- Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has ordered Worldcoin to cease all biometric data collection operations in the region
- The PCPD alleges that Worldcoin has breached privacy rules by scanning iris and facial images
- The watchdog has been aggrieved by Worldcoin’s storage of biometric data for up to ten years
The Office of the Privacy Commissioner for Personal Data (PCPD) has ordered Worldcoin to cease all operations in Hong Kong involving the collection of biometric data, according to the Hong Kong Free Press. The outlet reports that the PCPD has ordered Worldcoin to stop the scanning of iris and facial images over allegations that it has breached privacy rules. It is also aggrieved at Worldcoin’s storing of such data for up to ten years, which it says represents further breaches of such laws.
PCPD Conducted Covert Site Visits
The Hong Kong Free Press alleges that the PCPD conducted an investigation that included ten covert visits to six locations associated with the crypto organization, founded by OpenAI CEO Sam Altman, Alex Blania, and Max Novenstern. These visits, conducted between December and January, led to a formal investigation in late January, with the PCPD executing court warrants at premises in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay.
During its investigation, the PCPD discovered that participants were required to consent to iris scanning to verify their “humanness” and generate a unique iris code. This process is a prerequisite for obtaining a World ID, which allows users to receive Worldcoin tokens (WLD). These tokens, according to Worldcoin, can be used for transactions within the Worldcoin ecosystem or as a store of value.
Worldcoin in Violation of Privacy Laws
Worldcoin admitted that it had scanned the irises and faces of 8,302 individuals during its Hong Kong operations. However, the PCPD found these practices to be in violation of the Personal Data (Privacy) Ordinance. Privacy Commissioner Ada Chung stated that the methods used by Worldcoin for data collection, retention, transparency, and access were excessive and unnecessary, while the PCPD also called the methods “unnecessary and excessive.”
Additionally, the watchdog criticized the lack of transparency involved, pointing out that the privacy notice and biometric data consent forms were not available in Chinese, and participants were not adequately informed about the implications of their consent.
Of additional concern to the PCPD was the fact that Worldcoin intended to retain the collected data for up to ten years for training artificial intelligence models, a period deemed excessively long and unjustifiable. As a result of its investigation, Commissioner Chung urged the public to report any ongoing iris scanning activities by Worldcoin.
Worldcoin Beats a Hasty Retreat
The Hong Kong Free Press reported that by Wednesday afternoon, all Worldcoin banners and logos had been removed from its office in Jordan, suggesting that the company has been forced to take the accusations seriously.
Worldcoin told us in a statement that it believed it had done all it required in order to continue operation in the region:
Worldcoin Foundation is disappointed by the views recently released by the regulatory authorities in Hong Kong. Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong, among many other similar statutes across other markets. In an effort to prepare humanity for the age of AI, the Foundation continues to raise the privacy bar through data minimization, user control over data and advanced technology such as personal custody, iris code deletion, and secure multi-party computation. Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process.
