Hong Kong Cracks Down on Worldcoin for Unlawful Biometric Data Collection

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its investigation into the Worldcoin project, finding that the project’s biometric data collection practices violated the Personal Data (Privacy) Ordinance (PDPO). In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling mandated an immediate stop to all Worldcoin operations in Hong Kong involving the collection of iris and facial images.

The PCPD’s investigation, which began in January 2024, sought to assess whether Worldcoin’s identity verification methods posed significant risks to personal data privacy and compliance with the PDPO. During the probe, the PCPD conducted 10 undercover visits to six Worldcoin operation sites between December 2023 and January 2024.

Worldcoin Ordered to Cease Operations

The investigation found that the collection of facial images was unnecessary for confirming the humanness of participants, as this verification could be done in person by the operators at the locations. The PCPD criticized Worldcoin for failing to provide adequate information, thereby preventing participants from making informed decisions and giving genuine consent.

One key issue was that Worldcoin’s privacy notice was not available in Chinese, leaving non-English speakers unable to comprehend the project’s policies, practices, terms, and conditions. Furthermore, the operators at the scanning sites did not adequately explain the documents to participants or confirm their understanding, nor did they inform participants of the potential risks associated with sharing their biometric data.

Given these circumstances, the PCPD concluded that the collection of facial and iris images was both unfair and unlawful, violating Hong Kong’s data protection principles. Additionally, the retention of this sensitive biometric data for up to ten years for AI model training purposes was deemed unjustifiable.

Worldcoin disclosed that during its operations in Hong Kong, 8,302 individuals had their facial and iris images scanned for verification. The project, launched in 2021, garnered over two million sign-ups before its official launch in July 2023. However, Worldcoin has faced scrutiny from regulators worldwide over privacy concerns, leading to the suspension of its services in Kenya and a halt to iris scans in India.