German Regulator Orders Worldcoin to Remove Non-Compliant Data

The Bavarian State Office for Data Protection Supervision has ordered Worldcoin to delete non-compliant data. The decision follows an investigation into Worldcoin’s handling of biometric data. The company now has one month to implement a procedure that meets EU data protection standards.

Concerns Over Biometric Data and GDPR Compliance

Worldcoin, launched in July 2023 by Tools for Humanity, uses iris scans for digital identity verification. The BayLDA raised concerns over Worldcoin’s compliance with the General Data Protection Regulation (GDPR). 

The regulator pointed out that the collection of biometric data was not properly aligned with GDPR guidelines. As a result, Worldcoin suspended operations in several EU countries during the investigation.

On December 19, 2023, the BayLDA ruled that Worldcoin must delete data that was collected without proper consent. Additionally, the company will need explicit consent from users before processing their data in the future.

What’s Next for Worldcoin?

Worldcoin seeks clarity on whether its Privacy Enhancing Technologies (PETs) meet the EU's anonymization standards. The company argues that its systems follow privacy regulations. However, the BayLDA remains firm in its stance, emphasizing the need for compliance.

Along with deleting non-compliant data, Worldcoin must revise its data processing procedures. This includes removing iris data collected in the early stages of the project. The company plans to overhaul its system and delete all stored data by May 2024.

This case highlights the ongoing challenges tech companies face in navigating privacy regulations. Worldcoin’s efforts to comply will be closely watched as the digital identity space continues to evolve.