Hong Kong Halts Worldcoin’s Biometric Data Collection

The Worldcoin initiative breached the Personal Data (Privacy) Ordinance (PDPO), according to the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong. Worldcoin was sent with an enforcement notice by Privacy Commissioner Ada Chung Lai-ling on May 22, which demanded that the company immediately stop using face and iris scans for any purpose in Hong Kong.

In January 2024, the PCPD began looking into Worldcoin, with a particular emphasis on the project’s identity verification techniques. They sought to ascertain if these techniques violated the PDPO’s guidelines and presented appreciable dangers to people’ data privacy. The PCPD carried out ten surreptitious visits to six different places using Worldcoin’s iris scanning equipment between December 2023 and January 2024.

The investigation revealed that scanning and collecting facial images was unnecessary. Operators could verify participants’ humanness in person, making the additional facial scans redundant. Furthermore, Worldcoin failed to provide adequate information, hindering participants from making informed decisions and giving genuine consent.

Lack of Transparency and Consent

The PCPD highlighted that Worldcoin’s privacy notice was not available in Chinese, preventing non-English speakers from understanding the project’s policies and terms. “The iris scanning device operators at the operating locations also did not offer any explanation or confirmed the participants’ understanding of the aforesaid documents. They also did not inform the participants of the possible risks pertaining to their disclosure of biometric data, nor answered their questions,” stated the PCPD.

The PCPD deemed the collection of face and iris images unfair and unlawful, breaching data protection principles. Additionally, Worldcoin’s retention of sensitive biometric data for up to 10 years solely for AI model training was found to be unjustified.

Worldcoin confirmed that during its operation in Hong Kong, 8,302 individuals had their faces and irises scanned for verification. The project, launched in 2021, saw over two million sign-ups before its official launch in July 2023. However, privacy concerns have drawn regulatory attention worldwide, leading to suspended services in Kenya and halted iris scans in India.