The National Data Protection Commission (CNPD) of Portugal took action to protect personal data, particularly for minors, by issuing a temporary 90-day restriction on Worldcoin’s biometric data collection through its Orb devices in Portugal. This decision was made in response to concerns raised by numerous complaints about the collection of biometric data, including iris, eye, and facial scans, without proper consent or authorization. The CNPD also noted deficiencies in the information provided to data subjects and potential data deletion or revocation issues. Media reports indicating that over 300,000 individuals in Portugal had already provided their biometric data further prompted the CNPD to take action due to the rapid proliferation of collection points, particularly in commercial areas.
Biometric data is classified as a special category of data under the GDPR, requiring enhanced protection due to its inherent risks. Minors, being vulnerable, are entitled to special protection under European and national laws. The CNPD’s temporary restriction reflects its commitment to upholding citizens’ fundamental rights in the digital age. An ongoing investigation will analyze incoming reports and take further steps as necessary to ensure compliance with data protection regulations and mitigate potential harm. Worldcoin, a global digital identity and cryptocurrency project founded by OpenAI CEO Sam Altman, has also faced legal uncertainties surrounding its operations in Spain and other jurisdictions.
In Spain, the Spanish Data Protection Agency (AEPD) issued a temporary order on March 6 prohibiting Worldcoin from collecting data in the country for three months due to concerns related to users’ inability to withdraw consent and allegations of data collection from minors. Despite Worldcoin’s compliance efforts, a local court rejected its injunction against the data regulator. This situation in Spain is separate from regulatory challenges faced by Worldcoin in Hong Kong and Kenya. In January 2024, Hong Kong’s Office of the Privacy Commissioner for Personal Data investigated Worldcoin’s operations due to concerns about personal data privacy risks. In Kenya, Worldcoin’s eye-scanning project encountered regulatory challenges, leading to a government ban on local activities associated with the platform in August 2023. Worldcoin is willing to collaborate with the Kenyan government to resume operations in 2024.
In a statement released on March 18, Worldcoin assured stakeholders that it operates lawfully in all locations where it is available and is designed to comply with relevant laws fully. The project aims to provide clear answers to frequently asked questions and address concerns about data privacy and protection. Worldcoin’s willingness to collaborate with regulatory authorities and engage in dialogue with stakeholders demonstrates its commitment to addressing legal uncertainties and ensuring compliance with data protection regulations. As the CNPD’s investigation continues in Portugal, further actions may be taken to safeguard personal data protection, particularly for minors, in light of Worldcoin’s biometric data collection concerns. The intersection of technology, data privacy, and legal compliance remains a complex and evolving issue in the digital age.
