\n<\/p>\n
Worldcoin, OpenAI CEO Sam Altman\u2019s bid to sew up the market for verifying humanness by convincing enough mobile meatsacks to have their eyeballs scanned in exchanged for crypto tokens (yes, really), only started its official global rollout this week<\/a> but it\u2019s already landed on the radar of European data protection authorities.<\/p>\n Why should anyone feel the need to prove their humanness on the Internet? Well one reason is that by unleashing free power tools like ChatGPT Altman\u2019s generative AI company is leading the charge to make it harder to distinguish between bot-generated and human digital activity. But don\u2019t worry, he\u2019s got an eyeball-scanning orb-plus-crypto-token to sell humanity on for that!<\/p>\n Pop-up locations where willing guinea pigs (i.e. humans) can get some Worldcoin \u201cdigital tokens\u201d in exchange for feeding their biometric data into its proprietary Half Life<\/em>-esque orbs have sprung up in four markets in Europe so far: The U.K., France, Germany and Spain. And, surprising precisely no-one, privacy regulators in at least three of those markets are already expressing concerns and\/or actively investigating WTF Worldcoin is doing with European\u2019s sensitive personal data.<\/p>\n Earlier this week the U.K.\u2019s Information Commission Office (ICO) was asked about Worldcoin launching in the U.K. and said publicly it would be \u201cmaking enquiries\u201d, before issuing some boilerplate warning that: \u201cOrganisations must conduct a Data Protection Impact Assessment (DPIA) before starting any processing that is likely to result in high risk, such as processing special category biometric data. Where they identify high risks that they cannot mitigate, they must consult the ICO<\/span>.\u201d<\/p>\n The ICO\u2019s remarks also emphasized the need for \u201ca clear lawful basis to process personal data\u201d, adding: \u201cWhere they are relying on consent, this needs to be freely given and capable of being withdrawn without detriment\u201d.<\/p>\n One privacy compliance question to consider, then, is can consent be freely given if people are being encouraged to hand over their biometrics in exchange for a token which is being presented as a form of virtual currency?<\/p>\n Fast forward a few days and France\u2019s data protection authority, the CNIL, has followed the ICO\u2019s remarks with even more specific expressions of concern, as first reported by Reuters<\/a> \u2014 out-and-out questioning the legality of what Worldcoin is doing. The French authority also revealed it\u2019s already been actively investigating Worldcoin.<\/p>\n \u201cThe legality of [Worldcoin\u2019s data] collection seems questionable, as do the conditions for storing biometric data,\u201d a CNIL spokesperson confirmed by email, adding: \u201c Per the CNIL, the investigation it started has been passed to Bavaria\u2019s DPA \u2014 after it found the German state authority was Worldcoin\u2019s lead data supervisor in the EU (owing, presumably, to Worldcoin having a subsidiary in the German state). It added that it is providing support to Bavaria\u2019s probe \u201cunder the mutual assistance procedure\u201d in EU law.<\/p>\n The bloc\u2019s General Data Protection Regulation (GDPR) \u2014 a pan-EU law which is still baked into legacy U.K. data protection rules (hence the ICO sharing the same sort of concerns as EU peers) \u2014 contains a mechanism called the One-Stop-Shop that\u2019s intended to streamline regulatory oversight in instances where concerns cut across Member State borders, as here. Or at least when the data processor in question has a main establishment in the EU, as Worldcoin apparently does.<\/p>\n In this scenario the data controller only needs to liaise with a single lead DPA. And in Worldcoin\u2019s case that\u2019s apparently the state of Bavaria\u2019s DPA.<\/p>\n We contacted the Bavarian authority with questions about the investigation. But a spokesperson told us that because it\u2019s an ongoing procedure it\u2019s unable to go into details. (They did confirm one of the first aspects it will look at, out of a range of \u201cmany\u201d questions, is the obligation to carry out a data protection impact assessment \u2014 which they said \u201cshould provide a clear analysis of the impact of the envisaged processing operations on the protection of personal data and the safeguards in place to address these risks\u201d.)<\/p>\n We\u2019ve also reached out to Spain\u2019s DPA to ask if it shares its peers concerns about Worldcoin\u2019s data processing in that EU market and will update this report with any response.<\/p>\n On the legality point, the GDPR classes biometric data that\u2019s used for the purpose of identification \u2014 which is exactly what the Worldcoin project intends \u2014 as so-called \u201cspecial category data\u201d. This type of (very sensitive) data has the strictest rules for legal processing.<\/p>\n A spokeswoman for Tools For Humanity, the for-profit technology company that led the development of Worldcoin and operates the World App, confirmed to TechCrunch that consent is the lawful basis being claimed for processing Europeans biometrics data. \u201cUnder GDPR, the project relies on the users\u2019 consent for creating the proof of personhood and for opting into data custody,\u201d she told us.<\/p>\n She also pointed us to Worldcoin\u2019s biometric data consent form <\/a>and privacy notice<\/a> \u2014 documents that run to almost 3,800 words and almost 3,400 words, respectively.<\/p>\n Since Worldcoin is relying on people\u2019s consent to process their special category data, under EU law it must meet an even higher bar \u2014 of explicit consent \u2014 in order for this processing to be lawful. This means the description shown to, er, eyeball providers before their biometrics are harvested must be extremely clear and specific about what the processing is for.\u00a0And let\u2019s just say that achieving the highest bar for clarity when you\u2019re presenting individuals with circa 7,000 words of legalese while simultaneously telling them they\u2019ll get a bunch of crypto if they do the scan looks challenging to say the least. (NB: Consent under EU law must also be freely given<\/em>.)<\/p>\n