The Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its investigation into the Worldcoin project, finding that the project violated Hong Kong’s Personal Data (Privacy) Ordinance (PDPO).
In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling announced an enforcement action against Worldcoin, demanding an immediate cessation of all activities in Hong Kong involving the scanning and collection of iris and facial images from the public.
The investigation, which began in January 2024, aimed to assess whether Worldcoin’s identity verification methods posed significant risks to personal data privacy and violated PDPO requirements. The PCPD’s inquiry included 10 covert visits to six different locations operating the Worldcoin project between December 2023 and January 2024.
The findings revealed that collecting facial images was unnecessary for verifying the humanness of participants. The PCPD noted that operators of the iris scanning devices were already capable of verifying identities in person at the locations, rendering the additional collection of facial images superfluous.
Furthermore, the PCPD criticized Worldcoin for not providing sufficient information to allow participants to make informed decisions and give genuine consent. The investigation highlighted that Worldcoin’s privacy notice was not available in Chinese, limiting the understanding of the project’s policies, practices, terms, and conditions for non-English speaking participants.
As a result, the PCPD has ordered Worldcoin to halt all related operations in Hong Kong immediately to ensure compliance with local privacy laws.