The Office of the Privacy Commissioner for Personal Data (PCPD) of Hong Kong states that Worldcoin’s activities contravene the Privacy Ordinance and orders it to stop
The Privacy Commissioner, Chung Liling, served the Worldcoin Foundation with an enforcement notice on May 22. The notice mandated the prompt cessation of all Worldcoin project activities in Hong Kong that entailed using iris scanning devices to scan and gather facial and iris images of the general public.
In January 2024, the PCPD initiated an inquiry into the Worldcoin identity verification project to ascertain whether it involved significant vulnerabilities in citizens’ personal data privacy or contravened the Personal Data (Privacy) Ordinance stipulations.
This transpired after ten covert inspections carried out by the PCPD at six locations implicated in the Worldcoin project operations between December 2023 and January 2024.
Per the PCPD, the acquisition of face images to verify the humanness of participants was superfluous. This was because the operators of the iris scanning devices could have personally conducted this verification at the operational sites; therefore, the scanning or collection of face images was superfluous.
Additionally, the PCPD noted that Worldcoin’s lack of adequate information prevented genuine consent and informed decision-making.
The investigation unveiled that the Chinese version of Worldcoin’s Privacy Notice was not accessible, thereby impeding non-English-speaking participants’ comprehension of the project’s policies, practices, terms, and conditions. PCPD stated:
“ …the iris scanning device operators at the operating locations also did not offer any explanation or confirm the participant’s understanding of the aforesaid documents. They also did not inform the participants the possible risks pertaining to their disclosure of biometric data, nor answered their questions.”
The PCPD determined that gathering face and retinal images was unjust and illegal, violating the Data Protection Principle (DPP) 1(2), under these conditions.
The investigation revealed that the PCPD rendered a decision that deemed Worldcoin’s retention of confidential biometric data, such as face and iris images, unjustified for up to ten years, exclusively to train AI models.
Throughout its operation in Hong Kong, Worldcoin validated the identities of 8,302 individuals by scanning their features and irises.
Since its inception in 2021, Worldcoin has garnered over two million registrations in anticipation of its official debut in July 2023. Privacy concerns have prompted numerous nations’ regulatory bodies to scrutinize the undertaking, resulting in the cessation of operations in Kenya and iris scans in India.