Hong Kong says Sam Altman’s Worldcoin crypto breached city’s privacy laws

THE Worldcoin cryptocurrency project, set up by OpenAI chief Sam Altman, breached Hong Kong’s privacy laws by demanding “unnecessary and excessive” scans of users’ eyes and faces, the city’s privacy watchdog said on Wednesday (May 22).

Worldcoin launched last July and seeks to give users a private digital identity – a “World ID” – after scanning their unique iris patterns, but it has run into trouble in some countries over concerns about the use of users’ personal data.

Hong Kong’s Privacy Commissioner for Personal Data (PCPD) said an enforcement notice had been issued telling the project to stop scanning and collecting iris and face images in the city.

“The collection of face and iris images for (verification) purpose was not necessary, and excessive,” PCPD said in a statement, adding that data leaks could lead to “grave consequences”.

More than five million people have a “World ID” and 137 million of the project’s crypto tokens have been claimed in more than 160 countries, Worldcoin said last month.

Its operation in Hong Kong had scanned the faces and irises of more than 8,000 people, PCPD said.

The privacy watchdog said Worldcoin breached multiple Hong Kong rules on the purpose and manner of data collection, and showed insufficient transparency.

Failing to comply with an enforcement notice can be punished with a maximum fine of HK$50,000 (S$8,633) and two years in prison.

Users were not given enough information to “make an informed choice or give real consent”, PCPD said, adding that Worldcoin’s plan to retain data collected for up to 10 years was “prolonged” and “not justified”.

SEE ALSO

OpenAI to ‘pause’ voice linked to Scarlett Johansson

The trillion-dollar AI arms race

PCPD said its investigation involved 10 covert visits to six Worldcoin locations in Hong Kong beginning in December, followed by searches with court warrants.

AFP has contacted Worldcoin for comment.

The crypto project has been suspended over privacy concerns in countries such as Spain, Portugal and Kenya, but it maintains that the personal data collected is encrypted and safe.