Cryptocurrency project Worldcoin has been found to violate Hong Kong’s privacy law by the city’s data watchdog. Requiring users to provide face and iris scans to verify their “humanness” amounted to “unnecessary and excessive” collection of personal data, the privacy body said.
The Office of the Privacy Commissioner for Personal Data (PCPD) on Wednesday ordered Worldcoin to cease all operations of its biometric crypto project in Hong Kong which involved scanning and collecting people’s iris and face images.
The PCPD’s enforcement notice came after the watchdog conducted 10 covert visits at six premises linked to the operation of the crypto organisation founded by Open AI CEO Sam Altman, Alex Blania and Max Novenstern.
Following the visits between last December and January, the watchdog entered the premises in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central and Causeway Bay with court warrants for investigation in late January. Two rounds of inquiries were conducted afterwards.
According to the PCPD’s findings, participants of the Worldcoin project were required to grant permission to the group to use iris scanning to confirm their “humanness” and generate iris codes before they could obtain a “digital passport” known as a World ID.
The users could then receive Worldcoin tokens, also known as WLD, which the company said could be used to pay for “certain actions in the Worldcoin Ecosystem” in the future. The cryptocurrency may also be used as a store of value or make payments, according to Worldcoin’s website.
Worldcoin confirmed that 8,302 individuals had their faces and irises scanned for verification during the group’s operation in Hong Kong.
The crypto group’s operation breached the provisions on data collection, retention, transparency, access and correction rights stated in the Personal Data (Privacy) Ordinance, Privacy Commissioner Ada Chung said on Thursday. There were “less privacy-intrusive means” for the group to verify the identity of participants, the watchdog said.
“The PCPD considered that the face and iris images collected by the Worldcoin project were unnecessary and excessive,” an English statement from the PCPD read.
The watchdog accused Worldcoin of collecting personal data “unfairly,” saying the privacy notice and bio-metric data consent form were not available in Chinese. Worldcoin’s staff operating the iris scanning device also did not give any explanation or confirm participants’ understanding of the documents, it said. Such practices showed that there was a lack of transparency, the PCPD found.
“Worldcoin failed to provide adequate information to participants to enable them to make an informed choice or give a real consent,” the statement read.
PCPD added that Worldcoin would keep personal data for up to 10 years for training artificial intelligence models on how to verify users.
“The PCPD considered that the retention period was too long and amounted to prolonged retention of personal data,” the watchdog said.
Chung called on the public to report to the PCPD immediately if they saw any iris scanning services operated by Worldcoin.
By Wednesday afternoon all banners and logos of Worldcoin had been removed from its office in Jordan, according to an HKFP reporter on the ground.
Support HKFP | Policies & Ethics | Error/typo? | Contact Us | Newsletter | Transparency & Annual Report | Apps
