Worldcoin, a cryptocurrency project launched by OpenAI CEO Sam Altman, promised universal access to the global economy through a unique verification system: iris scanning.
However, the project faces increasing global sanctions due to potential privacy risks since launch.
Countries like France, India, Hong Kong, and Brazil have banned Worldcoin transactions and iris registrations, citing the unpredictable use of iris data and hacking vulnerabilities.
Worldcoin maintains that captured iris images are encrypted and deleted immediately, eliminating the possibility of data leaks.
This time, its operations in Hong Kong were abruptly halted in May 2024 after the city's privacy watchdog, the Office of the Privacy Commissioner for Personal Data (PCPD), found them to be in violation of the Personal Data (Privacy) Ordinance (PDPO).
The PCPD launched an investigation into Worldcoin in December 2023 following concerns about the project's data collection practices.
The PCPD executed search warrants on 31 January 2024, at six locations associated with the Worldcoin project to conduct investigations. (Source: Privacy Commissioner for Personal Data)
Investigators conducted undercover visits to six Worldcoin project locations across Hong Kong, including Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central, and Causeway Bay.
They even obtained court warrants to gain access to the premises for further inspection.
The investigation revealed that Worldcoin collected iris scans and facial images from participants during registration. This data collection process raised several red flags for the PCPD.
According to the privacy commissioner, Worldcoin's practices violated the PDPO in six key aspects.
The PCPD deemed the collection of both iris scans and facial images excessive. They argued that iris scanning alone was sufficient to verify a participant's identity as a human being, rendering facial recognition data unnecessary.
The PCPD found the project's "privacy notice" and "biometric data consent form" lacking crucial information. These documents were not available in Chinese, the primary language for a significant portion of Hong Kong's population. Additionally, the iris scanning device operators failed to adequately explain the consent forms or confirm participants' understanding of the documents. Furthermore, they neglected to inform participants about the potential risks associated with disclosing their biometric data.
The PCPD criticised Worldcoin for failing to clearly inform participants about their rights under the PDPO. This included a lack of transparency regarding the purpose of data collection, whether participation was voluntary, and the process for accessing and correcting personal information.
Worldcoin planned to retain personal data for up to ten years to train AI models for user verification. The PCPD considered this retention period to be unreasonably long.
The PCPD found Worldcoin's data policy to be unclear and lacking in transparency. Participants were left unsure about how their data would be used and managed.
The PCPD concluded that Worldcoin did not provide participants with sufficient means to exercise their right to access and correct their personal information.
These violations of the PDPO led the PCPD to issue an enforcement notice to the Worldcoin Foundation, effectively shutting down the project's operations in Hong Kong.
Following news of Worldcoin being banned in Hong Kong, the value of the WLD token has declined by 2.44% in the last 24 hours, now trading at $4.93.
Earlier in March this year, Spain's data protection regulator, the AEPD, stepped in and demanded Worldcoin cease collecting personal information through its eye-scanning "orbs."
The AEPD expressed particular concern about the potential collection of data from minors and argued that Worldcoin was not adequately informing users about how their data would be used or stored.
Spain's data protection chief, Mar España Martí, highlighted the potential risks of identity theft, breaches of health privacy, and discrimination associated with sharing biometric data.
The regulator also emphasised the limited ability for users to erase their data once submitted, which contradicts the "right to erasure" enshrined in EU data protection laws.
Worldcoin vehemently contested the Spanish order, claiming full compliance with data protection regulations.
The company argued that the AEPD's actions were unfounded and aimed at spreading misinformation. However, their efforts to obtain an injunction against the order were unsuccessful.
Just weeks after the Spanish ban, Portugal's National Data Protection Commission (CNPD) followed suit in April 2024.
The CNPD received numerous complaints, including concerns about underage users providing scans without parental consent.
The Portuguese regulator mirrored Spain's concerns about data transparency, storage, and the lack of a mechanism for data deletion.
The CNPD pointed out that Worldcoin's iris-scanning technology falls under the category of "special data" under the General Data Protection Regulation (GDPR), demanding a higher level of protection due to the increased risk associated with biometric data.
The CNPD issued a temporary three-month ban on Worldcoin's operations while a full investigation was conducted. This ban came after an estimated 300,000 people in Portugal had already submitted their iris scans in exchange for Worldcoin's cryptocurrency.
South Korea is experiencing a surge in interest for Worldcoin after a two-month suspension of Worldcoin's iris registration services in Korea.
The suspension stemmed from allegations of illegal personal information use. However, as of writing, Worldcoin has restarted operations in six key locations across Seoul, including COEX in Samseong-dong, Yeoksam-dong, Seongsu-dong, Euljiro, Yongsan, and Yeouido.
The resumption has been met with high demand, with all slots at orb operator branches filled for the foreseeable future.
Adding another layer of complexity is the ongoing investigation by Korea's Personal Information Protection Commission.
Launched in February 2024, the investigation remains incomplete, with no regulations yet imposed on Worldcoin's iris registration services.
Currently, transactions involving Worldcoin tokens continue on domestic crypto exchanges like Bithumb and Coinone.
While residents see an opportunity for financial gain, the project remains under scrutiny for its data privacy practices and lack of transparency regarding its economic model.
The ongoing investigation by Korean authorities will likely determine the future of Worldcoin's operations in the country.
In a contradictory twist, Singapore stands out as a more welcoming environment for Worldcoin compared to other countries since its launch in December last year.
Starting with just five locations, it has now expanded to eight, predominantly concentrated around the central district.
The project's contributor, Tools for Humanity (TFH), gained membership in two of Singapore's most prestigious tech associations: ACCESS and the Singapore Fintech Association (SFA).
Meanwhile, Worldcoin has recently been making strides in Malaysia. The Securities Commission Malaysia (SC) has granted approval to MX Global Sdn Bhd, a digital business solutions provider, to facilitate the trading of the Worldcoin (WLD) token on digital asset exchanges recognized by the SC.
This means that WLD will now join a list of other cryptocurrencies that can be traded in Malaysia, such as Bitcoin, Ethereum, and Litecoin.
MX Global is one of the six recognised market operator-digital asset exchanges (RMO-DAX) in Malaysia and has been operating since July 2021. In March 2022, MX Global received an investment from cryptocurrency exchange Binance.
In a recent move that signifies a shift in strategy for Worldcoin, executives from the company and its parent organisation met with Malaysian government officials, including Prime Minister Anwar Ibrahim.
This meeting is seen as an attempt to improve relations with governments as Worldcoin expands internationally. By meeting with Malaysian officials, Worldcoin is likely hoping to address any potential concerns and pave the way for wider adoption of its technology in the country.
Worldcoin's innovative iris-scanning technology promises financial inclusion for the masses, but its approach raises serious privacy concerns.
Worldcoin's approach, which incentivises users with cryptocurrency in exchange for highly sensitive information, has raised red flags for data protection authorities.
With a growing number of countries banning the project, Worldcoin faces an uphill battle. Its success hinges on resolving data security anxieties and achieving regulatory clarity.
As of now, Worldcoin offers humanness verification in nine countries: Argentina, Chile, Germany, Japan, South Korea, Mexico, Peru, Singapore, and the United States.
The project also faces accusations of being a potential Ponzi scheme.
While Worldcoin claims to provide a universal basic income to combat AI replacing human labour, details on its business strategies and funding methods remain shrouded in secrecy.
Market insiders suspect the promised income might be funded by reselling coins to new investors at inflated prices, raising concerns about the project's long-term sustainability.
Will Worldcoin revolutionise global finance or fade into obscurity?
Only a fundamental shift in user trust or a revolutionary approach to data protection can secure its future.