Worldcoin, a project initiated by Sam Altman, the creator of ChatGPT, has faced repeated obstacles in overcoming privacy regulations. Recently, Worldcoin was ruled to have violated the Privacy Ordinance in Hong Kong and was forced to cease collecting users’ iris and facial images.
Worldcoin utilizes iris scanning technology for human identity verification. According to the official website, over 5 million people from more than 160 countries have already undergone verification.
Due to the serious privacy concerns associated with collecting iris data, the Office of the Privacy Commissioner for Personal Data in Hong Kong revealed that between December 2023 and January 2024, they conducted 10 undercover operations, known as “snake releases,” at six Worldcoin operating locations in Hong Kong, including Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay. On January 31, 2024, they obtained a court order to investigate the operating locations and, after two rounds of questioning, concluded all relevant investigations.
Based on the investigation results, Privacy Commissioner for Personal Data, Ada Chung, ruled that Worldcoin’s operations in Hong Kong violated the Privacy Ordinance.
Further reading:
Foreign media: Worldcoin may collaborate with OpenAI and PayPal! If true, will it raise more regulatory concerns?
Worldcoin’s collection of facial and iris images deemed unnecessary
The Privacy Commissioner’s Office believes that Worldcoin’s project does not require the collection of facial and iris images because verifying whether a user is human does not necessitate iris scanning. On-site evaluation by staff members at the operating locations is sufficient.
Furthermore, biometric data is considered sensitive personal information, and if improperly used or disclosed, it can lead to serious consequences. The office believes that facial and iris images are not necessary when there are less invasive methods of verification available.
Lack of important information in Chinese, failure to proactively inform the public of risks
Additionally, the Privacy Statement and Biometric Data Consent Form for Worldcoin not only lack Chinese versions but also fail to be explained or confirmed by staff members at the operating locations to participants, nor do they inform the public of the risks of providing biometric data to the project or address their questions.
Excessive retention of personal data
During the investigation, it was discovered that Worldcoin retains personal data for up to 10 years to train the AI models for identity verification. The Privacy Commissioner’s Office considers this to be an excessively long duration of data retention.
The Privacy Commissioner in Hong Kong has issued an enforcement notice to Worldcoin, demanding that the project cease collecting the iris and facial images of Hong Kong residents using iris scanning devices. The Office of the Privacy Commissioner for Personal Data in Hong Kong stated that if any individuals discover the continued operation of iris scanning devices at Worldcoin’s locations, they can directly report it, prompting the office to take enforcement actions. Therefore, Worldcoin is currently in a “banned” state in Hong Kong.
Sources:
CoinDesk, PCPD, Reuters