Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its inquiry into the Worldcoin project. It has been determined that Worldcoin’s operations in Hong Kong violated the Privacy Ordinance.
In a May 22 notice, the Privacy Commissioner, Chung Liling, issued an enforcement notice to the Worldcoin Foundation, ordering the immediate halt of all Worldcoin project operations in Hong Kong that involve scanning and collecting iris and facial images of the public using iris scanning devices.
The PCPD commenced an investigation against the Worldcoin project in January 2024 to determine whether the identity verification project Worldcoin posed serious risks to citizens’ personal data privacy and violated the requirements of the Personal Data (Privacy) Ordinance.
This was after the PCPD conducted 10 covert visits at six premises involved in operating the Worldcoin project from December 2023 to January 2024.
According to the PCPD, collecting face images was unnecessary for verifying the humanness of participants, as the iris scanning device operators were already capable of performing this verification in person at the operating locations, making the scanning or collection of face images an unnecessary step.
The PCPD also pointed out that Worldcoin failed to provide sufficient information, preventing informed decisions and genuine consent.
The investigation revealed that Worldcoin’s Privacy Notice was unavailable in Chinese, which meant non-English speaking participants could not understand the project’s policies, practices, terms, and conditions. The PCPD said:
“ …the iris scanning device operators at the operating locations also did not offer any explanation or confirmed the participants’ understanding of the aforesaid documents. They also did not inform the participants the possible risks pertaining to their disclosure of biometric data, nor answered their questions.”
Under these circumstances, the PCPD deemed the collection of face and iris images unfair and unlawful, violating the Data Protection Principle (DPP) 1(2).
Related: Worldcoin beefs up security by open-sourcing biometric data system
According to the investigation, the PCPD ruled that Worldcoin’s retention of sensitive biometric data, including face and iris images, for up to 10 years solely for AI model training was unjustified.
Worldcoin confirmed that 8,302 individuals had their faces and irises scanned for verification during its operation in Hong Kong.
Worldcoin announced its start in 2021, with more than two million people signing up before the project’s official launch in July 2023. The project has drawn the attention of many countries’ regulators over privacy concerns, leading to the suspension of services in Kenya and the pausing of iris scans in India.
Magazine: ‘Moral responsibility’: Can blockchain really improve trust in AI?