The Bavarian State Office for Data Protection Supervision (BayLDA) has recently concluded its investigation into Worldcoin’s biometric data practices, ordering the company to implement stricter privacy measures. Worldcoin, known for its World ID system that uses iris-derived biometric data to create unique digital identities, has been instructed to provide a GDPR-compliant data deletion process within one month.
The investigation, which began in April 2023, focused on Worldcoin’s collection and use of biometric data for authentication purposes. While the company voluntarily paused its activities in some EU countries during the investigation, the BayLDA found compliance issues that needed to be addressed. Michael Will, President of BayLDA, emphasized the importance of enforcing European fundamental rights standards in favor of data subjects, stating that all users who provided their iris data to Worldcoin now have the right to demand the erasure of their data.
In addition to implementing a GDPR-compliant data deletion process and obtaining explicit user consent for certain data processing activities, Worldcoin is required to delete data collected without a sufficient legal basis. The BayLDA’s ruling also highlighted concerns regarding the protection of minors and potential administrative offenses, which are under separate examination.
Worldcoin’s global operations have faced regulatory challenges in various regions, with scrutiny over its biometric data practices and compliance with local laws. While investigations in some countries, like Kenya, have been closed without further action, pending compliance with regulations, scrutiny in other regions, such as Hong Kong and Singapore, continues due to concerns over data collection practices and potential financial misconduct.
The BayLDA’s enforcement of stricter privacy measures underscores the importance of upholding data protection standards, especially in the rapidly evolving landscape of biometric data usage. As Worldcoin works to address the compliance issues identified by the BayLDA, the project will need to navigate regulatory challenges and ensure that its data practices align with international standards.