The AEPD pronounces on the Worldcoin case

The AEPD pronounces on the Worldcoin case

On March 6, 2024, the Spanish Data Protection Agency (hereinafter, the “AEPD”) issued a statement ordering Tools for Humanity Corporation, as a precautionary measure, to cease the collection and processing of personal data being carried out in Spain under its Worldcoin project.

Worldcoin, the company founded by OpenAI leader Sam Altman, is a form of digital currency, specifically a cryptocurrency, designed to provide a unique identification and facilitate user participation in the global economy.

To achieve this, its operation is based on a device known as the “orb,” which scans the human eye iris and provides a unique code that no one else possesses. The fundamental purpose is to ensure that the user’s identity is unimpeachable and that no one else can access the user’s money improperly.

When registering with the orb, the user receives a series of tokens called WLD. These tokens allow for purchases, money transfers, or backing projects according to user preferences. Worldcoin aims to be a currency accessible to all, regardless of origin or place of residence.

Measures imposed by the AEPD on Worldcoin

The Spanish Data Protection Agency (AEPD) has received multiple complaints against this company, addressing issues such as inadequate information, collection of data from minors, and the impossibility of revoking consent.

The handling of biometric data, considered high-risk according to European and national regulations on data protection, poses serious implications for individual rights due to the sensitivity of such data.

Hence, the precautionary measure taken constitutes a response grounded in exceptional circumstances, where it is necessary and proportionate to implement temporary measures to immediately halt the processing of such personal data, prevent their possible transfer to third parties, and guarantee the fundamental right to the protection of personal data. Tools for Humanity Corporation is headquartered in Germany.

The intervention of the Agency is framed within the procedure established in Article 66.1 of the GDPR, which allows a supervisory authority, in this case, the AEPD, to take provisional measures with legal effects in its territory when it deems urgent to intervene to protect the rights and freedoms of individuals, with a validity limit of three months.

Impact of the Measures on Worldcoin

As we have mentioned, these measures imply that Worldcoin, despite remaining active, cannot operate within Spain, nor can it currently use the data it may have already collected from individuals within the national territory.

Worldcoin’s Response to the AEPD

In response to this decision, Worldcoin has chosen to appeal to the judiciary. However, the initial ruling on the appeal has been unfavorable to its interests, as the National Court has rejected the request for a precautionary measure and has upheld the temporary suspension of data collection by Worldcoin.

In this context, the National Court has supported the AEPD, justifying that “the protection of the right to the protection of personal data of the interested parties must prevail over the particular interest of the recurring company, fundamentally of an economic nature.”

The court supports the blocking measure because, in case Worldcoin proves that it has been unjustly blocked, it may request economic compensation for the damages suffered. Worldcoin asserts that they strictly comply with the General Data Protection Regulation (GDPR) and are already cooperating with the European Data Protection Authority to demonstrate this.

The next step for Worldcoin would be to file a lawsuit against the AEPD. Worldcoin intends to seek judicial support and, therefore, plans to sue the AEPD.