\n<\/p>\n
A German subsidiary involved in Sam Altman\u2019s controvercial crypto blockchain digital identity business, Worldcoin, was reported Friday to have filed a legal challenge against a suspension order from Spain\u2019s data protection authority.<\/p>\n
Earlier this week<\/a> it emerged that the Spanish authority, the AEPD, had instructed Worldcoin to temporarily stop scanning people\u2019s eyeballs or further processing data already collected from people in the market.<\/p>\n As we reported Wednesday, the AEPD announced an Article 66 \u201curgency procedure\u201d against Worldcoin under the European Union\u2019s General Data Protection Regulation (GDPR), saying it was acting after receiving a number of complaints. Issues of concern it cited include the level of information Worldcoin provides about the processing; the collection of data from minors; and how withdrawal of consent is not allowed. It also emphasized the sensitive nature of the biometric data involved which it said entails \u201chigh risks for people\u2019s rights\u201d.<\/p>\n While Worldcoin\u2019s operating company, Tools for Humanity, is considered \u201cmain established\u201d in Germany, which allows it to avail itself of streamlined regulatory oversight via the GDPR\u2019s one-stop-shop mechanism \u2014 with the Bavarian DPA (aka BayLDA) acting as its lead authority for oversight and investigating complaints \u2014 the regulation contains powers that permit any other DPA to issue temporary orders, lasting up to three months, if it believes there is an \u201curgent need\u201d to act to protect locals\u2019 rights.<\/p>\n Such orders only apply in the authority\u2019s own market, rather than being EU-wide. So the AEPD\u2019s temporary ban on Worldcoin only applies in Spain.<\/p>\n Despite the GDPR providing for urgent interventions by non-lead DPAs, Worldcoin is challenging the AEPD\u2019s order.<\/p>\n The development was first reported in German press. A spokeswoman for Worldcoin, Rebecca Hahn, emailed a link to the report published by Schw\u00e4bisch<\/a>, saying she wanted to draw it to TechCrunch\u2019s attention. She also sent a statement (below), attributed to Worldcoin, in which Tools for Humanity claims its eyeball-scanning business is \u201cfully compliant\u201d with all EU laws pertaining to biometrics, data transfer, data processing and data protection. The statement also accuses the AEPD of circumventing \u201caccepted EU process and rules\u201d \u2014 which it claims has left it \u201clittle recourse\u201d but to file suit.<\/p>\n Here\u2019s Worldcoin\u2019s statement in full:<\/p>\n Worldcoin is fully compliant with all laws and regulations governing biometric data collection and data transfer, including Europe\u2019s General Data Protection Regulation (\u201cGDPR\u201d). As such, we have been in consistent and ongoing dialog with our lead Data Privacy Authority in the EU, BayLDA, for months. We were disappointed that the Spanish regulator circumvented the accepted EU process and rules, which leaves us little recourse but to file suit.<\/p>\n<\/blockquote>\n Hahn did not respond to questions asking for more details about the legal arguments Tools for Humanity intends to make against the AEPD\u2019s order. Nor to confirm whether Worldcoin and its operators in Spain have complied with the local order to stop scanning and processing data of people from the market.<\/p>\n The AEPD was contacted for comment on Worldcoin\u2019s challenge \u2014 but had not responded at press time.<\/p>\n According to Schw\u00e4bisch\u2019s report, Worldcoin was \u201clargely developed\u201d in Erlangen in Bavaria, Germany. It names the German computer scientist, Alex Blania (pictured above), as a co-founder of Tools for Humanity, along with OpenAI\u2019s Altman. Blania\u2019s LinkedIn profile<\/a> lists him as based in San Francisco.<\/p>\n At the time of writing, the Worldcoin.org website<\/a> still lists five \u201cpop-up\u201d locations in Spain (three in Barcelona, one in Madrid and one in Malaga) where it says people can go and get their eyeballs scanned by one of Worldcoin\u2019s proprietary orbs. However, on Wednesday, Worldcoin\u2019s site was listing 29 locations around the country where people could go and have their biometrics harvested in exchange for a few crypto tokens. Which suggests it may be in the process of shuttering scanning ops in the market.<\/p>\n One of the controversies around the business is it\u2019s acquiring people\u2019s sensitive biometrics in exchange for a form of payment. Worldcoin claims users are consenting to their data being processed for its purpose. But in the EU, the GDPR requires consent to be freely given \u2014 and a financial incentive creates an obvious incentive that may mean people are not able to freely consent as the law understands it.<\/p>\n Other GDPR concerns about Worldcoin include the transparency and fairness of the processing; issues over data subjects\u2019 rights, such as the right to have personal data deleted; risks to minors; and questions about data transfers and security.<\/p>\n The BayLDA\u2019s investigation of whether Worldcoin complies with the GDPR, which started last year, remains ongoing. But yesterday the authority told us it expects to send a draft decision with its findings to the other European data protection authorities for review \u201cvery soon\u201d.<\/p>\n Under the GDPR, other authorities with concerns about cross-border processing may raise objections to a draft decision if they disagree with the lead authority\u2019s findings. If that happens, disputes over decisions are either resolved via majority votes or, if DPAs remain split, the European Data Protection Board gets a casting vote. This means that even though the regulation allows for oversight on entities like Worldcoin to be led by a single authority, it has been designed to ensure other concerned authorities remain involved in decisions that affect users in their own markets.<\/p>\n In Catalonia, the autonomous community in Spain where Worldcoin currently lists the most pop-ups (three) for eyeball scanning, local press recently reported<\/a> that the regional government had responded to concerns about the company\u2019s biometric scanning ops by publishing an article<\/a> containing advice and warnings from the Catalan Data Protection Authority.<\/p>\n The article warns about the \u201cparticularly sensitive personal data\u201d being collected via the iris scans; the risks of harms from misuse of such data; and raises specific concerns about children\u2019s data being harvested without the necessary consent of a parent or guardian.\u00a0<\/span><\/span><\/span><\/p>\n\n