ExplainerWhy Hongkongers should protect biometric data: after cryptocurrency Worldcoin is banned from face and iris scans collection, the Post talks to experts

The Hong Kong privacy watchdog’s decision to ban cryptocurrency Worldcoin from obtaining images of faces and irises of people through its devices in the city has sparked an objection from Sam Altman, its creator. The Privacy Commissioner for Personal Data on Wednesday ruled the collection of the biometric information breached the Personal Data (Privacy) Ordinance and was “unnecessary and excessive” after an investigation was launched last December. But Altman, also the creator of OpenAI’s ChatGPT, insisted Worldcoin operated legally and the digital currency’s policies were designed to be compliant with legislation. Here the Post examines the dispute and what Hongkongers can do to safeguard their biometric information. 1. What are the privacy concerns? The privacy commissioner carried out 10 undercover visits at six locations involved in the Worldcoin project between December 2023 and January 2024. The watchdog raided six of the premises, at Yau Ma Tei, Kwun Tong, Wan Chai, Cyberport, Central and Causeway Bay, on January 31. The investigation found the initiative required participants to provide facial and iris scans to verify their “humanness” and create a “digital passport”, a type of registered identity, in exchange for free cryptocurrency tokens. Biometric information was collected from 8,302 individuals across the city. But the watchdog slammed the Worldcoin project for illegally collecting private information. Officials also highlighted the absence of Chinese versions of documents such as a “privacy notice” and a “biometric data consent form”. The watchdog ruled Worldcoin’s information-collecting method was unfair because it failed to keep participants informed of possible risks related to disclosure of biometric information and did not answer reasonable questions. The privacy commissioner added the company had also not adequately explained to participants important details, such as the purpose of the information collection and the voluntary nature of participation. The watchdog criticised the project policy of data retention for up to 10 years to train artificial intelligence software for user verification as excessively long. 2. How did Worldcoin defend itself? Cayman Islands-based Worldcoin Foundation, which is behind the project, said it was disappointed by the views by the regulatory authorities. It stressed it operated within the law and was designed to be compliant with laws and regulations on data collection and use in Hong Kong, as well as in many other markets. Worldcoin said that the foundation continued to raise the privacy bar through data minimisation, user control over data and advanced technology such as personal custody, iris code deletion and secure multiparty computation. “Unfortunately, the authorities in Hong Kong overlooked these aspects in their evaluation of the humanness verification process,” a company spokesman said. But Worldcoin did not say whether it would stick to the watchdog’s ruling to suspend its biometric data collection operations in the city or tackle the concerns of participants. The privacy commissioner on Thursday said it had no further comment, but emphasised that an enforcement notice had been served on Worldcoin. 3. What is Worldcoin’s footprint? Technology company Tools for Humanity, co-founded by Altman, launched the Worldcoin project in 2023. It claims to have signed up more than 5.3 million applicants from more than 160 countries and territories. Worldcoin has come in for scrutiny in a variety of countries over privacy concerns linked to its collection of biometric information. Its operations have been suspended in Spain, Portugal and Kenya. 4. How can residents protect themselves? Ronald Pong, the chairman of a committee of the Smart City Consortium, warned people to be vigilant when their biometric data was collected. He said the nature of biometric information meant that, once it was leaked, the individual would lose all control over its use. “Don’t ever surrender your bodily features as a means of authentication because, purely in technical terms, your iris patterns, fingerprints and voiceprints are among the most robust authentication methods,” he said. “There is a significant issue once you hand over this information. If the mechanism responsible for safeguarding this data fails and a breach occurs, you cannot simply obtain new bodily features, as you would with replacing a lost identification card.”