The Privacy Commissioner's Office has completed an investigation into the "World Coin" project, indicating that World Coin has violated the privacy regulations. Privacy Commissioner's Office image.

Source: Sing Tao Daily

The Privacy Commissioner's Office has completed its investigation into the Worldcoin project and released the investigation results today (22nd). After considering the facts of the case and the information obtained from the investigation, Privacy Commissioner Elaine Lo ruled that the operation of Worldcoin in Hong Kong violates the principles of collecting, retaining, transparency, access, and correction of personal data under the Personal Data (Privacy) Ordinance. She has requested the Worldcoin project to stop collecting the iris and facial images of Hong Kong residents using iris scanning devices.

The Office of the Privacy Commissioner for Personal Data (PCPD) has followed up on the operation of "World Coin" in Hong Kong, which involves serious privacy risks. Therefore, an investigation into the "World Coin" project was voluntarily initiated in January 2024. Between December 2023 and January 2024, the PCPD conducted a total of 10 "sting" operations at six operational locations of "World Coin" in Hong Kong. On January 31, 2024, with a court order, the PCPD entered the six operational locations of the "World Coin" project in Hong Kong, located in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay, to conduct the investigation. After two rounds of questioning, the investigation has now been completed.

The Office of the Privacy Commissioner for Personal Data (PCPD) obtained a court order on January 31, 2024 to conduct an investigation into the "World Coin" project at its six operational locations in Hong Kong.

On 31 January 2024, the PCPD, with a court warrant, entered six locations of the World Coin project in Hong Kong to conduct an investigation.

The Privacy Commissioner's staff entered six locations with a court order to conduct an investigation into "World Coin".

Privacy Commissioner Clara Cheung has ruled that the operation of "World Coin" in Hong Kong violates the Personal Data (Privacy) Ordinance. Stock photo.

The Privacy Commissioner has issued an enforcement notice to "Worldcoin", requesting the project to stop collecting the iris and facial images of Hong Kong residents using iris scanning devices.

The investigation found that participants in the "World Coin" project need to have their facial and iris images scanned by relevant institutions through iris scanning to "verify" their human identity and create iris codes, in order to obtain a registered identity (known as World ID, a digital passport in World Coin) and receive virtual currency "World Coin" regularly for free. "World Coin" has confirmed that during its operation in Hong Kong, facial and iris scanning authentication has been conducted for a total of 8,302 individuals.

The Privacy Commissioner, Elizabeth Denham, ruled that the operation of "Worldcoin" in Hong Kong violates the principles of the Personal Data (Privacy) Ordinance, including the collection, retention, transparency, access, and correction of personal data.

• Principle of minimality of data protection - The Privacy Commissioner's Office believes that the collection of facial and iris images by the "World Coin" project is not necessary and excessive, which violates the principle of minimality of data protection.
• Principle of protecting personal data 1(2) - "World Coin" unfairly collects personal data, especially the content of the "Privacy Statement" and "Biometric Data Consent Form" lacks a Chinese version, and the staff of the operation point will not explain or confirm to the participants that they understand the content of the above documents, nor will they inform the participants of the risks of disclosing biometric data or answer the participants' questions.
• DPP 1(3) – Participants have not been clearly informed of the information required by law on or before the time of collection of personal data, including the purposes for which the personal data is collected, the classes of persons to whom they are obliged or voluntarily to provide their personal data, the classes of persons to whom the data may be transferred, and the rights and means of access and correction of the personal data of the participants.
• Principle of Data Protection No. 2(2) - "World Coin" will retain personal data for up to 10 years for training the AI model for identity verification procedures. The Privacy Commissioner's Office considers this to be an excessive retention of personal data.
• Insufficient Transparency on the Fifth Principle of Data Protection - The privacy statement of Gate.io does not provide a Chinese version at the relevant time. For participants whose native language is Chinese, the Office of the Privacy Commissioner considers that they are unable to clearly understand the relevant policies, practices, terms, or provisions, thus resulting in insufficient transparency.
• Principle 6 of data protection - Participants are unable to exercise their rights to access and correct personal information.

The Privacy Commissioner has issued an enforcement notice to "World Coin", requesting the project to stop collecting the iris and facial images of Hong Kong residents using iris scanning devices.