Worldcoin's attempt to overturn a temporary suspension imposed by Spain's data protection authority (AEPD) has been rejected by a Madrid court. The AEPD had invoked emergency powers under the EU's General Data Protection Regulation (GDPR) to halt Worldcoin's operations in the country for up to three months, citing concerns over the company's handling of sensitive biometric data.

The court ruling emphasized the need to prioritize public interest and individual rights over Worldcoin's business interests. The AEPD had raised red flags about the potential risks posed by Worldcoin's collection of biometric data, including the impact on minors, based on complaints received.

Worldcoin, operated by Tools for Humanity, had argued that the AEPD overstepped its jurisdiction by invoking the GDPR's "urgency procedure." The company also highlighted the absence of intervention from German authorities, which serve as the lead regulator under the GDPR's cross-border oversight mechanism.

However, the court found the AEPD's suspension order justified, citing doubts about the validity of Worldcoin's legal basis for data processing (consent) and the level of information provided to data subjects. Concerns were also raised regarding individuals' rights, such as the ability to withdraw consent and have personal data deleted.

The complaints received by the AEPD alleged that Worldcoin captured data from minors without proper information, lacked a mechanism for consent withdrawal, and directed users to delete the app without ensuring complete erasure of personal data. One complainant reported issues with the deletion procedure, rendering the provided code invalid upon arrival.

While Worldcoin claimed the suspension would cause irreparable harm to its global business, including economic losses and reputational damage, the court dismissed these arguments as unsubstantiated. It highlighted that the AEPD's suspension is time-limited, applicable only in Spain, and compensable if Worldcoin prevails in court.

Responding to the ruling, Worldcoin spokeswoman Rebecca Hahn maintained that the company is compliant with all laws and regulations governing biometric data collection and transfer, including the GDPR.