Introduction

Cryptocurrency startup Worldcoin is embroiled in a legal dispute with the Spanish data protection authority (AEPD) after the agency ordered a temporary suspension of its eyeball-scanning operations in the country.

The Issue:

Worldcoin offers cryptocurrency rewards in exchange for individuals undergoing iris scans using their proprietary devices. The company claims this data will be used to establish a universal basic income (UBI) program through a global digital identity system. However, the AEPD raised concerns regarding Worldcoin's compliance with the EU's General Data Protection Regulation (GDPR) due to several factors:

Transparency: The AEPD alleges that Worldcoin fails to provide users with clear and comprehensive information about how their iris scan data will be collected, used, stored, and shared. This lack of transparency makes it difficult for users to understand the potential risks and implications of consenting to the scans.

Data Collection from Minors: Worldcoin's scanning locations are open to the public, raising concerns that minors may be included in the data collection process without proper parental consent. The GDPR imposes stricter requirements for collecting and processing data from children.

Limited Control over Consent: The AEPD argues that the financial incentive offered by Worldcoin in exchange for iris scans compromises the ability to freely give consent. Because individuals are motivated by the reward, their decision to participate in the scanning may not be based on a clear understanding of how their data will be used.

Highly Sensitive Data: Iris scans are considered biometric data, a category of information accorded a high level of protection under GDPR. Biometric data, unlike passwords or usernames, is unique and immutable, raising significant privacy risks if compromised. In the wrong hands, iris scans could be used for unauthorized identification or tracking purposes.

Worldcoin's Response:

Worldcoin strongly refutes the AEPD's claims, insisting that its data collection practices fully comply with all relevant European Union regulations on data transfer, processing, and protection. The company argues that its data collection process is transparent and users are provided with comprehensive information about how their iris scan data will be used. Worldcoin maintains that users freely give consent after careful consideration of the information presented.

In response to the AEPD's concerns regarding data collection from minors, Worldcoin emphasizes that its scanning locations are designed to be staffed by personnel trained to identify and prevent minors from participating in the scanning process. The company also highlights its commitment to upholding user privacy and emphasizes that iris scan data is stored securely using state-of-the-art encryption techniques.

Worldcoin contends that the AEPD's decision to enact a temporary suspension order is an overreach and bypasses established procedures outlined under the GDPR. The company argues that the AEPD did not engage in a constructive dialogue or provide a clear opportunity to address the data protection agency's concerns before resorting to such a drastic measure. Due to these perceived procedural irregularities, Worldcoin has filed a lawsuit challenging the suspension order and has paused operations in Spain to avoid any further complications.

Current Situation:

Worldcoin's website initially listed five locations in Spain for eyeball scanning. However, in a move likely prompted by the AEPD's suspension order, these listings have all been removed. This suggests that Worldcoin is complying with the order, at least temporarily, while the legal dispute unfolds. The Bavarian data protection authority (BayLDA) remains the lead investigator for Worldcoin's GDPR compliance across the EU. They are expected to release a draft decision with their findings soon. This draft decision will then be circulated to other EU data protection authorities for review.

If any of these authorities disagree with the BayLDA's findings, they can raise objections. In such cases, the GDPR includes a mechanism for resolving disputes, either through majority votes by the authorities involved or, if disagreements persist, by referral to the European Data Protection Board for a final ruling. This multi-step process ensures that all relevant concerns are addressed before a final decision regarding Worldcoin's GDPR compliance is reached.

Catalan Response:

The Catalan government, where most of the Spanish scanning locations were situated, issued warnings regarding Worldcoin's data collection practices.

Wider Implications:

👉 This case highlights the ongoing tension between technological advancements and data privacy regulations.

👉 It raises crucial questions about informed consent, the collection of sensitive biometric information, and the potential misuse of such data.

Conclusion

Worldcoin's legal battle in Spain exposes the complexities of balancing technological innovation with robust data protection safeguards. While the company maintains its adherence to EU regulations, the Spanish data protection agency raises concerning issues regarding transparency, potential exploitation of minors, and the sensitive nature of biometric data collection. The lawsuit filed by Worldcoin and the ongoing investigation by the lead German authority along with the involvement of other EU data protection agencies underscore the multifaceted approach adopted within the European Union to ensure user privacy. The outcome of this case will set a precedent for how strictly iris scan technology, employed for purposes like establishing a global UBI program, needs to comply with data protection regulations to gain widespread acceptance and ensure user trust.