Hong Kong’s privacy authority has mandated the immediate cessation of the Worldcoin Foundation’s operations in the region, claiming breaches of local privacy laws. The Privacy Commissioner for Personal Data (PCPD) discovered that Worldcoin, spearheaded by OpenAI chief executive Sam Altman, compromised the facial and iris recognition data of over 8,300 people.
In its detailed findings, the PCPD stated that the data collection methods employed by Worldcoin were both “unnecessary and excessive,” thereby contradicting the Personal Data (Privacy) Ordinance of Hong Kong.
According to the PCPD, collecting face images was unnecessary for verifying the humanness of participants, as the iris scanning device operators were already capable of performing this verification in person at the operating locations, making the scanning or collection of face images an unnecessary step.
The report also criticized the need for more transparency in Worldcoin’s processes. It highlighted that privacy notices and consent forms were not provided in Chinese, and participants needed to be better explained about these documents.
Further issues included the extended retention of personal data, up to ten years, which exceeded what was deemed reasonable. Additionally, Worldcoin failed to inform participants about their rights to access and correct their data, prompting the Privacy Commissioner, Ada Chung, to issue an enforcement notice.
The order requires Worldcoin to cease all biometric data collection in Hong Kong, a decision echoed by similar actions in other regions, including South Korea, Portugal, and Kenya, where Worldcoin has also faced scrutiny. As of now, Worldcoin has yet to respond publicly to the enforcement notice.
However, Worldcoin shared with The Crypto Times that the Wordcoin Foundation is disappointed by the approach of the Hong Kong regulatory authority. They further said, “Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong, among many other similar statutes across other markets.”
The foundation continues to raise the privacy bar through data minimization, user control over data, and advanced technology such as personal custody, iris code deletion, and secure multi-party computation. Unfortunately, the authorities in Hong Kong “overlooked these aspects in their evaluation of the humanness verification process.”
