Hong Kong: Issued PCPD ruling following investigation into Worldcoin project for potential data privacy violations

On 22 May 2024, the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong concluded its investigation into the Worldcoin project, finding multiple contraventions of the Personal Data (Privacy) Ordinance (PDPO). The PCPD's findings highlighted that Worldcoin's collection of face and iris images for creating digital passports and distributing cryptocurrency tokens violated data protection principles concerning necessity, fairness, transparency, retention, and individuals’ rights to data access and correction. Specifically, the use of biometric data was deemed unnecessary and excessive, with personal data being retained for an unjustifiably long period of up to 10 years. Furthermore, the lack of Chinese translations for privacy notices and consent forms, coupled with insufficient explanations to participants, contributed to a lack of transparency and fairness in data collection. As a result, the PCPD has issued an enforcement notice to the Worldcoin Foundation, directing the cessation of all iris and face image collection operations in Hong Kong.