Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its inquiry into the Worldcoin project, determining that its operations in Hong Kong violated its Personal Data (Privacy) Ordinance (PDPO).

In a May 22 notice, Privacy Commissioner Ada Chung Lai-ling issued an enforcement notice to Worldcoin, ordering the immediate halt of all project operations in Hong Kong that involve scanning and collecting iris and facial images of the public using iris scanning devices.

The PCPD started its investigation against the Worldcoin project in January 2024 to determine whether the identity verification methods posed serious risks to citizens’ personal data privacy and violated the requirements of the PDPO.

The PCPD conducted 10 covert visits at six premises involved in operating the Worldcoin project from December 2023 to January 2024.

According to the PCPD, collecting face images was unnecessary for verifying the humanness of participants, as the iris scanning device operators were already capable of performing this verification in person at the operating locations, making the scanning or collection of face images an unnecessary step.

The PCPD also pointed out that Worldcoin failed to provide sufficient information, preventing informed decisions and genuine consent.

The investigation revealed that Worldcoin’s privacy notice was unavailable in Chinese, which meant non-English speaking participants could not understand the project’s policies, practices, terms and conditions. The PCPD said: 

“ […] the iris scanning device operators at the operating locations also did not offer any explanation or confirmed the participants’ understanding of the aforesaid documents. They also did not inform the participants the possible risks pertaining to their disclosure of biometric data, nor answered their questions.”

Under these circumstances, the PCPD deemed the collection of face and iris images unfair and unlawful, violating its data protection principles.

Related: Worldcoin beefs up security by open-sourcing biometric data system

The PCPD ruled that Worldcoin’s retention of sensitive biometric data for up to 10 years solely for AI model training, including face and iris images, was unjustified.

Worldcoin confirmed that 8,302 individuals had their faces and irises scanned for verification during its operation in Hong Kong.

The project was announced in 2021, with more than two million people signing up before the project’s official launch in July 2023. Worldcoin has attracted the attention of regulators in many countries over privacy concerns, leading to the suspension of services in Kenya and the pausing of iris scans in India.

Magazine: ‘Moral responsibility’: Can blockchain really improve trust in AI?