Hong Kong Orders Worldcoin to Stop

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has directed Worldcoin, a crypto project co-founded by OpenAI CEO Sam Altman, to cease operations. This decision ended an investigation that began in January 2024.

Earlier this year, the PCPD announced it was investigating Worldcoin, citing a potential “risk to personal data privacy.” The Privacy Commission examined six Worldcoin sites in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay. Privacy Commissioner Ada Chung Lai-ling found that Worldcoin breached Data Protection Principles (DPPs) related to data collection, retention, transparency, and correction rights.

Worldcoin used iris scanning to verify identities for its cryptocurrency, WLD. The investigation revealed that participants had to allow the collection of their facial and iris images in an “unnecessary and excessive” manner. Worldcoin confirmed that 8,302 people had their faces and irises scanned. The PCPD stated this data collection was “unfair” because important policies were not provided in Chinese:

“The relevant ‘Privacy Notice’ and ‘Biometric Data Consent Form’ were not available in Chinese,” the PCPD noted. “Operators did not explain or confirm participants’ understanding of these documents.”

The Privacy Commission highlighted insufficient transparency for Chinese-speaking users, making it difficult for them to understand and consent. Additionally, the PCPD said Worldcoin did not inform participants of the risks of sharing biometric data or answer their questions. This violated the Personal Data Privacy Ordinance (PDPO) because participants couldn’t exercise their data access and correction rights.

Based on these findings, the commission ordered an immediate stop to Worldcoin’s activities involving the scanning and collecting of iris and facial images in Hong Kong. Hong Kong’s action is one of many challenges Worldcoin faces globally. Since its launch, the project has been scrutinized by regulators in Germany, France, and Kenya.

In response, the Worldcoin Foundation introduced a new open-source system to address regulatory concerns. This system aims to implement advanced data protection measures to better “safeguard sensitive information.”

Worldcoin has enhanced security through secure multi-party computation (SMPC), distributing data across various locations. As part of this, Worldcoin has deleted the iris codes obtained during user registration.

The new approach aims to address concerns about data storage, scalability, and cost, reducing the risk of security breaches. By improving data protection, Worldcoin hopes to regain trust and comply with international regulations.

The halting of Worldcoin’s operations by the Hong Kong Privacy Commission underscores the growing scrutiny of digital identity projects worldwide. The PCPD’s decision highlights the importance of transparency and user consent in data collection. As Worldcoin implements new security measures, it remains to be seen if these changes will satisfy regulators and restore public confidence.