Bavarian Data Protection Office Orders Worldcoin to Delete Biometric Data

YEREVAN (CoinChapter.com) — The Bavarian State Office for Data Protection Supervision (BayLDA) has issued a directive to Worldcoin, requiring the deletion of specific biometric data.

Bavarian data regulator orders Worldcoin to delete biometric dataThe Bavarian State Office for Data Protection Supervision (BayLDA) has ordered Worldcoin to delete specific biometric data following an investigation into the company’s handling of sensitive iris data under General Data Protection Regulation (GDPR) standards.

On Dec. 19, the BayLDA mandated Worldcoin, now operating under the name World, to create a data deletion procedure compliant with GDPR. The company has been given one month to comply with this ruling.

The BayLDA launched an investigation into Worldcoin in 2023 over the methods used to collect and store biometric data for its World ID verification system. This development raises critical questions about GDPR compliance in the digital identity sector.

Worldcoin appeals for clarity on anonymization standardsIn response to the ruling, the World Foundation appealed for clarity on whether its Privacy Enhancing Technologies (PETs) align with EU anonymization standards. The foundation highlighted the absence of a consistent definition of anonymization under GDPR.

In May 2024, Worldcoin stated that it had deleted all previously collected data linked to its old iris data collection system to meet regulatory requirements. However, the current directive includes stricter measures.

According to the foundation, data anonymization plays a crucial role in protecting user privacy. The organization stressed that clear guidelines are needed to balance compliance and technological advancement.

Bavarian regulator strengthens user rights“All users who have provided Worldcoin with their iris data will in future have the unrestricted opportunity to enforce their right to erasure,” said BayLDA President Michael Will in the ruling.

The regulator’s decision aims to ensure that Worldcoin users can fully exercise their right to delete personal data. Additionally, the BayLDA now requires Worldcoin to obtain explicit consent from users for specific data processing activities in the future.

Worldcoin ordered to delete non-compliant dataThe directive also includes the deletion of data collected during the project’s initial phase in summer 2023, which the BayLDA found was not processed in accordance with the GDPR. This involves the removal of iris codes collected without a sufficient legal basis.

While the current decision focuses on GDPR compliance, other user complaints, such as concerns about the protection of minors, remain unresolved. The BayLDA clarified that these issues will be handled in separate proceedings.

Worldcoin expresses commitment to working with EU regulatorsWorldcoin expressed its commitment to working with EU regulators to address compliance issues. The organization stated that it will continue to develop secure digital identity systems while aiming to meet GDPR requirements.

The World Foundation reiterated its stance that anonymization, alongside data deletion, is essential to safeguarding user privacy in the digital era. As the debate over compliance progresses, Worldcoin must implement the required measures within the specified timeframe.