It was reported on Friday that a German branch of Sam Altman’s controversial crypto blockchain digital identity business, Worldcoin, had filed a court challenge against a suspension order from Spain’s data protection authority.
This week, it came to light that the AEPD, the Spanish government agency, had told Worldcoin to temporarily stop reading people’s eyes or processing any more data they had already gathered from people in the market.
According to what we reported on Wednesday, the AEPD said it would start a “urgency procedure” under Article 66 of the General Data Protection Regulation (GDPR) against Worldcoin. It said it was doing this because it had received several complaints. Concerns it raised include how little information Worldcoin gives about the processing, the fact that data from children is collected, and the fact that consent can’t be revoked. The report also talked about how sensitive the genetic data was and how it poses “high risks for people’s rights.”
Tools for Humanity, which runs Worldcoin, is “main established” in Germany, which means it can take advantage of the GDPR’s one-stop-shop mechanism for easier regulatory oversight, with the Bavarian DPA (aka BayLDA) acting as its lead authority for oversight and complaints. However, the regulation gives any other DPA the power to issue temporary orders that last up to three months if it thinks there is a “urgent need” to do so.
These kinds of orders only work in the authority’s own market, not all over the EU. This means that the AEPD’s short ban on Worldcoin only works in Spain.
Even though the GDPR allows non-lead DPAs to step in right away, Worldcoin is fighting the AEPD’s order.
The news of the event was first covered in German media. Becky Hahn, a spokeswoman for Worldcoin, sent TechCrunch an email with a link to Schwabisch’s story because she wanted to bring it to their attention. There was also a statement sent by her that was attributed to Worldcoin. In it, Tools for Humanity says that its eyeball-scanning business is “fully compliant” with all EU rules about biometrics, data transfer, data processing, and data protection. In the statement, it is also said that the AEPD broke “accepted EU process and rules,” which gave it “little choice” but to file a lawsuit.
This is what Worldcoin said in full:
Worldcoin follows all the rules and laws that cover collecting and sending personal data, such as the General Data Protection Regulation (GDPR) in Europe. So, for months, we’ve been talking to BayLDA, which is our lead Data Privacy Authority in the EU, in a steady way. We were upset that the Spanish regulator didn’t follow the EU’s accepted process and rules. Now we have no choice but to file a lawsuit.
When asked for more information about the legal arguments Tools for Humanity plans to make against the AEPD’s order, Hahn did not reply. To find out if Worldcoin and its employees in Spain have followed the law and stopped collecting and using people’s data from the market has also not been done.
The AEPD was asked for a word on Worldcoin’s challenge, but they had not replied by the time of press.
The report by Schwabisch says that Worldcoin was “largely developed” in Erlangen, which is in Bavaria, Germany. It lists Alex Blania, a German computer scientist (shown above), as one of the founders of Tools for Humanity, along with Altman from OpenAI. On his LinkedIn page, Blania says that he lives in San Francisco.
At the time this was written, Worldcoin.org still listed five “pop-up” sites in Spain—three in Barcelona, one in Madrid, and one in Malaga—where people could go to have one of Worldcoin’s orbs scan their eyes. Thursday, Worldcoin’s website showed 29 places across the country where people could go to get their biometrics taken in exchange for some crypto coins. Which means it might be about to stop scanning operations in the market.
One of the problems with the business is that it takes people’s private personal information in exchange for money. Worldcoin says that users agree for their information to be used in this way. But in the EU, the GDPR says that permission must be freely given. And a financial incentive is a clear incentive, which could mean that people can’t freely consent as the law sees it.
The GDPR also raises concerns about Worldcoin when it comes to the fairness and openness of the processing, the rights of data subjects (like the right to have personal data deleted), the safety of children, and data transfers and security.
The BayLDA’s probe into whether Worldcoin follows the GDPR, which began last year, is still going on. The authority told us yesterday, though, that it plans to send a draft decision with its findings to the other European data security authorities “very soon” so that they can look it over.
Under the GDPR, other authorities that are worried about cross-border processing can object to a draft decision if they don’t agree with what the lead authority has decided. In that case, disagreements about choices are either settled by majority votes or, if the DPAs can’t agree, the European Data Protection Board has the power to make a decision. This means that the regulation lets one authority keep an eye on groups like Worldcoin, but it was made so that other authorities are still involved in choices that affect users in their own markets.
The autonomous community of Catalonia in Spain has three of the most pop-ups for eyeball scanning on Worldcoin. Recently, local news outlets reported that the regional government had responded to concerns about the company’s biometric scanning operations by publishing an article with advice and warnings from the Catalan Data Protection Authority.
The article raises concerns about the “particularly sensitive personal data” that is being collected through eye scans and the harms that could happen if this data is misused. It also raises concerns about children’s data being collected without their parents or guardians’ permission.
Also Read: The World’s First Eyeball Scanner, Orb, Will Get a New Look That Will Make It Look “friendlier.”
The article also says that “several” EU officials are looking into whether Worldcoin follows the GDPR right now.
What do you say about this story? Visit Parhlo World For more.
