Worldcoin Halts Spain Operations, Challenges Temporary Ban in Court

Worldcoin’s German Subsidiary Files Legal Challenge Against Spanish Data Protection Authority’s Suspension Order

Worldcoin Accused of Violating GDPR Regulations

On Friday, it was reported that a German subsidiary of Sam Altman’s controversial crypto blockchain digital identity business, Worldcoin, had filed a legal challenge against a suspension order from the Spanish data protection authority (AEPD). The company also informed us that it has temporarily halted its services in the Spanish market.

The AEPD had previously instructed Worldcoin to stop scanning people’s eyeballs and processing data collected from individuals in Spain, citing concerns over the level of information provided about the processing, the collection of data from minors, and the inability for users to withdraw consent. The authority emphasized the sensitive nature of the biometric data involved, which it said poses “high risks for people’s rights”.

Worldcoin Claims Compliance with EU Laws

Despite the GDPR allowing for urgent interventions by non-lead data protection authorities, Worldcoin is challenging the AEPD’s order. In a statement, Tools for Humanity, Worldcoin’s operating company, claimed that its eyeball-scanning business is “fully compliant” with all EU laws related to biometrics, data transfer, data processing, and data protection. The company accused the AEPD of circumventing “accepted EU process and rules”, leaving it with “little recourse” but to file a lawsuit.

Worldcoin is fully compliant with all laws and regulations governing biometric data collection and data transfer, including Europe’s General Data Protection Regulation (“GDPR”). As such, we have been in consistent and ongoing dialog with our lead Data Privacy Authority in the EU, BayLDA, for months. We were disappointed that the Spanish regulator circumvented the accepted EU process and rules, which leaves us little recourse but to file suit.

Worldcoin’s Operations in Spain

Worldcoin has confirmed that it has “paused” its operations in Spain. The company’s website initially listed 29 locations across the country where people could have their eyeballs scanned in exchange for crypto tokens. However, following the AEPD’s order, the number of listed locations has been reduced to five, suggesting that Worldcoin may be in the process of shutting down its scanning operations in the market.

Concerns Over Worldcoin’s Biometric Data Collection

One of the main controversies surrounding Worldcoin is its practice of acquiring people’s sensitive biometrics in exchange for a form of payment. While the company claims that users are consenting to their data being processed, the GDPR requires consent to be freely given, and a financial incentive may mean that people are not able to freely consent as required by law.

Other GDPR concerns related to Worldcoin include the transparency and fairness of the processing, issues over data subjects’ rights (such as the right to have personal data deleted), risks to minors, and questions about data transfers and security.

Ongoing Investigations and Warnings

The Bavarian data protection authority (BayLDA), which is leading the investigation into Worldcoin’s compliance with the GDPR, expects to send a draft decision with its findings to other European data protection authorities for review “very soon”. If other authorities raise objections, disputes over decisions will be resolved through majority votes or, if necessary, by the European Data Protection Board.

In Catalonia, where Worldcoin currently lists the most pop-ups for eyeball scanning, the regional government has published an article containing advice and warnings from the Catalan Data Protection Authority. The article warns about the sensitive nature of the personal data being collected, the risks of misuse, and raises specific concerns about children’s data being harvested without proper parental consent.

As the investigations into Worldcoin’s compliance with the GDPR continue, the company faces an uphill battle to prove that its controversial biometric data collection practices adhere to the strict regulations set forth by the European Union.