It turns out that a sci-fi-looking orb that scans and stores your biological data might raise some questions from privacy regulators.
What happened: Spain’s data regulator banned eye-scanning-slash-crypto startup Worldcoin for up to three months, ordering it to stop collecting personal information and cease using any data it has already gathered.
- Under the EU’s General Data Protection Regulation (GDPR), biometric data — like eye scans — is considered especially sensitive and subject to additional controls.
- Spanish regulators received complaints about Worldcoin that hit on several key GDPR rules, like providing limited information about how it processes data, collecting data from minors, and not letting users withdraw consent for data collection.
Catch-up: Founded by OpenAI’s Sam Altman, Worldcoin’s “orb” devices scan people’s irises to create a unique digital ID, offering an eponymous cryptocurrency as an incentive.
- The company claims that a permanent, unchangeable ID is vital in the AI age when verifying identities online has become complicated.
Why it matters: This ruling is a shot at what Worldcoin touts as part of its core purpose. If privacy laws require that people be allowed to revoke or change the data the ID is based on, Worldcoin’s whole concept falls apart.
- Germany’s data protection authority was tasked with leading an investigation into EU privacy concerns, as Worldcoin is based in Germany.
- But Spain invoked GDPR’s Article 66, which lets member states temporarily act on their own if there’s an urgent need to protect people’s rights.
- Last year, Kenya suspended Worldcoin operations for privacy reasons, while the company “scaled back” operations in Brazil, France, and India.
In Canada: Bill C-27’s pending updates to privacy laws take a lot of inspiration from GDPR, including deeming biometric data extra sensitive and letting people revoke consent for data processing. If Worldcoin isn’t able to operate in the EU, it’s a good sign that it may never come to Canada, either.