Worldcoin instructed to cease operations in Hong Kong

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has completed its inquiry into the Worldcoin project and determined that the project’s operations in Hong Kong violated the Personal Data (Privacy) Ordinance (PDPO). In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling issued an enforcement notice to Worldcoin, ordering the immediate cessation of all project operations in Hong Kong that involve scanning and collecting iris and facial images of the public using iris scanning devices. The PCPD launched its investigation into the Worldcoin project in January 2024 to assess whether the identity verification methods posed significant risks to individuals’ personal data privacy and contravened the requirements of the PDPO. Covert visits were conducted by the PCPD at six premises involved in operating the Worldcoin project from December 2023 to January 2024. The PCPD determined that collecting face images was unnecessary for verifying the authenticity of participants as the operators of the iris scanning devices were already able to perform this verification in person at the operating locations, rendering the scanning or collection of face images redundant. The PCPD also highlighted that Worldcoin failed to provide adequate information, hindering informed decision-making and genuine consent. The investigation revealed that Worldcoin’s privacy notice was not available in Chinese, making it impossible for non-English speakers to comprehend the project’s policies, practices, terms, and conditions. Consequently, the PCPD deemed the collection of face and iris images to be unfair and unlawful, violating data protection principles. The PCPD ruled that Worldcoin’s retention of sensitive biometric data, including face and iris images, for up to 10 years solely for AI model training purposes was unjustified. Worldcoin verified that 8,302 individuals had their faces and irises scanned for verification during its operation in Hong Kong. The project, which was unveiled in 2021, attracted over two million sign-ups before its official launch in July 2023. Due to privacy concerns, Worldcoin has faced regulatory scrutiny in multiple countries, resulting in the suspension of services in Kenya and the temporary suspension of iris scans in India.