Controversial eye-scanning startup WorldCoin has failed to obtain an injunction against a suspension ordered by Spain's data protection authority AEPD on Wednesday.
The authority used emergency powers contained in the European Union's General Data Protection Regulation (GDPR) to issue the local order, which could apply for up to three months. Given the sensitivity of the biometric data collected and the potentially high risk to individual rights and freedoms, the company has issued a statement to WorldCoin's operator Tools for Humanity. He said he was taking precautions. It also raised specific concerns about risks to minors, citing complaints received.
Today, the Madrid-based High Court refused to grant an injunction against the AEPD's order, citing the need to prioritize “the protection of the public interest.”
As we reported on Friday, the cryptocurrency blockchain biometrics digital identity company stopped scanning the market shortly after the AEPD order. This gave them 72 hours to comply with the order. Today's court ruling means WorldCoin's services will remain suspended in Spain for up to three months.
In its appeal against the AEPD's order, Tools for Humanity argues that the Spanish authorities will invoke the “urgent procedure” under Article 66 of the GDPR, following a public investigation by the Bavarian data protection authority, which is the lead DPA under the GDPR. He was trying to claim that he had overstepped his authority. Mechanisms to streamline the oversight of cross-border complaints. He also pointed out that so far German authorities have not intervened in the project.
However, the court found that AEPD's cease and desist order was justified given the risks associated with biometric data and how many individuals, including children, are at risk from WorldCoin's processing. It also points out questions about the validity of the claimed legal basis (consent) and the level of information provided regarding the processing, and the rights of data subjects, such as the right to withdraw consent and the right to obtain personal information. He cited concerns about corporate influence. Data has been deleted.
The proceedings provide some additional details about the four complaints received by AEPD. The court said these complaints indicate that data from minors is being collected by Worldcoin. Insufficient information provided. There is no way for people to withdraw their consent. And data deletion only instructs the data subject to delete the app (i.e. it does not erase all personal data). The court further stated that one of the petitioners told AEPD that the supposed removal procedure would not work because the company would have to send the code by post, and the arrival of the code would always be delayed and the code would not arrive. It is pointed out that he stated that it will become invalid at that point.
In its suit for an injunction, Tools for Humanity argues that the suspension would cause economic harm, damage its reputation, and reduce the chances of future success for its eye-scanning business. It sought to claim that it would cause “irreparable harm” to the company's global operations. .
Again, the court was unimpressed, rejecting what it described as “baseless allegations” and noting that AEPD's suspension was time-limited. Applies only in Spain. and is compensable (i.e. if you win in court, you have a route to claim compensation in the future).
Asked for comment on the denial of the injunction, Rebecca Hahn, a spokeswoman for Tools for Humanity, emailed a statement that attributed it to World Coin.
Worldcoin is fully compliant with all laws and regulations governing biometric data collection and data transfer, including the European General Data Protection Regulation (“GDPR”). Previous attempts to get involved with the AEPD went unanswered, so we look forward to the opportunity to demonstrate this compliance before the Spanish High Court and provide regulators with accurate and important information about this essential and legal technology. I'm doing it.