Worldcoin Stumbles in Hong Kong? Privacy Commissioner Rules Worldcoin Violates Privacy Ordinance, Orders Halt to Collection of Citizens' Iris and Facial Images

The Office of the Privacy Commissioner for Personal Data (PCPD) has completed its investigation into the "Worldcoin" project, stating that Worldcoin violates privacy regulations. PCPD image

Source: Sing Tao Daily

The PCPD has completed its investigation into the Worldcoin project and released the findings today (22nd). After considering the facts of the case and the information obtained during the investigation, Privacy Commissioner Ada Chung Lai-ling ruled that Worldcoin's operations in Hong Kong violate the Personal Data (Privacy) Ordinance regarding the collection, retention, transparency, access, and correction of personal data. The PCPD has ordered the Worldcoin project to cease collecting iris and facial images of Hong Kong citizens using iris scanning devices.

The PCPD is concerned that Worldcoin's operations in Hong Kong pose significant personal data privacy risks. Therefore, it proactively initiated an investigation into the Worldcoin project in January 2024. Between December 2023 and January 2024, the PCPD conducted 10 undercover operations at six Worldcoin operation points in Hong Kong. On January 31, 2024, armed with a court warrant, the PCPD entered the six operation points located in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay to conduct the investigation. After two rounds of inquiries, the investigation has now been completed.

On January 31, 2024, the PCPD entered six Worldcoin operation points in Hong Kong with a court warrant to conduct the investigation.

On January 31, 2024, the PCPD entered six Worldcoin operation points in Hong Kong with a court warrant to conduct the investigation.

PCPD officers entered six Worldcoin premises with a court warrant to conduct the investigation.

Privacy Commissioner Ada Chung Lai-ling ruled that Worldcoin's operations in Hong Kong violate the Personal Data (Privacy) Ordinance. File photo

The Privacy Commissioner has issued an enforcement notice to Worldcoin, requiring the project to cease collecting iris and facial images of Hong Kong citizens using iris scanning devices.

The investigation found that participants in the Worldcoin project had to allow the organization to collect their facial and iris images through iris scanning to "verify" human identity and create iris codes, thereby obtaining a registered identity (i.e., World ID, which Worldcoin refers to as a digital passport). Participants could then periodically receive free virtual currency "Worldcoin." Worldcoin confirmed that during its operations in Hong Kong, it conducted facial and iris scan verifications for 8,302 individuals.

Privacy Commissioner Ada Chung Lai-ling ruled that Worldcoin's operations in Hong Kong violate the Personal Data (Privacy) Ordinance regarding the collection, retention, transparency, access, and correction of personal data, including:

• Data Protection Principle 1(1) – The PCPD believes that the collection of facial and iris images by the Worldcoin project is unnecessary and excessive, violating the provisions of Data Protection Principle 1(1).
• Data Protection Principle 1(2) – Worldcoin unfairly collects personal data, particularly as the relevant Privacy Statement and Biometric Data Consent Form lack a Chinese version. Additionally, staff at the operation points do not explain or confirm that participants understand the content of these documents, nor do they inform participants of the risks of disclosing biometric data or answer their questions.
• Data Protection Principle 1(3) – Participants were not clearly informed of the legally required information at or before the time of data collection, including the purpose of collecting personal data, whether they are obligated or can voluntarily provide their personal data, to whom the data may be transferred, and their rights and means to access and correct their personal data.
• Data Protection Principle 2(2) – Worldcoin retains personal data for up to 10 years to train AI models for identity verification processes. The PCPD considers this retention period excessively long.
• Data Protection Principle 5 – Insufficient transparency in the policies and practices for handling personal data. At the relevant time, Worldcoin's Privacy Statement did not provide a Chinese version, making it difficult for participants whose native language is Chinese to clearly understand the relevant policies, practices, terms, or conditions, thus lacking transparency.
• Data Protection Principle 6 – Participants were unable to exercise their rights to access and correct their personal data.

The Privacy Commissioner has issued an enforcement notice to Worldcoin, requiring the project to cease collecting iris and facial images of Hong Kong citizens using iris scanning devices.