The Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its investigation into the Worldcoin project, finding it in violation of Hong Kong’s Personal Data (Privacy) Ordinance (PDPO).
Concerns over the privacy risks posed by Worldcoin’s operations in Hong Kong led the PCPD to initiate the investigation in January 2024.
Worldcoin, a cryptocurrency project developed by OpenAI CEO Sam Altman, aims to promote digital identification through iris scanning technology.
Since its launch over nine months ago, the project has attracted over 10 million users globally, including 8,302 participants in Hong Kong who had their facial and iris images scanned.
The investigation findings revealed that participants of the Worldcoin project needed to allow the relevant organisations to collect their face and iris images through iris scanning to verify their humanness and generate iris codes.
This process provided them with a registered identity, known as a World ID or digital passport, after which they would be able to receive Worldcoin tokens, a cryptocurrency, at regular intervals for free.
The PCPD conducted covert visits to six Worldcoin operation sites across Hong Kong between December 2023 and January 2024, followed by court-warranted investigations.
The findings revealed that Worldcoin’s data collection practices were excessive and unnecessary, failing to comply with several Data Protection Principles (DPPs) under the PDPO.
The data collection practices were deemed unfair, particularly due to the insufficient explanation of privacy risks to participants and the lack of Chinese language support.
Participants were not adequately informed about the purposes of data collection, their rights, or whether the provision of personal data was obligatory or voluntary.
The investigation also highlighted the prolonged retention of personal data for up to 10 years, which was considered excessive.
Additionally, transparency issues were noted, as participants using Chinese as their native language could not clearly understand the relevant policies and practices.
Lastly, the investigation found that participants lacked the means to exercise their rights to access and correct their data.
As a result of these findings, the Privacy Commissioner has issued an enforcement notice to Worldcoin Foundation, ordering the cessation of all iris and face image collection operations in Hong Kong.
The Privacy Commissioner, Ada Chung Lai-ling said,
“If members of the public notices that Worldcoin is still operating at any premises with the iris scanning devices in Hong Kong, please report the matter immediately to the PCPD (telephone: 2827 2827 or email: complaints@pcpd.org.hk) for our enforcement actions.
In addition, if members of the public have any queries about the handling of their registered World ID, they can inquire with relevant organisation and the PCPD (telephone: 2827 2827 or email: communications@pcpd.org.hk).”
