Office of the Privacy Commissioner for Personal Data (PCPD) — Worldcoin Foundation

Decided by

Office of the Privacy Commissioner for Personal Data

Parties

Office of the Privacy Commissioner for Personal Data v. Worldcoin Foundation

Decision date

May 22, 2024

Remedy

The Privacy Commissioner served an enforcement notice on Worldcoin Foundation, directing it to cease all operations in Hong Kong involving the scanning and collection of iris and face images.

Appeal

Appeal status not stated

Key holdings

1. Collecting face and iris images to verify humanness was unnecessary and excessive because less privacy-intrusive alternative options were available.

   “the collection of face and iris images for such purpose was not necessary, and excessive, thereby contravening the requirements of DPP 1(1).” — Annex 1, Purposes of collecting personal data

2. Worldcoin collected personal data unfairly by failing to provide privacy notices in Chinese, failing to explain risks, and failing to verify age before scanning.

   “The PCPD considered that the collection of face and iris images under the above circumstances constituted an unfair collection which contravened DPP 1(2).” — Annex 1, Manner of personal data collection

3. Retaining sensitive biometric data for up to ten years to train artificial intelligence models was unjustified and constituted prolonged data retention.

   “The PCPD was therefore of the view that Worldcoin retained personal data of participants for prolonged period and contravened DPP 2(2).” — Annex 1, Retention of personal data

4. The Privacy Commissioner served an enforcement notice ordering Worldcoin Foundation to stop scanning and collecting iris and face images in Hong Kong.

   “The Privacy Commissioner has served an enforcement notice on Worldcoin Foundation , directing it to cease all operations of the Worldcoin project in Hong Kong” — Paragraph 11

In plain English

Following a proactive investigation launched in January 2024, Hong Kong's Office of the Privacy Commissioner for Personal Data completed its inquiry into the operations of the Worldcoin project. Between December 2023 and January 2024, the authority carried out 10 covert visits and executed court warrants on 31 January 2024 to enter 6 premises across Hong Kong. The investigation revealed that 8,302 individuals had their faces and irises scanned in Hong Kong to verify their humanness and receive free Worldcoin tokens. The Privacy Commissioner concluded that Worldcoin Foundation violated multiple personal data privacy principles. Specifically, the authority found that collecting face and iris images was unnecessary and excessive because less intrusive alternatives existed. Worldcoin also collected data unfairly, as its privacy notice and consent forms were not available in Chinese, device operators failed to explain risks or verify if participants were under 18, and participants were not properly informed about data usage or their rights. Furthermore, keeping sensitive biometric data for up to 10 years to train artificial intelligence models was found to be unjustified prolonged retention, and users lacked adequate means to access or correct their data. Consequently, the Privacy Commissioner served an enforcement notice on Worldcoin Foundation, ordering it to immediately cease all operations in Hong Kong that involve scanning and collecting the face and iris images of the public using iris scanning devices.