Worldcoin fights Spanish regulator’s ban in court

After the Spanish data protection regulator temporarily banned Worldcoin from collecting personal information last week, the biometric-based cryptocurrency and proof-of-personhood project has hit back with a lawsuit against the agency.

Worldcoin developer Tools for Humanity announced on Friday that it filed a suit against the order from the Agencia Española de Protección de Datos (AEPD).

“It is unfortunate that the Spanish data protection authority (AEPD) is circumventing established procedures under GDPR with their actions today, which are limited to Spain and not the broader EU,” says Jannick Preiwisch, data protection officer at the Worldcoin Foundation.

“It is also unfortunate that they are spreading inaccurate and misleading claims about our technology globally after our efforts to provide them with an accurate view of Worldcoin and World ID have gone unanswered for months,” he adds.

The Spanish data protection authority ordered Worldcoin to stop collecting personal data by scanning irises and to stop using the data it had already collected for the next three months.

Worldcoin requested a stay on the order, pending a decision from the court. Spain’s High Court rejected the stay request today, Reuters reports, leaving the AEPD’s ban in place, at least for now. The court rejected an argument that blocking its operations could cause irreparable damage, because Worldcoin will be compensated for lost income if the court eventually decides in its favor.

The AEPD had used similar language to describe its own move.

“Our decision is justified to avoid potentially irreparable damage. Not taking action would have deprived people of the protection that they’re entitled to,” says AEPD Director Mar España Martí.

Preiwisch added that Worldcoin has been in “constant dialogue” with the Bavarian State Office for Data Protection Supervision (BayLDA) which is responsible for the oversight of the company’s GDPR compliance in the EU. Worldcoin, which has EU headquarters in the Bavarian city of Erlangen, is “disappointed that the Spanish regulator did not comply with applicable EU law,” he adds.

The German data watchdog originally launched an investigation into Worldcoin in November 2022 and has been testing Worldcoin since summer 2023 when its digital ID-linked cryptocurrency was launched.

“We assume that we will be able to communicate the preliminary results of the focus test in the next few weeks,” a BayLDA spokesperson told German news agency DPA.

Since July 2023, Worldcoin’s iris-scanning devices have the eyeballs of some 400,000 Spaniards who have been flocking to shopping centers to exchange their biometric data for cryptocurrency valued at around US$80, El Pais reports.

Much like in other parts of the world, Worldcoin’s popularity has been worrying both regulators and privacy advocates.

Ricard Martínez, director of Privacy and Digital Transformation at the University of Valencia, explained for El Pais that biometric data is considered a special category of data in European legislation. It can be captured either when Spanish legislation expressly allows it in certain cases, or when there’s consent.

“Spanish regulations say that, supposedly, in health and biometric data, you should be able to consent. But that doesn’t mean everything is possible. You could have the consent of the affected person and pursue an illegal or disproportionate activity, or violate a fundamental right. It’s more complicated than it seems.”

Other experts, such as data privacy lawyer Jorge García Herrero, allege that Worldcoin has been making “databases and images available to other algorithms” without disclosing the reason behind this.

Worldcoin says that its devices process and then delete iris images, creating an iris code, which is a numerical representation of the texture of an iris. Unless there is explicit user consent otherwise, a message containing the iris code is the only output stored from this process, the company adds.

The company is also attempting to burnish its privacy bona fides with an explanation of how it uses zero-knowledge proofs (ZKP). A video in which Worldcoin Foundation Head of Blockchain Remco Bloemen explains that ZKP represents a bigger breakthrough than the blockchain itself has been posted to LinkedIn.

Article Topics

AEPD  |  biometric data  |  data protection  |  GDPR  |  Spain  |  Tools for Humanity  |  World  |  zero knowledge