Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its investigation into the Worldcoin project, determining that its operations in the city violated the Personal Data Privacy Ordinance (PDPO).

Privacy Commissioner Ada Chung Lai-ling issued an enforcement notice to Worldcoin, demanding an immediate cessation of all activities involving the scanning and collection of iris and facial images using iris scanning devices.

Investigation over Data Privacy Practices

The PCPD launched its investigation in January 2024 to assess whether Worldcoin’s identity verification methods posed significant risks to personal data privacy and complied with the PDPO’s requirements. The investigation involved ten covert visits to six Worldcoin operation sites from December 2023 to January 2024.

The investigation found that the collection of facial images was unnecessary for verifying the humanness of participants. Iris scanning device operators could perform this verification in person at the operation sites, making the additional step of scanning or collecting facial images redundant.

The PCPD also criticized Worldcoin for failing to provide sufficient information for participants to make informed decisions and give genuine consent. Notably, the project's privacy notice was not available in Chinese, preventing non-English speakers from understanding the project's policies, practices, and terms and conditions.

Moreover, the PCPD found Worldcoin’s retention of sensitive biometric data for up to 10 years solely for AI model training unjustified. The project had scanned the faces and irises of 8,302 individuals during its operation in Hong Kong. The PCPD deemed the collection of face and iris images unfair and unlawful, violating the data protection principles of the PDPO.

Global Scrutiny Intensifies

Worldcoin, launched in 2021 and boasting over two million global users, faces regulatory heat over privacy issues. Services were suspended in Kenya and iris scans paused in India.

Earlier, in Portugal, CNPD ordered a 90-day halt to biometric data collection, citing data protection concerns. Meanwhile, Spain's AEPD took action against Tools for Humanity Corporation within the framework of its Worldcoin project, citing complaints about inadequate information disclosure and data collection from minors.