Hong Kong’s Office of the Privacy Commissioner for Personal
Data (PCPD) has concluded its investigation into the Worldcoin project,
determining that its operations in the city violated the Personal Data Privacy
Ordinance (PDPO).
Privacy Commissioner Ada Chung Lai-ling issued an
enforcement notice to Worldcoin, demanding an immediate cessation of all
activities involving the scanning and collection of iris and facial images
using iris scanning devices.
Investigation over Data Privacy Practices
The PCPD launched its investigation in January 2024 to
assess whether Worldcoin’s identity verification methods posed significant
risks to personal data privacy and complied with the PDPO’s requirements. The
investigation involved ten covert visits to six Worldcoin operation sites from
December 2023 to January 2024.
The investigation found that the collection of facial images
was unnecessary for verifying the humanness of participants. Iris scanning
device operators could perform this verification in person at the operation
sites, making the additional step of scanning or collecting facial images
redundant.
The PCPD also criticized Worldcoin for failing to provide
sufficient information for participants to make informed decisions and give
genuine consent. Notably, the project’s privacy notice was not available in
Chinese, preventing non-English speakers from understanding the project’s
policies, practices, and terms and conditions.
Moreover, the PCPD found Worldcoin’s retention of sensitive
biometric data for up to 10 years solely for AI model training unjustified. The
project had scanned the faces and irises of 8,302 individuals during its
operation in Hong Kong. The PCPD deemed the collection of face and iris images
unfair and unlawful, violating the data protection principles of the PDPO.
Hong Kong orders Worldcoin to cease local operations, calls iris data collection ‘excessive’ https://t.co/YGmEqDLtm7
— The Block (@TheBlock__) May 22, 2024
Global Scrutiny Intensifies
Worldcoin, launched in 2021 and boasting over two million
global users, faces regulatory heat over privacy issues. Services were
suspended in Kenya and iris scans paused in India.
Earlier, in Portugal, CNPD
ordered a 90-day halt to biometric data collection, citing data protection
concerns. Meanwhile, Spain’s
AEPD took action against Tools for Humanity Corporation within the
framework of its Worldcoin project, citing complaints about inadequate
information disclosure and data collection from…
