Hong Kong Orders Worldcoin to Cease Operations

Key takeaways:

• After completing its investigation of the Worldcoin project, Hong Kong’s Office of the PCPD found that the project’s activities in Hong Kong violated the PDPO.
• From December 2023 to January 2024, the PCPD made ten surreptitious inspections to six locations that are important to the Worldcoin project’s operation.

After completing its investigation of the Worldcoin project, Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) found that the project’s activities in Hong Kong were in violation of the Personal Data (Privacy) Ordinance (PDPO).

Privacy Commissioner Ada Chung Lai-ling served Worldcoin with an enforcement notice on May 22. The notice directed Worldcoin to immediately cease all project operations in Hong Kong that entail the use of iris scanning devices to scan and collect public faces and iris images.

In January 2024, the PCPD began its investigation against the Worldcoin project to ascertain whether the identity verification procedures breached the PDPO’s regulations and constituted a substantial risk to people’s privacy over their personal data.

From December 2023 to January 2024, the PCPD made ten surreptitious inspections to six locations that are important to the Worldcoin project’s operation.

The iris scanning device operators could already verify the humanness of participants in person at the operating locations, so the PCPD claimed that gathering face images was not necessary for this purpose. Therefore, scanning or collecting face images was deemed unnecessary.

Additionally, the PCPD noted that Worldcoin’s inadequate disclosure of facts hindered decision-making and true consent.

According to the report, individuals who did not know English were unable to comprehend the project’s rules, procedures, terms, and conditions because Worldcoin’s privacy notice was not available in Chinese. According to the PCPD: 

“iris scanning device operators at the operating locations also did not offer any explanation or confirmed the participants’ understanding of the aforesaid documents”

In these conditions, the PCPD determined that acquiring iris and face photos was unjust and illegal, going against its data protection principles.

According to the PCPD, it was unreasonable for Worldcoin to keep sensitive biometric information, such as face and iris photos, for up to ten years purely for the purpose of training AI models.

Worldcoin verified that 8,302 people had their irises and features checked for identity during its Hong Kong operation.

More than two million individuals signed up for the initiative when it was revealed in 2021 and before it officially launched in July of 2023. Because of privacy issues, Worldcoin has drawn the attention of regulators in several nations, causing services to be suspended in Kenya and iris scans to be halted in India.