Worldcoin ordered to stop operating in Hong Kong

Hong Kong’s privacy office has announced the results of its investigation into Worldcoin, and found that the iris biometrics project runs afoul of data privacy laws. A release from the Privacy Commissioner for Personal Data (PCPD) says that Worldcoin’s activities contravene several of Hong Kong’s Data Privacy Principles (DPP) and that “the face and iris images collected by the Worldcoin project were unnecessary and excessive.”

As a result, the commissioner has directed Worldcoin to cease all iris scanning operations in Hong Kong.

The fair collection of data is an issue for the PCPD, which claims that Worldcoin’s privacy and consent documents were not made available in Chinese. It also says Worldcoin operators were unhelpful, offering participants no explanation of the project or how their data would be used, and failing to answer questions when asked.

Also flagged is the maximum personal data retention period of ten years for the purposes of training AI. The PCPD “considered that the retention period was too long and amounted to prolonged retention of personal data.” As well, there were concerns that participants “did not have the means to exercise their rights of data access and correction.” The full results of the investigation are available here.

“Worldcoin Foundation is disappointed by the views recently released by the regulatory authorities in Hong Kong,” Worldcoin Foundation says in a statement shared with Biometric Update. “Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong, among many other similar statutes across other markets. In an effort to prepare humanity for the age of AI, the Foundation continues to raise the privacy bar through data minimization, user control over data and advanced technology such as personal custody, iris code deletion, and secure multi-party computation. Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process.”

For a while, regulators in various countries struggled to keep up with Worldcoin’s deployments of its biometric capture stations. The tide, however, appears to have turned, as Worldcoin rolls out new privacy commitments in pursuit of compliance and legality.

Worldcoin insists it takes privacy very, very seriously

A post on Worldcoin’s blog goes to lengths to point to “a non-exhaustive list of recent, demonstrable steps Worldcoin has taken in 2024 to increase transparency, enhance privacy and security and improve user choice and control at every level of the project.”

The list reads as a mix of tech branding and genuine commitment. They trumpet the implementation of “Personal Custody” for enhanced user data control. “With Personal Custody, all information used to create the iris code during World ID verification is held securely on an individual’s device. The information is never stored on the orb.”

A more fulsome explanation of Personal Custody on the Worldcoin website, however, suggests that while users may retain their data, it is not a cut-and-dried privacy solution – the same data was previously deleted – but rather a gateway to biometric use cases such as Worldcoin’s Face Authentication feature.

More clearly beneficial from a strict privacy perspective is giving users the option to unverify their World ID. “This includes the permanent deletion of their iris code or their encrypted SMPC iris code shares,” says the post. Worldcoin’s secure multi-party computation (SMPC) system encrypts iris codes, “divided into secret components” that by themselves do not reveal any personal information about any individual, then stores them in a decentralized manner.

These measures follow the Worldcoin Foundation’s open-sourcing the core components of the Orb’s hardware, biometric pipeline and software, the latter of which is publicly available on GitHub under an MIT/Apache 2.0 dual license.

Finally, says Worldcoin, it “engaged the respected security experts at Trail of Bits to conduct a specialized security and privacy audit of the orb’s software.”

Regardless of its efforts, the news out of Hong Kong will have Worldcoin scrambling to further explain itself to other governments that may take the PCPD’s decision as a cue. At time of writing, Worldcoin had not issued a public statement in response, but an article in CryptoSlate says a Worldcoin source expressed disappointment at the ban. And no wonder: since the news broke, Worldcoin’s cryptocurrency token, WLD, has dropped by about 5 percent.

Its efforts may also be driven by the emergence of competing schemes with similar visions for biometric digital identity.

The list of governments that have raised concerns about Worldcoin’s operations now includes Kenya, the UK, France, Germany, Mexico, South Korea, Argentina, Portugal and Spain – still relatively few, considering the company has already amassed 10 million users in 160 countries.

Article Topics

biometric data  |  data privacy  |  data protection  |  digital ID  |  face biometrics  |  Hong Kong  |  iris biometrics  |  World