Controversial crypto-biometric venture WorldCoin has been suspended again, this time in Portugal, and has been almost completely banned from Europe. The order from the country's data protection authority follows a similar three-month suspension order issued by Spain's DPA earlier this month.
Portugal was one of only two countries left in Europe where WorldCoin operated its own eye-scanning sphere after Spain's ban. This leaves Germany currently the only market in Europe where biometrics can be collected, as privacy watchdogs take urgent steps to address local concerns.
Portugal's data protection authority announced on Tuesday that it had banned WorldCoin from local operations for three months following complaints that the company scanned children's eyeballs.
Other complaints mentioned in the press release announcing the suspension, which it noted were issued on Monday, also echo the Spanish DPA's concerns. Users cannot delete their data or withdraw their consent to Worldcoin processing.
The venture's use of blockchain technology to store tokens obtained from scanned biometrics means the system is designed to retain personal data forever. , there is no need for people to erase their information after the fact.
In contrast, EU data protection law gives people in the region a series of rights regarding their personal data, including the ability to correct, amend, or have data about them deleted. Therefore, there is an inherent legal contradiction in Worldcoin's approach. That's before considering other problematic issues, such as the quasi-financial incentives offered by Worldcoin to encourage people to get scanned. Contains highly sensitive biometric data. And its overarching goal is to construct and operate an identity layer for “humanness.”
This controversial project is backed by Sam Altman, of OpenAI fame, who is also accelerating the boom in generative AI tools. ) making it difficult to distinguish between activities and human activities. Next stop: Collect rent from every online human on the planet?
Portuguese authority CNPD announced last month that it had taken action after receiving “dozens” of complaints about World Coin.
The company estimates that more than 300,000 people in Portugal have agreed to undergo an iris scan with its unique orb in exchange for WorldCoin (a virtual currency also invented by the company), It notes that the number of locations offering scans has nearly doubled in six years. A few months. He added that the large influx of people willing to receive virtual currency offers in exchange for eye scans has prompted WorldCoin to introduce a pre-booking system for scans on the market.
Regarding risks to children's data, the CNPD notes that WorldCoin's Orb operator did not implement age verification and did not take strong measures to prevent children from accessing the technology. Suggests.
“Biometric data qualifies as special data under the GDPR.” [General Data Protection Regulation] Therefore, the risks of treatment are high and the patient enjoys greater protection.” [in Portuguese, this is a machine translation]. “On the other hand, minors are particularly vulnerable and may be less aware of the risks and consequences of the processing of their personal data, as well as their rights, and as such under national and European law. subject to special protection.”
Portuguese authorities have given WorldCoin 24 hours to comply with local cease-and-desist orders.
Given that the Worldcoin.org website does not include Portugal in the list of countries where you can book an eye scan (as mentioned above, Germany is the only remaining country in Europe, along with Argentina, Chile, Japan, Singapore and the US). country), the deadline was met.
Coincidentally or not, Germany is the EU market where World Coin developer Tools for Humanity has a regional presence. Co-founder Alex Brania is also German. Bavaria's data protection authority, which leads the company's data protection oversight and has been investigating WorldCoin since last year, comes as its southern European peer authorities intervene urgently to protect citizens in its own market. Despite this, there has been no public intervention yet.
WorldCoin failed to obtain an injunction against Spain's order earlier this month, but its appeal against the DPA case continues. It is not clear whether Portugal intends to appeal the order.
Tools for Humanity was contacted in response to the latest ban in the EU. Spokesperson Rebecca Hahn sent a statement (below) attributed to WorldCoin Foundation Data Protection Officer Yannick Preivish, in which the WorldCoin Foundation said: “We are fully compliant with all laws and regulations governing transfers.” Including the European General Data Protection Regulation. ”
“World Coin Foundation has the utmost respect for the role and responsibilities of the data protection authorities in the Portuguese CNPD,” he added. “Since providing humanity verification services in Portugal, we have been fully transparent and willing to respond to the CNPD's questions and concerns. The report from the CNPD This is the first time we are hearing from the CNPD on many of these issues, including reports of .Some reports.”
We have also contacted the Bavarian DPA to obtain an update on the investigation. An agency spokesperson said the investigation is ongoing. “In our role as the lead supervisory authority of the World Coin Foundation, we will liaise with the administrator to establish as quickly as possible reliable preventive measures to prevent abuse of the service and possible violations of the Terms of Use. ” they added. We are currently investigating more than 20 complaints from Spanish data subjects regarding the issue of data processing of minors.
As Lead DPA at Tools for Humanity, I am responsible for investigating privacy and data protection complaints about the company under the block's General Data Protection Regulation (GDPR) One-Stop-Shop (OSS) mechanism.
This structure means that the Bavarian DPA will prepare a draft decision on the WorldCoin GDPR investigation and make it available for review by peer authorities. Other authorities will also have the opportunity to object if they disagree with the findings. The regulations require majority support to decide cross-border cases, allowing weaker enforcement to be overturned if there is agreement that stronger measures are warranted. This allows us to mitigate the forum shopping risks inherent in GDPR's OSS mechanisms over a longer period of time.
The power under Article 66 of the GDPR, which both Spain and Portugal have used to impose regional temporary bans on WorldCoin, could be used to force leading authorities to take action where they have not yet taken action or where they are dragging their feet. provide tools to respond to urgent risks. .
However, neither side explicitly blamed the Bavarian authorities for taking too long. But the fact that they are making emergency interventions speaks volumes.
“Given the current situation where the processing of biometric data of minors is illegal, in relation to possible violations of other GDPR standards, the CNPD believes that the risks to the fundamental rights of citizens are high and serious. “We understand that urgent intervention to prevent the situation is warranted, or irreparable damage may occur,” Portuguese authorities said, adding that they would continue to investigate WorldCoin's activities there. Stated.
CNPD President Paula Meira Lorenzo added in a statement: “This order temporarily restricting the collection of biometric data by the World Coin Foundation is a necessary and legitimate measure at this time to have the beneficial effect of protecting the public interest,” especially for minors. in protecting the rights of others. ”
This report has been updated with comments from Worldcoin and Bavarian DPA.