-supplements that present a new arena of data creation not yet reflected in the EU GDPR. Therefore, this pioneering VR work calls for careful consideration of potentially new ways of categorizing data and defining data essence and data boundaries.
The avatar setup introduces the concept of personal data as data stemming from more than one natural person as in the avatar-treatment, the avatar-persona and appearance is informed by both patient and health professional in collaboration. The data flow does not extend from the patient to the health professional but stays in a circuit between the two of them in the process of creating and operating the avatar. The avatar is created as part of the treatment and projects itself as a complex co-creation infused with data from the patient and the health professional. ‘Co-lab data’, i.e. data forged in a collaboration (‘co-‘) between the health professional and the patient and born out of the VR laboratory (‘lab’) is the term, that seems to best reflect this new type of data that serves as the core and mechanics of the VR-avatar.
VR and the creation of personal data
The reason why VR generated Avatar therapy[3] has proven efficient to an amazingly high percentage of patients with long-term, severe schizophrenia[4] is to be found in the design of the interaction between health professional and the patient. In avatar therapy “people who hear voices have a dialogue with a digital representation (avatar) of their presumed persecutor, voiced by the therapist so that the avatar responds by becoming less hostile and concedes power over the course of therapy”.[5] The interaction between therapist and patient exceeds mere communication as they work closely together in initially sketching the physical appearance of the avatar and subsequently finding the right tone of voice, pitch, wording, tonality and semantic persona, dialect or sociolect of the persecutor.
Once all these data have been mapped and logged or even recorded, the interaction therapy commences. The parties collaborate on using the perceptions of the patient to equip the physical appearance of the avatar and mimic its behaviour and interaction pattern. The avatar is made to move according to the mapping of the patient’s audio-visual experiences contains a shift between the wording and description produced by the patient as testament to his/her condition and the voicing produced by the therapist mimicking the descriptions provided by the patient. Voice patterns are distinct and in representing the inner world of the patient, the psychologist is actively adding his/her data (tone of voice, pitch, distinct voice patterns etc.) to the avatar and clothing him. When sessions are logged of recorded, the patient health data encapsulates also personal data from the health professional. The avatar, therefore, becomes a merger of personal data from two sources and this applies a strong pressure on the GDPR data categories as we know them all as they are all founded on the ‘one natural person only’-assumption.
VR forming data categories beyond the GDPR
The data harvesting and handling described above deviates from the GDPR in a number of ways. GDPR Art. 9 lists physical and mental health information as special categories of personal data. Due to their display of penetrating insights into the physical and/or mental condition of one single, identifiable individual, health data are highly sensitive.
Personal data as defined in GDPR Art 4 (1) are data “relating to an identified or identifiable natural person (‘data subject’)”. Hence, it is the underlying assumption of the entire GDPR that personal data are data related to one person only. It is the underlying assumption therefore, that health data contain information about the condition of one and only one individual.
According to GDPR Recital 6, ‘Technology allows both private companies and public authorities to make use of data on an unprecedented scale to pursue their activities.’ Though Recital 6 encapsulates an obvious concern about the transformative impact of technology on data in real life settings, the GDPR lacks recitals that formulate the transformative impact on data by human groups employing technological devices in virtual reality settings in such a way that personal data like health information is no longer attributive to one individual only but is created as part of interactions and shared between individuals, co-created and even merged or creatively shaped. Health data can no longer be referred specifically to one individual but is a co-creation.
“Participants first created a computerised representation of the entity that they believed was the source of their main voice. After completing the set-up of the avatar in an introductory session, which included a comprehensive assessment of the voice(s) and included verbatim content, the therapy was delivered over six weekly 50-min sessions. 10–15 min of each session involved face-to-face work with the avatar, wherein the therapist facilitated a direct dialogue between the participant and the avatar’.[6]
The above description demonstrates that the parties work closely together in sketching the physical appearance of the avatar and finding the right tone of voice, pitch, wording, tonality and dialect or sociolect of the persecutor. Once this has been mapped and logged, the interaction therapy commences. Eventually, it is not possible to extract the personal data of each of the specific contributors from the avatar.
Co-lab data going forward
As seen for a GDPR perspective, the cutting-edge VR therapy is also the rise of a new type of data category where patient health data is being used to sketch the avatar and add facial features to it. Once the creature is in place and projected into the technical realm, the psychologist acts as a puppeteer bringing the avatar to life and lending him a tone of voice a vocabulary and a personality. The appearance of the avatar depicts 1:1 the patient’s mental image but the contribution from the psychologist is both voice and words. The avatar as a vehicle of treatment mirrors both the patient’s inner life and the psychologist’s data as far as voice and communication pattern and pace goes. When looking at the avatar as a healing instrument, we are viewing a merger of personal data. The avatar is a documentation of a mental condition related to the patient and at the same time a treatment instrument operated by the psychologist. In the line of communication, the patient can be found self-healing when confronting himself/herself with his/her inner voices, so the data contribution of the therapist is pivotal. There is to rolling back technological progress, so the next step is handling the GDPR challenges it initiated, and the merged data remains to be mapped out as a specific category in the current GDPR world.
Gabriele Recke
Head of Legal
Januar ApS
[1] Homepage of Khora https://khora.com/healthcare/ (Accessed September 22, 2022).
[2] Virtual Reality is a technology deployed to create simulated immersive visual and auditive experiences.
1 This article derives its information about the technical setup of the avatar project from Tom KJ Craig, Mar Rus-Calafell, Thomas Ward, Julian P Leff, Mark Huckvale, Elizabeth Howarth, Richard Emsley, Philippa A GaretyAvatar Therapy for auditory verbal hallucinations in people with psychosis: a single-blind, randomised controlled trial. IN : Psychiatry 2017. Published Online November 23, 2017; http://dx.doi.org/10.1016/S2215-0366(17)30427-3
[4] The first avartar-based study of this kind took place between Nov 1, 2013, and Jan 28, 2016Tom KJ Craig, Mar Rus-Calafell, Thomas Ward, Julian P Leff, Mark Huckvale, Elizabeth Howarth, Richard Emsley, Philippa A Garety Lancet IN : Psychiatry 2017. Published Online November 23, 2017; http://dx.doi.org/10.1016/S2215-0366(17)30427-3, p. 1.
[5] Tom KJ Craig, Mar Rus-Calafell, Thomas Ward, Julian P Leff, Mark Huckvale, Elizabeth Howarth, Richard Emsley, Philippa A Garety Lancet IN : Psychiatry 2017. Published Online November 23, 2017; http://dx.doi.org/10.1016/S2215-0366(17)30427-3, p. 1.
[6] Tom KJ Craig, Mar Rus-Calafell, Thomas Ward, Julian P Leff, Mark Huckvale, Elizabeth Howarth, Richard Emsley, Philippa A Garety Lancet IN : Psychiatry 2017. Published Online November 23, 2017; http://dx.doi.org/10.1016/S2215-0366(17)30427-3, p. 3.
