Portuguese Regulator Suspends Worldcoin's Biometric Data Collection

Portuguese data protection authority CNPD has ordered Sam Altman's Worldcoin to halt data collection for 90 days due to high risks to citizens' data protection rights. Over 300,000 individuals in Portugal have provided their biometric data to Worldcoin, which has raised privacy concerns in several countries and is under investigation for unauthorized data collection and insufficient information provision.

Portuguese Regulator Halts Worldcoin's Biometric Data Collection

The Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection regulator, has ordered Sam Altman's Worldcoin to cease collecting biometric data for a period of 90 days. This decision follows Worldcoin's controversial iris-scanning initiative, which has raised privacy concerns in numerous jurisdictions.

Heightened Data Protection Risks

The CNPD cited a "high risk" to Portuguese citizens' data protection rights, justifying its urgent intervention to avert potential harm. Over 300,000 individuals in Portugal have shared their biometric data with Worldcoin, according to the regulator.

Unauthorized Data Collection and Deficient Consent

The CNPD has received numerous complaints alleging unauthorized data collection from minors, inadequate information provided to data subjects, and the inability to erase or withdraw consent. These allegations have prompted the regulator to initiate an investigation and impose a temporary suspension on Worldcoin's data collection activities.

Temporary Halt for Due Diligence and Investigation

The CNPD clarified that the suspension order is temporary, allowing the regulator to conduct additional due diligence and analyze complaints. During this period, Worldcoin is prohibited from acquiring, processing, or transferring biometric data.

Worldcoin's Response

Worldcoin's data protection officer, Jannick Preiwisch, maintains the organization's "full compliance with all laws and regulations governing the collection and transfer of biometric data." He acknowledged the CNPD's report but emphasized that this is the first communication received from the regulator regarding various concerns raised.

Regarding underage sign-ups, Preiwisch asserted that Worldcoin has a "zero tolerance" policy and is addressing all reported instances. The organization is also implementing a "Personal Custody" transition, granting users control over their data, including deletion and future use.

International Scrutiny and Privacy Concerns

Worldcoin's initiative has faced regulatory challenges and criticism from privacy advocates across the globe. The project has been under investigation in multiple countries, including the United Kingdom, Germany, and Portugal.

Privacy campaigners have expressed concerns about the potential for biometric data to be hacked or misused. They also question the necessity of digital ID systems, arguing that they rarely deliver the promised benefits.

Investigation Under EU Data Protection Rules

The Bavarian state regulator in Germany currently serves as the lead authority investigating Worldcoin under the European Union's General Data Protection Regulation (GDPR). This is due to the presence of a German subsidiary of Tools For Humanity, the company behind Worldcoin.

Suspension Addressed to Worldcoin Foundation

The CNPD's suspension decision is directed at the Worldcoin Foundation, a Cayman Islands entity described as "memberless" and without owners or shareholders. The Worldcoin Foundation is the sole director and member of World Assets Ltd., a British Virgin Islands company responsible for issuing Worldcoin tokens to participants.

Regulator's Rationale

The CNPD's decision stems from its assessment that the Worldcoin Foundation acts as the data controller for the biometric data collected. This classification obligates the foundation to comply with the data protection requirements of the GDPR.

Investor Support

Despite the regulatory challenges, Worldcoin has attracted significant support from prominent venture capital firms, including a16z crypto and Bain Capital Crypto. The project's ability to navigate the current regulatory environment and address privacy concerns will ultimately determine its long-term viability.