Portugal orders Sam Altman's Worldcoin to halt data collection

By Elizabeth Howcroft

LONDON (Reuters) -Portugal's data regulator has ordered Sam Altman's iris-scanning project Worldcoin to stop collecting biometric data for 90 days, it said on Tuesday, in the latest regulatory blow to a venture that has raised privacy concerns in multiple countries.

Worldcoin encourages people to have their faces scanned by its "orb" devices, in exchange for a digital ID and free cryptocurrency. More than 4.5 million people in 120 countries have signed up, according to Worldcoin's website.

Portugal's data regulator, the CNPD, said there was a high risk to citizens' data protection rights, which justified urgent intervention to prevent serious harm. More than 300,000 people in Portugal have provided Worldcoin with their biometric data, the CNPD said.

The regulator said it had received dozens of complaints in the last month about unauthorised collection of data from minors, "deficiencies in the information provided to the data subjects" and "the impossibility of erasing the data or withdrawing consent."

Jannick Preiwisch, data protection officer at the Worldcoin Foundation said Worldcoin was "fully compliant with all laws and regulations governing the collection and transfer of biometric data".

"The report from CNPD is the first time we are hearing from them regarding many of these matters, including reports of underage sign-ups in Portugal, for which we have zero tolerance for and are working to address in all instances, even if a matter of a few reports," Preiwisch said in an emailed statement.

Worldcoin also said that the company in March began a transition to "Personal Custody" which would give users control over their data, including deletion and any future use.

The CNPD said the order to stop data collection was temporary while it carried out additional due diligence and analysed complaints during an investigation.

PRIVACY CONCERNS

Worldcoin says it aims to build an "identity and financial network", which Altman says will be necessary for people to prove that they are human in a world dominated by artificial intelligence. Altman is CEO of OpenAI as well as co-founder of the company behind Worldcoin.

Worldcoin is under investigation in various countries and has drawn criticism from privacy campaigners over the collection of personal data.

UK privacy campaign group Big Brother Watch said after Worldcoin's launch there was a risk biometric data could be hacked or exploited, with senior advocacy officer Madeleine Stone adding that digital ID systems "rarely live up to the extraordinary benefits technocrats tend to attribute to them".

Spain's data protection regulator issued a three-month ban on Worldcoin, in response to complaints, earlier this month. Kenya suspended Worldcoin's activities in August.

The Bavarian state regulator has said it is the lead authority investigating Worldcoin under the European Union's data protection rules because Tools For Humanity, the company behind Worldcoin, has a German subsidiary there.

The CNPD's suspension refers instead to the Worldcoin Foundation - a Cayman Islands entity described on its website as "memberless", having no owners or shareholders. The Worldcoin Foundation's website says it is the only member and director of a British Virgin Islands company called World Assets Ltd, which is responsible for issuing the Worldcoin tokens allocated to people who sign up.

The CNPD said that its decision was addressed to the Worldcoin Foundation because that entity is the data controller for the biometric data.

Worldcoin is backed by some of the most prominent venture capital names, including a16z crypto and Bain Capital Crypto.

(Reporting by Elizabeth HowcroftEditing by Tommy Reggiori Wilkes and Louise Heavens)