Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its investigation into the Worldcoin project, finding that the project’s biometric data collection practices violated the Personal Data (Privacy) Ordinance (PDPO). In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling mandated an immediate stop to all Worldcoin operations in Hong Kong involving the collection of iris and facial images.
The PCPD’s investigation, which began in January 2024, sought to assess whether Worldcoin’s identity verification methods posed significant risks to personal data privacy and compliance with the PDPO. During the probe, the PCPD conducted 10 undercover visits to six Worldcoin operation sites between December 2023 and January 2024.
Worldcoin Ordered to Cease Operations
The investigation found that the collection of facial images was unnecessary for confirming the humanness of participants, as this verification could be done in person by the operators at the locations. The PCPD criticized Worldcoin for failing to provide adequate information, thereby preventing participants from making informed decisions and giving genuine consent.
One key issue was that Worldcoin’s privacy notice was not available in Chinese, leaving non-English speakers unable to comprehend the project’s policies, practices, terms, and conditions. Furthermore, the operators at the scanning sites did not adequately explain the documents to participants or confirm their understanding, nor did they inform participants of the potential risks associated with sharing their biometric data.
Given these circumstances, the PCPD concluded that the collection of facial and iris images was both unfair and unlawful, violating Hong Kong’s data protection principles. Additionally, the retention of this sensitive biometric data for up to ten years for AI model training purposes was deemed unjustifiable.
In an official statement to BlockchainReporter, the Worldcoin Foundation stated, “Worldcoin Foundation is disappointed by the views recently released by the regulatory authorities in Hong Kong. Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong, among many other similar statutes across other markets. In an effort to prepare humanity for the age of AI, the Foundation continues to raise the privacy bar through data minimization, user control over data and advanced technology such as personal custody, iris code deletion, and secure multi-party computation. Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process.”
Worldcoin disclosed that during its operations in Hong Kong, 8,302 individuals had their facial and iris images scanned for verification. The project, launched in 2021, garnered over two million sign-ups before its official launch in July 2023. However, Worldcoin has temporarily paused operations in India on its own accord.
Talking about the situation in India, the Worldcoin Foundation expressed, “World App continues to experience broad adoption in India where thousands download the app each week. Orb-verified proof of personhood services have been temporarily scaled back as the protocol works to develop and roll out a bespoke, safe and orderly process that sufficiently meets the demand for World ID in India. Individuals are encouraged to refer to the World App and Worldcoin website for updates regarding Orb availability near them.”
This pause in operations reflects Worldcoin’s commitment to ensuring compliance with local regulations and addressing the specific demands of the Indian market. As the project works towards enhancing its protocols, it emphasizes the importance of user trust and regulatory adherence in the successful global implementation of biometric verification technologies.
