.svg)
The Personal Information Protection Commission of South Korea has become the latest regulator to crack down on the Sam Altman-backed project, imposing a financial penalty and taking remedial action.
The data protection watchdog has imposed fines totalling KRW1.14bn ($866,165) on Worldcoin Foundation and its affiliate, Tools for Humanity Corporation (TFH), for violating the country’s Personal Information Protection Act.
The penalties were issued following an investigation into improper handling of sensitive biometric data, including iris information, by both entities.
Worldcoin is a for-profit cryptocurrency project that uses iris biometrics developed by Altman, who is also behind OpenAI, and the Berlin-based TFH.
It aims to authenticate humans online through its World ID system, recruiting users by scanning their irises with an orb-shaped scanner in exchange for WLD tokens, which has prompted privacy concerns globally.
Launched in 2021, WLD is an ethereum-based cryptocurrency, and Worldcoin’s ambitions are apparently to build a more equitable economy.
Transferring sensitive data
The Korean investigation, initiated in February this year after complaints and media reports, revealed that Worldcoin Foundation and TFH collected and transferred biometric information of nearly 30,000 South Korean users without sufficient legal consent.
The data, primarily gathered through iris scans for Worldcoin's World ID authentication, was transferred overseas without proper notification to users, which is a violation of the Protection Act's compliance requirements.
The commission found that Worldcoin failed to notify users of the purpose and retention period of the data and did not obtain separate consent for processing sensitive information. Additionally, the details of these processes were only available in English, with a Korean version to be provided by March 2024.
Further violations included the lack of age verification in the World App and insufficient procedures for users to request deletion of their data.
As a result, Worldcoin Foundation was fined KRW725m, while TFH was fined KRW379m won.
The commission also issued corrective orders, requiring both organisations to strengthen data protection measures, including clearer notifications for users and more robust deletion functions.
Worldwide scrutiny
South Korea is far from the first country that has taken action against Worldcoin, and many data protection authorities across the globe are monitoring its activity.
For example, the project, which is based out of Germany, is being investigated by both the Bavarian data protection authority and the national financial regulator, the Federal Financial Supervisory Authority (BaFin).
In the meantime, it has agreed to stop its activity in jurisdictions such as Spain and Portugal until an official decision has been made by the German authorities.
Additionally, it has been shut down in Kenya over data privacy concerns, and has exited Brazil and India.
