Bavarian State Office for Data Protection Supervision (BayLDA) — Worldcoin / Tools for Humanity

Decided by

Bayerisches Landesamt für Datenschutzaufsicht

Parties

Bayerisches Landesamt für Datenschutzaufsicht v. Worldcoin

Decision date

December 19, 2024

Remedy

Worldcoin was ordered to establish a compliant deletion procedure within one month, obtain explicit consent for specific processing steps, and delete data previously collected without a sufficient legal basis.

Appeal

Appeal pending

Key holdings

1. All users who submitted iris data to Worldcoin must be granted an unrestricted right to request data erasure.

   “All users who have provided “Worldcoin” with their iris data will in future have the unrestricted opportunity to enforce their right to erasure.” — page 1

2. Worldcoin must provide a deletion procedure adhering to European data protection regulations within one month of the order taking effect.

   “the company will be obliged to provide a deletion procedure that complies with the provisions of the GDPR within one month of the decision taking effect.” — page 2

3. Worldcoin is required to obtain explicit consent for specific future processing operations.

   ““Worldcoin” will be obliged to provide explicit consent for certain processing steps in the future.” — page 2

4. The authority officially ordered the deletion of data records that had been collected without a sufficient legal basis.

   “the deletion of certain data records previously collected without a sufficient legal basis was ordered ex officio.” — page 2

In plain English

The Bavarian State Office for Data Protection Supervision concluded an investigation initiated in April 2023 into Worldcoin's processing of biometric data derived from iris images. Worldcoin operates a digital verification service designed to create an identity network centered on a World ID, which uses biometric data to confirm a user is a unique individual. The authority found that Worldcoin's operations presented data protection risks regarding data security, consent processes, and user rights. Following an investigation coordinated across European regulatory bodies, the authority issued an order requiring corrective measures. Specifically, Worldcoin must implement a deletion procedure complying with European data protection standards within one month of the decision taking effect, obtain explicit consent for specific processing actions, and delete specific data records that were previously collected without a sufficient legal basis. While Worldcoin has worked to improve its data protection practices and voluntarily suspended operations in individual European Union countries, the authority determined that further changes were necessary. Worldcoin has received the decision and indicated its intention to appeal. Assessment of potential administrative offense proceedings and specific user complaints, such as protection of minors, remain reserved for separate proceedings.