Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has completed its investigation into the Worldcoin project and determined that the project’s activities in Hong Kong violated the Personal Data (Privacy) Ordinance (PDPO).
In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling issued an enforcement notice to Worldcoin, ordering them to immediately cease all project operations in Hong Kong that involve scanning and collecting iris and facial images of the public using iris scanning devices.
The PCPD initiated its investigation into the Worldcoin project in January 2024 to assess whether the identity verification methods posed significant risks to individuals’ personal data privacy and violated the requirements of the PDPO.
Between December 2023 and January 2024, the PCPD conducted 10 undercover visits to six premises involved in operating the Worldcoin project. The investigation revealed that collecting face images was unnecessary for verifying the identity of participants, as the operators of the iris scanning devices were already able to perform this verification in person at the operating locations. Therefore, the scanning or collection of face images was deemed an unnecessary step.
Additionally, the PCPD highlighted that Worldcoin failed to provide adequate information, which prevented individuals from making informed decisions and giving genuine consent. The privacy notice of Worldcoin was not available in Chinese, meaning that non-English speakers could not understand the project’s policies, practices, terms, and conditions. In light of these circumstances, the PCPD considered the collection of face and iris images to be unfair and unlawful, thus violating data protection principles.
Furthermore, the PCPD ruled that Worldcoin’s retention of sensitive biometric data, including face and iris images, for up to 10 years solely for AI model training, was unjustified.
Worldcoin confirmed that during its operation in Hong Kong, 8,302 individuals had their faces and irises scanned for verification. The project, which was announced in 2021 and garnered over two million sign-ups before its official launch in July 2023, has drawn the attention of regulators in various countries due to privacy concerns. As a result, services were suspended in Kenya and iris scans were paused in India.
Related:
Worldcoin enhances security by open-sourcing its biometric data system.
Can blockchain genuinely improve trust in AI? – A moral responsibility.