Crypto barred for 'unfair' facial, iris data collection

Cryptocurrency project Worldcoin has been ordered to close in Hong Kong after the privacy watchdog found it violated the Personal Data (Privacy) Ordinance by collecting facial and iris images.

Worldcoin, founded by OpenAI's chief Sam Altman in 2019, collects iris information in exchange for a digital ID to distinguish between humans and robots online.

The project triggered privacy concerns around the world, with several countries considering bans.

The Privacy Commissioner for Personal Data said yesterday that Worldcoin had conducted facial and iris scanning of 8,302 people in Hong Kong and collected unnecessary information "unfairly."

The watchdog said it carried out 10 covert visits from December last year to January at six Worldcoin premises - Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central and Causeway Bay - and searched the venues with court warrants on January 31.

An investigation revealed that participants had to have their face and iris images scanned to verify they were human and to generate codes. They then obtained a "digital passport" called World ID and received Worldcoin tokens at regular intervals for free.

Privacy commissioner Ada Chung Lai-ling found that Worldcoin's operation in Hong Kong contravened the data-protection principles relating to data collection, retention, transparency, data access, and correction rights.

She also said that the face and iris images collected by Worldcoin were unnecessary and excessive and were done "unfairly."

The watchdog added: "The relevant 'privacy notice' and 'biometric data consent form' were not available in Chinese, and the scanning device operators at the operating locations also did not offer any explanation or confirm the participants' understanding of the documents.

"They also did not inform the participants of the possible risks on their disclosure of biometric data, nor answer their questions."

The watchdog added the project failed to inform participants of the purpose of data collection, whether it was obligatory or voluntary, or who may obtain it.

"Worldcoin would retain personal data for a maximum of 10 years to train AI models for the user-verification process. The privacy commissioner considered that the retention period was too long," it said, adding participants did not have the means to exercise their rights of data access and correction.

The watchdog has issued an enforcement notice to the Worldcoin Foundation, requiring it to cease all operations in the city and stop scanning and collecting iris and facial images.

In response, the Worldcoin Foundation said it is “disappointed” by the PCPD’s decision, adding it operates lawfully.

“In an effort to prepare humanity for the age of AI, the foundation continues to raise the privacy bar through data minimization, user control over data and advanced technology such as personal custody, iris code deletion, and secure multi-party computation,” it said,

“Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process.”

wallis.wang@singtaonewscorp.com