The Worldcoin cryptocurrency project, established by OpenAI CEO Sam Altman, has been found in breach of Hong Kong’s privacy regulations, according to the city’s privacy watchdog. The Privacy Commissioner for Personal Data (PCPD) declared on Wednesday that the project’s requirement for “unnecessary and excessive” scans of users’ eyes and faces contravenes local privacy laws.
Worldcoin, launched in July of the previous year, aims to provide users with a private digital identity—a “World ID”—by scanning their unique iris patterns. Despite its ambitious goals, the project has encountered resistance in several countries over concerns related to the handling and protection of personal data.
Hong Kong’s PCPD issued an enforcement notice to Worldcoin, demanding an immediate halt to the scanning and collection of iris and facial images within the city. “The collection of face and iris images for verification purposes was not necessary and excessive,” stated the PCPD, emphasizing that any potential data leaks could have “grave consequences.”
To date, more than five million individuals have registered for a “World ID,” and 137 million of the project’s crypto tokens have been claimed across more than 160 countries, Worldcoin reported last month. In Hong Kong alone, the faces and irises of over 8,000 people have been scanned as part of the project, according to the PCPD.
The privacy watchdog’s investigation highlighted multiple violations of Hong Kong’s data collection rules by Worldcoin, citing insufficient transparency regarding the purpose and method of data collection. The PCPD criticized the project for not providing users with adequate information to make informed choices or give genuine consent. Furthermore, the planned retention period of up to 10 years for the collected data was deemed “prolonged” and “not justified.”
The investigation into Worldcoin’s activities in Hong Kong involved 10 covert visits to six different locations starting in December, followed by searches conducted under court warrants. The findings led to the enforcement notice, which, if ignored, could result in a maximum fine of HK$50,000 (S$8,633) and up to two years in prison.
An AFP request for comment from Worldcoin remains unanswered.
Worldcoin has faced similar suspensions in countries like Spain, Portugal, and Kenya due to privacy concerns. Nevertheless, the project asserts that all personal data collected is encrypted and securely stored, aiming to reassure users and regulatory bodies alike.
The ongoing scrutiny of Worldcoin underscores the challenges and regulatory hurdles that emerging technologies and cryptocurrency projects face in balancing innovative ambitions with stringent privacy and data protection standards. As Worldcoin navigates these issues, the case in Hong Kong serves as a significant reminder of the critical importance of transparency and user consent in data collection practices.
