Iris-scanning Worldcoin crypto project contravenes Hong Kong’s privacy ordinance: watchdog

Cryptocurrency project Worldcoin, which collects and scans participants’ face and iris images, contravenes the Personal Data (Privacy) Ordinance in six aspects and has been ordered to cease all operations in the city, Hong Kong’s privacy watchdog announced on Wednesday. 

This came as the Office of the Privacy Commissioner for Personal Data released its findings today of an investigation into the project following commencement in January. 

Worldcoin has confirmed that there were 8,302 people with their faces and irises scanned for verification during its operation in Hong Kong. 

Upon completing the investigation, the Office found that the face and iris images collected by Worldcoin were unnecessary and excessive and that the project collected personal data unfairly, particularly as the relevant “Privacy Notice” and “Biometric Data Consent Form” were not available in Chinese. 

The Office noted that participants were not clearly informed of the information as specified under the Ordinance on or before the collection of personal data, including the purposes of collection and whether it was obligatory or voluntary for them to supply their personal data. 

The watchdog continued that the 10-year retention period for the purpose of training AI models for the user verification process was way too long. 

There was also insufficient transparency of the personal data policy and practices, and participants did not have the means to exercise their rights to data access and correction, the watchdog also said. 

“The Privacy Commissioner has served an enforcement notice on Worldcoin Foundation, directing it to cease all operations of the Worldcoin project in Hong Kong in scanning and collecting iris and face images of members of the public using iris scanning devices,” the Office said. 

“If the public notices that Worldcoin is still operating at any premises with the iris scanning devices in Hong Kong, please report the matter immediately to the PCPD by telephone at 2827 2827 or email at complaints@pcpd.org.hk for our enforcement actions,” commissioner Ada Chung Lai-ling said. 

A total of 10 covert visits were conducted from last December to this January at six premises located in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central and Causeway Bay. 

On January 31, the Office also entered the six premises with court warrants to carry out investigations and further conducted two rounds of inquiries afterwards.