Worldcoin is a crypto/blockchain project that aims to create a global identity verification and financial network using iris scans as a unique identifier for its users ("proof of personhood"). Users who scan their irises with a device called the "Orb" receive a worldwide unique and irrevocable ID and free Worldcoin tokens, a digital currency. The Orbs are devices located in scanning centres operated by independent local service providers. The project was launched in 2023 by Sam Altman, the CEO of OpenAI, and has over four million users worldwide. However, Worldcoin has faced regulatory challenges and privacy concerns in various countries due to its collection and processing of biometric data.
One of the countries that has taken action against Worldcoin is Spain, where the data protection authority, AEPD, ordered the project to suspend its activities in the country. The AEPD issued a temporary ban, valid for up to three months, to stop Worldcoin from collecting and using personal data related to the iris scans. The AEPD based its decision on multiple complaints about Worldcoin, including providing insufficient information to users, collecting data from minors, and lacking a mechanism for users to withdraw consent. The AEPD also invoked "exceptional circumstances" to protect personal data and prevent irreparable harm to privacy rights.
The AEPD's intervention is in line with the GDPR, which requires a valid legal basis for processing personal data, especially sensitive data such as biometric data. Other European countries, such as Portugal, France and Germany, are also investigating Worldcoin's GDPR compliance, as well as the UK Information Commissioner's Office.
Worldcoin has denied any unlawful activity and expressed a willingness to engage with regulators and clarify its technology. The company's Data Protection Officer has claimed that the AEPD is circumventing EU law and spreading misleading claims. However, Worldcoin has also faced service suspensions and investigations in other countries, such as Kenya, India, Brazil, Argentina and Hong Kong, where the Privacy Commissioner for Personal Data raided six premises controlled by Worldcoin.
Worldcoin's mission and the novel method of identity verification have attracted public interest and curiosity, but also raised questions and doubts about the privacy and security of (sensitive) personal data.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
