Worldcoin, a cryptocurrency project that collected iris scans from about 30,000 South Korean users without proper legal grounds and transferred the data overseas in violation of privacy laws (Image courtesy of Yonhap)
SEOUL, Sept. 27 (Korea Bizwire) – South Korea’s Personal Information Protection Commission (PIPC) has imposed a fine of 1.1 billion won on Worldcoin, a cryptocurrency project that collected iris scans from about 30,000 South Korean users without proper legal grounds and transferred the data overseas in violation of privacy laws.
The PIPC announced on September 26 that it had reached this decision during its 16th plenary session held on September 25.
The investigation was initiated in February following complaints that Worldcoin was collecting biometric data in exchange for cryptocurrency without proper authorization.
Worldcoin, launched in July 2023, is an iris recognition-based cryptocurrency developed by Sam Altman, the CEO of OpenAI, known for creating the AI chatbot ChatGPT.
The project uses a spherical device called the Orb to scan and digitize individuals’ irises, linking this data to a blockchain. Once a person’s identity is verified, a World ID is generated, which can be used to create a World App crypto wallet for storing Worldcoins.
According to the PIPC, as of July 6, 93,463 people in South Korea had downloaded the World App, with 29,991 of them completing iris authentication.
The investigation revealed that the Worldcoin Foundation and TFH, a company commissioned by the foundation to process personal information, collected iris data and other personal information without legal grounds and transferred it overseas without adhering to South Korea’s Personal Information Protection Act.
Specifically, the Worldcoin Foundation failed to properly inform users about the purpose of collecting and using their information, as well as the retention and usage period.
The commission noted that iris codes are considered sensitive information that can identify individuals and cannot be changed, requiring separate consent and enhanced security measures, which were not implemented.
Both the Worldcoin Foundation and TFH were found to have transferred personal information collected in South Korea to other countries, including Germany, without notifying the users of relevant details as required by law.
Furthermore, the Worldcoin Foundation did not provide a method for users to request deletion or suspension of processing their iris codes. TFH was found to have insufficient procedures for verifying the age of users under 14 when registering for the World App.
As a result, the PIPC decided to impose fines of 725 million won on the Worldcoin Foundation and 379 million won on TFH for violations related to sensitive information processing and overseas data transfer obligations.
The commission also issued recommendations to the Worldcoin Foundation, including implementing separate consent procedures for processing sensitive information, prohibiting the use of personal information for purposes other than those initially collected, and providing a feature for users to delete their personal information.
TFH was urged to introduce age verification procedures within the World App. Both companies were ordered to fully inform users about legal requirements when transferring personal information overseas.
Nam Suk, director of the Investigation and Coordination Bureau at the PIPC, stated, “We have confirmed that all original iris information previously collected has been destroyed. We plan to ensure that deletion or destruction is possible upon request from the data subjects in the future.”
Worldcoin responded with a statement saying, “We fully respect the PIPC’s decision. We have implemented state-of-the-art security measures and anonymization technologies prioritizing personal information protection, and we will continue meaningful dialogue with the PIPC to help them understand our approach.”
M. H. Lee (mhlee@koreabizwire.com)
