Worldcoin fined 1.1 billion won for illegally collecting and transferring iris data of 30,000 people in South Korea

Worldcoin, founded by OpenAI CEO Sam Altman, has come under fire in South Korea for illegally collecting and transferring iris data from approximately 30,000 users. The company operates a biometric identification system called World ID, which allows users to scan their irises using a device known as Orb to prove their identity and receive Worldcoin token airdrops.

Worldcoin Fined for Biometric Data Violations in South Korea

According to reports from the Korea Herald, the Personal Information Protection Commission (PIPC) of South Korea imposed a fine of 1.1 billion KRW (approximately $830,000) on Worldcoin for violating the Personal Information Protection Act. This action was prompted by complaints received in February last year regarding the company's collection of biometric data in exchange for virtual assets.

The PIPC found that both the Worldcoin Foundation and a contractor, TFH, collected iris data without proper user consent and transferred this data overseas, breaching local laws. As of September 6, nearly 93,463 people had downloaded the World App, with 29,991 users undergoing iris authentication.

Specific Violations

The investigation revealed that Worldcoin failed to adequately inform users about the purposes of data collection and the duration for which the data would be stored. Given that iris data is sensitive and immutable, the law requires explicit user consent for its collection. The Worldcoin Foundation also did not inform users when transferring data to Germany and other countries.

The commission highlighted several shortcomings:

• The Worldcoin Foundation did not establish procedures for users to request deletion or halt processing of their iris data.

• TFH lacked age verification processes, allowing children under 14 to register for the World App without parental consent.

Consequently, the PIPC levied a fine of 725 million KRW against the Worldcoin Foundation for mishandling sensitive data and 379 million KRW against TFH for failing to comply with overseas data transfer obligations, resulting in a total fine of 1.1 billion KRW.

Recommendations for Improvement

In light of these violations, the PIPC issued three key recommendations for the Worldcoin Foundation:

1. Establish separate consent procedures for processing sensitive information.
2. Prohibit the use of personal data for purposes other than those initially collected.
3. Provide functionalities for users to delete their personal data.

TFH was also instructed to implement an age verification process within the World App. A PIPC official noted that all original iris data collected has been deleted, and future requests for data deletion or destruction will be honoured.

Worldcoin's Response

In a statement, Worldcoin expressed full respect for the PIPC's decision and emphasised that it has implemented updated security measures prioritising data protection and anonymisation techniques. The company stated its intention to continue meaningful dialogue with the PIPC.

Previously, Worldcoin has faced investigations for privacy violations in France, the UK, Hong Kong, Colombia, and Argentina. Last month, authorities in Singapore arrested five individuals suspected of offering Worldcoin accounts and tokens for sale, warning consumers to be vigilant against potential involvement in money laundering or terrorist financing activities.

Read more: Singapore Cracks Down on Worldcoin Trading: Seven Individuals Under Investigation