Original author: PA Recommended reading
Original source: PANews
The Office of the Privacy Commissioner has completed its investigation into the Worldcoin project and announced its findings today (22nd). After considering the facts of the case and the information obtained from the investigation, Privacy Commissioner Chung Lai-ling ruled that the operation of Worldcoin in Hong Kong violated the data protection principles of the Privacy Ordinance regarding the collection, retention, transparency, access and correction of personal data, and required the Worldcoin project to stop collecting citizens' iris and facial images in Hong Kong using iris scanning devices.
The Privacy Commissioner's Office is concerned that the operation of "World Coin" in Hong Kong involves serious personal data privacy risks, so it took the initiative to launch an investigation into the "World Coin" project in January 2024. From December 2023 to January 2024, the Privacy Commissioner's Office conducted a total of 10 "snake" operations at the six operating points of "World Coin" in Hong Kong, and on January 31, 2024, with a court warrant, entered the six operating points of the "World Coin" project in Hong Kong located in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central and Causeway Bay for investigation. After two rounds of inquiries, the relevant investigation has been completed.
On January 31, 2024, the Privacy Commissioner's Office entered six operating locations of the "World Coin" project in Hong Kong for investigation with a court warrant.
On January 31, 2024, the Privacy Commissioner's Office entered six operating locations of the "World Coin" project in Hong Kong for investigation with a court warrant.
Officers of the Privacy Department entered six premises of WorldCoin with a court warrant to conduct investigations.
Privacy Commissioner Chung Lai-ling ruled that the operation of "WorldCoin" in Hong Kong violated the Privacy Ordinance.
The Privacy Commissioner has issued an enforcement notice to WorldCoin, requiring the project to stop collecting citizens' iris and facial images in Hong Kong using iris scanning devices.
The investigation found that people who participated in the "World Coin" project needed to allow the relevant organizations to collect their facial and iris images through iris scanning to "verify" their human identity and create an iris code, thereby obtaining a registered identity (i.e. World ID, which "World Coin" calls a digital passport) and can receive virtual currency "World Coin" for free on a regular basis. "World Coin" confirmed that a total of 8,302 people were authenticated by facial and iris scanning during its operation in Hong Kong.
Privacy Commissioner Chung Lai-ling ruled that the operation of WorldCoin in Hong Kong violated the data protection principles of the Privacy Ordinance regarding the collection, retention, transparency, access and correction of personal data, including:
Data Protection Principle 1(1) – The Privacy Commissioner’s Office considers that the collection of facial and iris images by the “World Coin” project is unnecessary and excessive, in violation of Data Protection Principle 1(1).
Data Protection Principle 1(2) - WorldCoin collects personal data unfairly. In particular, the relevant "Privacy Statement" and "Biometric Data Consent Form" not only lack Chinese versions, but the staff at the operation point also do not explain or confirm to participants that they understand the contents of the above documents, nor do they inform participants of the risks of disclosing their biometric data to them, or answer participants' questions.
Data Protection Principle 1(3) – Participants were not clearly informed of the information required to be informed under the law at or before the time of collection of personal data, including the purpose of the collection, whether it was mandatory or voluntary for them to provide their personal data, the categories of persons to whom the data could be transferred, and the rights and means by which the participants could access and correct their personal data.
Data Protection Principle 2(2) - WorldCoin will retain personal data for up to 10 years to train the artificial intelligence model for identity verification procedures. The Privacy Commissioner believes that this period is too long and constitutes excessive retention of personal data.
Data Protection Principle 5 - Insufficient transparency of policies and practices for processing personal data. At the relevant time, the "Privacy Statement" of "WorldCoin" was not available in Chinese. For participants whose native language is Chinese, the Privacy Commissioner's Office believes that participants cannot clearly understand the relevant policies, practices, terms or details, and therefore lack transparency.
Data Protection Principle 6 – Participants are unable to exercise their rights of access and correction of personal data.
The Privacy Commissioner has issued an enforcement notice to WorldCoin, requiring the project to stop collecting citizens' iris and facial images in Hong Kong using iris scanning devices.
