The Office of the Personal Data Privacy Commissioner (PCPD) has completed its investigation into the Worldcoin project, finding that its activities in Hong Kong violated the Personal Data (Privacy) Ordinance (PDPO).
Hong Kong Privacy Commission Orders Worldcoin to Stop Iris Scanning Operations
Privacy Commissioner Ms. Lillian Chung issued an enforcement notice requiring Worldcoin to stop using iris scanning devices to collect iris and facial images from the public.
The investigation revealed that Worldcoin violated various Data Protection Principles regarding the collection, storage, transparency, access and correction of personal data under the KVKK.
In particular, the collection of face and iris images was considered unnecessary and excessive. PCPD criticized Worldcoin's policy of storing personal data for up to 10 years to train artificial intelligence models used in identity verification processes, finding it excessive and unjustified.
Additionally, PCPD found that Worldcoin did not adequately inform participants about the purpose of data collection, their rights, and the means to access and correct their personal data as required by law.
The “Privacy Notice” and Consent Form for Biometric Data provided by Worldcoin did not have a Chinese version, and staff at collection sites did not explain or confirm that participants understood these documents.
PCPD conducted multiple visits to six Worldcoin locations in Hong Kong between December last year and January this year, including a court-ordered investigation in late January.
The investigation found that participants in the Worldcoin program were required to consent to the collection of facial and iris images through iris scanning to verify human identities and generate iris codes.
This verification process was a prerequisite for receiving a registered identity and free virtual currency known as “Worldcoin”.
Worldcoin confirmed that the faces and irises of a total of 8,302 people were scanned during its operation in Hong Kong.
This decision highlights the importance of complying with data protection laws and ensuring transparency and fairness in the collection and use of personal data.
*This is not investment advice.