Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has issued a cease and desist order to Worldcoin, directing the cryptocurrency project to suspend all operations within the region. The enforcement action comes in response to a damning inquiry that uncovered flagrant violations of the Personal Data (Privacy) Ordinance (PDPO), raising alarming concerns about the handling of biometric data and its implications for citizens’ privacy rights.

Privacy Commissioner Ada Chung Lai-ling delivered the enforcement notice on May 22, marking a significant escalation in the regulatory scrutiny surrounding Worldcoin’s activities in Hong Kong. The inquiry, initiated in January 2024, was prompted by mounting apprehensions over the potential risks posed by Worldcoin’s identity verification methods to the personal data privacy of Hong Kong residents.

During the investigative process, the PCPD conducted a series of covert visits spanning six premises associated with the Worldcoin project between December 2023 and January 2024. The findings of these visits painted a disturbing picture of systemic deficiencies in Worldcoin’s data collection practices, compelling regulators to take decisive action.

Central to the PCPD’s concerns was Worldcoin’s retention of sensitive biometric data, including iris and facial images, for a period of up to 10 years, purportedly for the sole purpose of training artificial intelligence (AI) models. This prolonged retention period, coupled with the indiscriminate collection of biometric information from the public using iris scanning devices, raised serious questions about the necessity and proportionality of Worldcoin’s data processing activities.

In its enforcement notice, the PCPD unequivocally demanded the immediate cessation of all project operations in Hong Kong involving the scanning and collection of iris and facial images. Commissioner Ada Chung Lai-ling underscored the paramount importance of upholding data protection principles and safeguarding individuals’ privacy rights in the face of emerging technologies.

The PCPD’s investigation further revealed troubling lapses in Worldcoin’s transparency and accountability measures, exacerbating the risks posed to data subjects’ privacy. Of particular concern was Worldcoin’s failure to provide adequate information to participants regarding the purpose and scope of data collection, hindering their ability to make informed decisions and provide genuine consent.

Moreover, the absence of a privacy notice in Chinese rendered Worldcoin’s policies and terms inaccessible to non-English speaking participants, exacerbating disparities in information accessibility and comprehension. This lack of linguistic inclusivity underscored broader challenges in ensuring equitable access to privacy protections in multicultural societies.

In a scathing indictment, the PCPD criticized Worldcoin’s operators for their failure to offer explanations or confirm participants’ understanding of key documents, including privacy notices and terms of service. The lack of transparency and engagement with data subjects further compounded the privacy risks associated with biometric data collection, rendering Worldcoin’s practices untenable under Hong Kong’s data protection framework.

As the cryptocurrency landscape continues to evolve at breakneck speed, regulatory authorities are grappling with the formidable task of balancing innovation with the protection of individuals’ privacy rights. The PCPD’s enforcement action against Worldcoin serves as a stark reminder of the critical importance of robust data protection measures and regulatory oversight in safeguarding citizens’ personal data in the digital age.

In response to the enforcement notice, Worldcoin has been compelled to suspend all operations in Hong Kong involving the scanning and collection of biometric data, signaling a significant setback for the project and a victory for data privacy advocates. However, the ramifications of this regulatory intervention extend far beyond Worldcoin, serving as a cautionary tale for cryptocurrency projects worldwide.

As stakeholders across the cryptocurrency ecosystem grapple with the implications of the PCPD’s enforcement action, the imperative to prioritize privacy by design and adopt responsible data practices has never been clearer. Only through concerted efforts to uphold privacy principles and adhere to regulatory requirements can the cryptocurrency industry earn the trust and confidence of users and regulators alike, paving the way for a more privacy-respectful and inclusive digital future.