Worldcoin Faces Regulatory Hurdles in Hong Kong Over Privacy Concerns

Worldcoin, a cryptocurrency project spearheaded by Sam Altman, CEO of OpenAI, has been ordered to cease operations in Hong Kong due to severe privacy violations. The decision came after an extensive investigation by Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD), which found that the project’s practices of collecting and retaining sensitive biometric data were excessive and unjustified.

Worldcoin’s ambitious project aims to create a secure digital identity for users through unique iris patterns. Using an orb-like device, the project scans users’ eyes to generate a World ID, which can be used to access their mobile app and cryptocurrency platform accounts. However, this method of identity verification has sparked significant privacy concerns.

The PCPD launched an inquiry into Worldcoin’s operations in January 2024 to determine if the identity verification methods posed risks to citizens’ personal data privacy and if they complied with the Personal Data (Privacy) Ordinance (PDPO). The investigation included ten covert visits to six Worldcoin premises between December 2023 and January 2024. The premises were located in various districts, including Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay.

The investigation revealed that Worldcoin collected both face and iris images from participants, which the PCPD deemed unnecessary and excessive. According to the PCPD, the iris scanning devices operated by Worldcoin were already capable of verifying the “humanness” of participants without needing to collect facial images. Additionally, the PCPD criticized Worldcoin’s plan to retain this biometric data for up to ten years for AI model training purposes, considering this retention period excessively long and unjustified.

Moreover, the PCPD highlighted significant issues with Worldcoin’s transparency and consent processes. The privacy notice provided by Worldcoin was not available in Chinese, making it difficult for non-English speaking participants to understand the project’s policies, practices, terms, and conditions. The iris scanning device operators did not offer any explanation or ensure that participants understood the documents, nor did they inform participants of the possible risks associated with disclosing their biometric data.

In response to these findings, Privacy Commissioner Ada Chung Lai-ling issued an enforcement notice to Worldcoin, ordering the immediate halt of all operations involving the scanning and collecting of iris and facial images. Worldcoin confirmed that 8,302 individuals had their faces and irises scanned for verification during its operations in Hong Kong.

The PCPD’s enforcement notice is not the first regulatory challenge faced by Worldcoin. The project has also been suspended in Kenya and faced scrutiny in Spain, Portugal, and South Korea over similar privacy concerns.

The halt in operations represents a significant setback for Worldcoin, which has attracted over two million users globally, including more than 8,000 from Hong Kong. Despite the regulatory hurdles, Worldcoin continues to advocate for the security and encryption of the collected data.

In an attempt to address privacy concerns, Worldcoin announced plans to cease the collection of personal data and introduce a feature called “Personal Custody,” which would allow users to store their data on their own devices. However, these measures have yet to mitigate the regulatory scrutiny the project faces.