Hong Kong eye scan for cryptocurrency scheme probed by city’s privacy watchdog
- Privacy commissioner’s office says Worldcoin, co-founded by Open AI CEO Sam Altman, could lead to sensitive information being compromised
- Officials raid six offices linked to Worldcoin in wake of investigations into the company in other jurisdictions
The data protection body said on Wednesday it feared that the iris scans of city users of Worldcoin, co-founded by OpenAI CEO Sam Altman, a leading figure in the global artificial intelligence industry, could lead to people’s personal information being compromised.
The watchdog’s high-profile action came after similar investigations were started by data regulators in other jurisdictions, with some labelling the biometric data collection method, where people are given cryptocurrency after images of their irises are taken, as questionable.
“The office is concerned that the operation of Worldcoin in Hong Kong involves serious risks to personal data privacy,” said Lo Dik-fan, a senior personal data officer at the Office of the Privacy Commissioner for Personal Data.
Worldcoin, which claims to have more than 3.2 million sign-ups worldwide, requires users to have their iris information collected by a scanner called the Orb in exchange for World ID digital identification and free cryptocurrency.
Lo added the way in which Worldcoin collected and processed the information might be in contravention of regulations in the Personal Data (Privacy) Ordinance.
“With the view to protecting the personal data privacy of members of the public, although we have not received any complaints about the project, the office has proactively commenced an investigation against Worldcoin in accordance with established procedures,” he said.
Officials armed with search warrants raided the project’s six premises in Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central and Causeway Bay on Wednesday.
Hong Kong plans to regulate cryptocurrency exchanges amid money-laundering alert
The commissioner’s office said some of the locations were used to conduct iris scans of service users.
A source familiar with the case said the office would look into whether Worldcoin obtained the consent in Hong Kong “genuinely” and if it used any authentications it had collected as agreed by participants.
Users are given 25 Worldcoin, worth about HK$19.55 (US$2.50) each on Wednesday, after their irises are scanned.
The Cayman Islands-based company has attracted scrutiny from overseas data regulator in places such as Britain and Germany, after its launch last year amid concerns about privacy and potential use of digital currency for fraudulent purposes.
Worldcoin set up its first store in Shanghai Street, Yau Ma Tei, last July for users to scan their irises to complete the registration process.
The privacy watchdog said it had noticed Worldcoin opened four other premises last December alone.
Hong Kong must address money-laundering risks for crypto changers: customs chief
Officials also appealed to the public to remain vigilant when they took part in schemes that collected sensitive personal information and to consider the legality and purpose, as well as the retention period and other security measures.
The commissioner’s office said it had no authority to suspend Worldcoin’s operations in Hong Kong.
Worldcoin on Thursday said any information used to verify “unique humanness” was “promptly deleted by default”.
“Worldcoin welcomes regulators, including the Office of the Privacy Commissioner for Personal Data (PCPD), and consumers to inquire and seek information or clarifications about its programs available to the people in their communities, cities, countries or regions,” it said.
The foundation added that it was committed to complying with laws and regulations concerning personal data in the markets where it operated, including Hong Kong’s Personal Data (Privacy) Ordinance.
Francis Fong Po-kiu, the honorary president of the Hong Kong Information Technology Federation, on Wednesday said iris recognition was a less-used biometric identification method than fingerprints or facial recognition.
“The crux of the issue now is how this unique biometric information is used,” he said.
“It has not been clear. You cannot just ask people to give you their iris information in exchange for your digital tokens without telling them how you will use the scans.”
