The watchdog on Wednesday said its investigation found Worldcoin’s operations in the city posed “serious risks to personal data privacy”.

“The PCPD considered that the face and iris images collected by the Worldcoin project were unnecessary and excessive, contravening the requirements of Data Protection Principles,” it said.

The privacy commissioner’s office has previously said it lacks the power to restrict the project’s operations in Hong Kong.

The project requires participants to scan their faces and irises to create a “digital passport”, a form of registered identity, in exchange for free Worldcoin cryptocurrency tokens.

The watchdog said that under the Personal Data (Privacy) Ordinance, the project had unfairly collected private information, especially as its “Privacy Notice” and “Biometric Data Consent Form” were not available in Chinese.

Worldcoin had failed to clearly explain to participants legally required information, such as the exact purpose of the data collected, as well as whether the process was voluntary, it added.

The watchdog slammed the project’s policy of retaining information for up to 10 years to train artificial intelligence (AI) software to perform user verification, describing it as a “prolonged” data retention period.

The privacy commissioner also took aim at Worldcoin’s lack of transparent personal data policies and practices, noting the latter had failed to allow participants to exercise their rights to access or correct their personal data.

The Worldcoin Foundation has been served an enforcement notice requiring it to “cease all operations” in Hong Kong that involve the collection of iris and face scans.

In reply to the Post inquiry on Thursday, Worldcoin said it was disappointed by the views of the regulatory authorities in Hong Kong.

“Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong, among many other similar statutes across other markets,” its spokesman said.

He added the firm continued to raise the privacy bar through the principle of ‘data minimisation’, user control over data and advanced technology such as iris code deletion in an effort to prepare humanity for the age of artificial intelligence.

“Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process.”

Technology company Tools for Humanity, which was co-founded by OpenAI’s Altman, officially launched the project in 2023. The initiative claims to have signed up more than 5.3 million applicants from over 160 countries and territories.

Worldcoin has come under scrutiny in various countries over privacy concerns regarding its collection of biometric data, with its operations being suspended in Spain, Portugal and Kenya.

The privacy watchdog has previously raided six of the project’s locations in Hong Kong four months ago, in addition to conducting 10 covert visits to those places between December 2023 and January 2024.

Francis Fong Po-kiu, an honorary president of the Hong Kong Information Technology Federation, said using retina biometrics could enhance the security of virtual assets compared with methods such as fingerprint and facial recognition.

As long as Worldcoin and other cryptocurrency ventures complied with the city’s biometric data collection policies, their operations would be unaffected by the watchdog’s instruction.

Lawmaker Johnny Ng Kit-chong, who also described himself as a cryptocurrency investor, said using retina scans could be advantageous as it ensures assets were owned by real people.

Discussing the 8,000 people in Hong Kong who had already joined the project, the legislator said anyone taking part in the scheme who had concerns had a right to request that their data be destroyed.

Ng also advised participants to look out for any abnormalities in their financial records.

Additional reporting by Oscar Liu