Spanish authorities put a stop to biometric data collection by Worldcoin

Lines of teenagers getting iris scans for money worry public and data protection agency

Source : https://www.covidhub.ch/autorites-espagnoles-mettent-hola-collecte-donnees-biometriques-worldcoin/

The Spanish Data Protection Agency (AEPD) has ordered Tools for Humanity Corporation, the company responsible for the controversial Worldcoin project, to stop collecting biometric data from Spaniards. The AEPD indicates that it has received several complaints, citing in particular concerns about the lack of transparency, the collection of data from minors, and the impossibility of withdrawing consent to the processing of biometric data.

A controversial project

Anyone curious to observe lines of teenagers stretching out in front of shopping centers to get their iris scans in exchange for cryptocurrency just need to go to this page on the Worldcoin website to find “the orb ” closest to his home. It is these orbs, with a dystopian name and appearance, which record the biometric data of volunteers attracted by the promise of easy gain.

The Worldcoin project, launched by Sam Altman (best known for being the director of OpenAI, offering the famous artificial intelligence tool ChatGPT) promises, to those who agree to have their eyes scanned, a “minimum basic income” under the form of its cryptocurrency WLD. Despite communication that is intended to be reassuring, Worldcoin's ambition raises concerns. Edward Snowden in particular is concerned about the idea of ​​preserving and cataloging the “hash” (that is to say the unique cryptographic signature) of the scan of people's irises, which she calls the “iris code”, and on the basis of which it proposes to issue a “World ID” (digital passport).

Edward Snowden writes on Twitter on October 23, 2021: It looks like we're producing a global database of “hashes” – unique cryptographic signatures generated from scanning people's irises (under the guise of “fairness”) – but that we minimize the implications by saying: “we erased the scans!”. Certainly, but you saved the hashes produced by the scans. Hashes that will match other future scans…. Don't list eyeballs!

Since its launch in 2019, Worldcoin has been engaged in an international campaign aimed at collecting the biometric data of as many individuals as possible (it has already collected 4 million). The company says it does not store scans of the irises it harvests; unfortunately this promise reflects a certain bad faith, since Worldcoin at the same time admits to retaining the cryptographic signature of said scans. In other words, by having your eye scanned by Worldcoin, we still give this company (and its partners) the ability to identify us biometrically. It doesn't matter that the company doesn't keep the image itself, as long as it keeps the unique signature, which essentially amounts to the same thing.

The order from the Spanish AEPD is not the first of its kind. Already in January, Hong Kong's data protection commissioner ordered the search of six of Worldcoin's offices, citing serious concern that scanning people's irises could lead to a leak of personal data. In December 2023, the publication TechCrunch further announced that Worldcoin had suspended for the moment the collection of biometric data in India, Brazil and France, again citing legal constraints.

Without necessarily understanding the dangers inherent in this technology, a large part of the public remains suspicious of this “orb” which captures their identity.

Adam Cochran also reacted on Twitter on October 24, 2021 in a discussion thread on the Worldcoin dystopia, calling out Sam Altman : “sorry guys: you underestimated the visceral reaction (of people) when we tell them : “Hey, human, scan your eye in this silver orb that looks like the Death Star (editor's note: reference to the Star Wars movie) so we can give you free money?”

Sam Altman, the creator of the project, then admitted to having underestimated this instinctive reaction of rejection for biometric identification of identity.

The Spanish order is temporary

In its press release, the AEPD indicates that it “considers that it is urgent to intervene to protect the rights and freedoms of individuals” and that it is authorized to “adopt provisional measures having legally binding effects on its territory , and whose validity period cannot exceed three months”.

This is therefore what it did, by adopting these “urgent measures having the effect of temporarily prohibiting the aforementioned activities”, justified “to avoid potentially irreparable damage”. She ultimately writes that “the absence of such measures would deprive individuals of the protection to which they are entitled under European data protection law (GDPR)”.

It therefore remains to be seen what will happen in 3 months, when this deadline has expired and the injunction is lifted. In the meantime, Worldcoin has announced that it will appeal against the Spanish decision.