Hong Kong Cracks Down on Worldcoin's Data Collection Practices

The Hong Kong Privacy Commissioner's Office (PCPD) has found that Worldcoin, a cryptocurrency project that utilizes face and iris scans for user verification, has violated the city's Personal Data (Privacy) Ordinance (PDPO), according to a statement on Wednesday.

The PCPD said it launched an investigation into Worldcoin's data collection practices earlier this year, after concerns were raised about the project's collection of sensitive biometric data, including face and iris scans. The investigation revealed that Worldcoin failed to adequately inform users about the collection of their personal data and did not obtain their informed consent.

According to the statement, Worldcoin confirmed that 8,302 individuals had their faces and irises scanned for verification during its operation in Hong Kong. In return, participants would be able to receive Worldcoin (WLD) tokens at regular intervals for free.

"The operation of Worldcoin in Hong Kong had contravened the Data Protection Principles (DPPs) in Schedule 1 to the PDPO relating to the collection, retention, transparency, data access and correction rights," the statement said.

Furthermore, the PCPD found that Worldcoin retained user data for extended periods beyond what was necessary and neglected to provide a Chinese translation of its privacy policy, in contravention of the PDPO's language requirements.

As a consequence of these violations, the PCPD has served an enforcement notice on the Worldcoin Foundation, directing it to cease all operations of the Worldcoin project in Hong Kong in scanning and collecting iris and face images of members of the public using iris scanning devices.

Update (24 May): Worldcoin Foundation shared the following comments with Blockhead: "Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong, among many other similar statutes across other markets. In an effort to prepare humanity for the age of AI, the Foundation continues to raise the privacy bar through data minimization, user control over data and advanced technology such as personal custody, iris code deletion, and secure multi-party computation. Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process.”