The Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong has completed its investigation into the Worldcoin project, concluding that the project’s activities in Hong Kong violated the territory’s Personal Data (Privacy) Ordinance (PDPO).
In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling directed Worldcoin to immediately cease all project operations in Hong Kong that involve the scanning and collection of iris and facial images from the public using iris scanning devices.
The PCPD initiated its inquiry into the Worldcoin project in January 2024 to assess whether the identity verification methods used posed significant risks to individuals’ personal data privacy and contravened the requirements of the PDPO.
Over the course of the investigation, the PCPD conducted 10 covert visits to six premises associated with the operation of the Worldcoin project between December 2023 and January 2024.
The PCPD determined that collecting facial images was unnecessary for verifying the identity of participants, as operators of iris scanning devices could perform this verification in person at the operating sites without the need for facial image collection.
Furthermore, the PCPD found that Worldcoin failed to provide adequate information to enable informed decisions and genuine consent. Notably, the project’s privacy notice was not available in Chinese, preventing non-English speakers from understanding the project’s policies, practices, terms, and conditions.
According to the PCPD, operators of iris scanning devices at the operating sites did not explain the relevant documents to participants or confirm their understanding of them. They also neglected to inform participants of the potential risks associated with disclosing biometric data or address their inquiries.
In light of these findings, the PCPD concluded that the collection of facial and iris images constituted unfair and unlawful practices, violating data protection principles.
Additionally, the PCPD ruled that Worldcoin’s retention of sensitive biometric data, including facial and iris images, for up to 10 years solely for AI model training purposes was unjustified.
Worldcoin disclosed that 8,302 individuals had their facial and iris images scanned for verification during its operations in Hong Kong.
The Worldcoin project, introduced in 2021, attracted over two million sign-ups before its official launch in July 2023. However, it has faced regulatory scrutiny in various countries due to privacy concerns, resulting in the suspension of services in Kenya and the cessation of iris scans in India.
May 2024, Cryptoniteuae
