Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has served an enforcement notice to Worldcoin, a crypto project co-founded by OpenAI’s CEO Sam Altman, asking them to cease operations. The resolution concludes the investigation launched by the PCPD in January 2024.
Hong Kong Halts Worldcoin Activities
At the beginning of the year, Hong Kong’s PCPD announced it would investigate Worldcoin’s activities as they could pose a “risk to personal data privacy.” The Privacy Commission investigated six Worldcoin facilities in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay.
PCPD’s Privacy Commissioner, Ada Chung Lai-ling, found that the crypto project had broken the Data Protection Principles (DPPs) regarding the collection, retention transparency, data access, and correction rights.
The Worldcoin project scanned participants’ iris to verify their identity and receive the project’s native cryptocurrency, WLD.
According to the statement, the investigation revealed that participants were required to allow certain organizations to collect their faces and iris images through iris scanning in an “unnecessary and excessive” manner.
The project confirmed that 8,302 individuals had their faces and irises scanned for verification during its operation in Hong Kong. PCPD argues that the project collected personal data “unfairly” as important policies were not available in Chinese:
In particular, the relevant “Privacy Notice” and “Biometric Data Consent Form” were not available in Chinese, the iris scanning device operators at the operating locations also did not offer any explanation or confirmed the participants’ understanding of the aforesaid documents.
The Privacy Commission considers there was a lack of sufficient transparency for those using the Chinese-language version to understand and consent to the relevant policies.
Additionally, Hong Kong’s PCPD stated that Worldcoin did not inform participants of the risks involving their disclosure of biometric data nor answer users’ questions. Therefore, the project contravened the Personal Data Privacy Ordinance (PDPO) as participants did not have the “means to exercise their rights of data access and correction.”
Based on this, the commission asked for the immediate cease of the Worldcoin Foundation’s operations involving scanning and collecting iris and face images of the public using iris scanning devices in Hong Kong.
Global Scrutiny And New System
Hong Kong’s crackdown is one of many challenges faced by Worldcoin worldwide. Since its announcement, the project has faced global regulatory scrutiny from countries like Germany, France, and Kenya.
Amid the global challenges, the Worldcoin Foundation recently unveiled a new open-source system to tackle some of the issues raised by authorities. The new system allows the project to adopt advanced data protection measures to more effectively “safeguard sensitive information.”
Through its secure multi-party computation (SMPC), Worldcoin has increased the security of the stored information by distributing the data through different locations. As a result, Worldcoin has deleted the iris codes obtained during user registration.
Ultimately, the new approach aims to address concerns about sensitive data storage, scale, and cost limitations, reducing the risk of security breaches.
