AEPD orders an injunction preventing Worldcoin to continue processing personal data in Spain

AEPD orders an injunction preventing Worldcoin to continue processing personal data in Spain

On March 6, 2024, the Spanish Data Protection Agency (hereinafter, AEPD) published on its official website its decision to order an injunction against the technology company Tools for Humanity Corporation to stop collecting and processing personal data in Spain within the framework of its “Worldcoin” project, and to immediately block the data already collected.

This company, although it has its European establishment in Germany, has extended its project to numerous countries of the European Union, including Spain. Therefore, and as stipulated in Article 66.1 of the General Data Protection Regulation (hereinafter, GDPR), in exceptional circumstances, and when a Supervisory Authority of a country (in this case the AEPD) considers it appropriate and urgent to intervene to protect the rights and freedoms of its citizens, it may adopt precautionary or provisional measures with legal effects in its territory, as has occurred in the case at hand.

What is the Worldcoin project?

Worldcoin is a biometric cryptocurrency project promoted by the technology company Tools for Humanity Corporation, which was created with the aim of promoting a more unified and equitable global economy.

Its particularity lies in the fact that it is based on iris recognition and, in essence, what is intended is to provide a more reliable way to authenticate online humans using this virtual currency, thus counteracting the use of bots and fake virtual entities created through the use of artificial intelligence.

In this sense, this project has been preceded by controversy since its inception since, different technology magazines have issued articles bringing to light the controversial practices carried out by Worldcoin, expressly citing that this company took advantage of impoverished people to grow its network, offering a payment of around 88 Worldcoin tokens in exchange for obtaining the biometric data (iris) of the person in question.

Decision of the AEPD and its motivation

When this Worldcoin project landed in Spain, the AEPD received numerous claims and complaints from Spanish users denouncing, among other aspects, the fact that Worldcoin allows the collection of data from minors and that it hinders the withdrawal of consent once it has been given.

In this regard, it should be noted, firstly, that the processing of personal data of minors can only be based on the express consent of those users who are over 14 years of age or, otherwise, when express consent is granted by the parents or guardians of the minor. However, this group is particularly protected by the GDPR and the processing of their data, especially when it concerns biometric data, cannot be used lightly.

Moreover, the processing of biometric data in general is considered by the GDPR as information subject to special protection, since its processing entails high risks to the rights and freedoms of individuals, given its sensitive nature. Therefore, and if we add to this fact the impossibility for users to exercise their inherent rights, such as the right of deletion or withdrawal of the consent granted, the decision taken by the AEPD on the Worldcoin case to temporarily prohibit the activity of Tools for Humanity Corporation to avoid potentially irreparable damage to citizens is logical and justified.

It should be noted that the temporary ban on the activity in Spain of the Worldcoin project will have a maximum validity period of three (3) months, during the course of which the AEPD will have to discern next steps.