Worldcoin’s Hong Kong Operations Suspended Over Privacy Concerns

• Hong Kong privacy watchdog halts Worldcoin’s biometric data collection, citing violations
• Investigation finds Worldcoin’s practices overly intrusive, lacking transparency and consent
• Worldcoin ordered to stop iris scans, revise data policies, and improve communication with users

The Office of the Privacy Commissioner for Personal Data (PCPD) has determined that Worldcoin’s activities in Hong Kong violated the city’s Privacy Ordinance. Privacy Commissioner Chung Liling has issued an enforcement notice, ordering Worldcoin to cease collecting biometric information, including iris and facial images.

The PCPD’s investigation uncovered significant breaches of the Privacy Ordinance’s data protection principles. Key concerns included the collection, storage, access, rectification, and transparency of personal data. Worldcoin’s practice of collecting facial and iris images was deemed unnecessarily intrusive and excessive. Additionally, the retention period for this data – up to 10 years for training an artificial intelligence model used in identity verification – was criticized as unduly lengthy.

A critical issue identified was the lack of clear and comprehensive communication with participants. Worldcoin failed to adequately explain the purpose of data collection, individuals’ rights, or how they could access and correct their information.

This issue was exacerbated by the absence of Chinese-language versions of the Privacy Statement and Biometric Data Consent Form, despite operating in a predominantly Chinese-speaking region. Furthermore, Worldcoin staff did not ensure that participants fully understood the documents they were signing or inform them about the potential risks associated with sharing their biometric data.

The PCPD’s investigation entailed multiple visits to Worldcoin’s operation points in Hong Kong. From December of the previous year to January, investigators visited six locations ten times. In late January, armed with a court warrant, they conducted a thorough on-site investigation. The investigation concluded after two rounds of inquiries.

The Worldcoin project required participants to undergo iris scanning to verify their human identity and generate unique iris codes. This biometric verification process was mandatory for individuals to register and receive Worldcoin’s virtual currency. During its operation in Hong Kong, Worldcoin conducted facial and iris scans on 8,302 individuals.

The PCPD’s findings underscore the importance of adhering to data protection principles, particularly in the rapidly evolving field of biometric data collection. The investigation highlighted that the collection of such sensitive data must be justified, minimally invasive, and accompanied by clear communication regarding its use and participants’ rights.

Following the PCPD’s enforcement notice, Worldcoin is required to immediately halt the collection of biometric data. The company must also address the identified issues and comply with the data protection standards set forth in the Privacy Ordinance. This includes revising their data collection practices, shortening data retention periods, and improving transparency and participant communication.