“Unnecessary & Excessive” Worldcoin Ordered to Halt Operations in Hong Kong Over Privacy Violations

The Worldcoin cryptocurrency project, founded by OpenAI CEO Sam Altman, has been ordered to halt operations in Hong Kong after the city’s privacy watchdog found the project to be in violation of local privacy laws.

The Office of the Privacy Commissioner for Personal Data (PCPD) issued an enforcement notice on Wednesday, stating that Worldcoin’s collection of face and iris scans for identity verification was “unnecessary and excessive.”

TLDR

• Hong Kong’s privacy watchdog, the Office of the Privacy Commissioner for Personal Data (PCPD), has ordered the Worldcoin cryptocurrency project to halt operations in the city due to privacy law violations.
• The PCPD found that Worldcoin’s collection of face and iris scans for identity verification was “unnecessary and excessive,” breaching the city’s Personal Data (Privacy) Ordinance (PDPO).
• Worldcoin’s privacy notice was not available in Chinese, and staff did not provide adequate explanations or confirm participants’ understanding of the documents, leading to a lack of transparency and informed consent.
• The PCPD conducted 10 covert visits to six Worldcoin locations in Hong Kong and carried out investigations with court warrants before issuing the enforcement notice.
• Worldcoin’s plan to retain personal data, including face and iris images, for up to 10 years for AI model training was deemed unjustified and amounted to prolonged retention of personal data.

Worldcoin, which launched in July 2023, aims to provide users with a private digital identity called a “World ID” after scanning their unique iris patterns.

The project has faced scrutiny in several countries over concerns about the use of users’ personal data. In Hong Kong, the PCPD conducted an investigation involving 10 covert visits to six Worldcoin locations between December 2023 and January 2024, followed by searches with court warrants.

The watchdog found that Worldcoin’s operation in Hong Kong had scanned the faces and irises of more than 8,000 people, breaching multiple rules on the purpose and manner of data collection, as well as showing insufficient transparency.

The PCPD stated that there were “less privacy-intrusive means” for the group to verify the identity of participants and that the collection of face and iris images was unnecessary for confirming users’ “humanness.”

The PCPD discovered that Worldcoin’s privacy notice and biometric data consent form were not available in Chinese, and staff operating the iris scanning devices did not provide explanations or confirm participants’ understanding of the documents.

This lack of transparency meant that users were not given enough information to make an informed choice or provide genuine consent.

The watchdog also criticized Worldcoin’s plan to retain personal data, including face and iris images, for up to 10 years for training artificial intelligence models on how to verify users.

The PCPD considered this retention period to be too long and unjustified, amounting to prolonged retention of personal data.

Failing to comply with the enforcement notice can result in a maximum fine of HK$50,000 (approximately $6,400) and two years in prison. The PCPD has called on the public to report any iris scanning services operated by Worldcoin immediately.

In response to the enforcement notice, Worldcoin has removed all banners and logos from its office in Jordan, Hong Kong, as of Wednesday afternoon.

The project maintains that the personal data collected is encrypted and safe, despite being suspended over privacy concerns in countries such as Spain, Portugal, and Kenya.