Worldcoin Foundation – Order (Italy, 2024)

The Italian DPA (Garante) initiated an investigation concerning the Worldcoin Foundation’s (the controller) cryptocurrency project. The controller offers a phone application (World App) where data subjects create a digital identity profile (World ID). An in-person device called the ‘Orb,’ which scans data subjects’ irises and faces, can be used to establish a ‘verified’ World ID. In exchange for the biometric data, data subjects are offered ‘free’ Worldcoin tokens via the phone application. During the investigation, the Garante observed that Italian citizens could download the World App, wherein they could provide personal data and claim ‘free’ tokens. The Garante noted that Orbs were not present in Italy at the time of the investigation. However, it considered that the World App’s availability anticipated the future installation of Orbs in Italy. The Garante also considered that the controller lacked age verification mechanisms for installation of World App or processing of biometric data via the Orb. The Garante made a request for information, which the controller responded to with documentation as well as a data protection impact assessment. It asserted that its legal basis for processing biometric data was consent. The Garante issued a warning against the controller pursuant to Article 58(2)(a) GDPR, finding that the processing of biometric data that may be carried out in Italy would likely lack legal justification under Article 9(2) GDPR and violates Article 7 GDPR consent obligations. The Garante categorised the imaging of data subjects’ irises and faces as ‘biometric data’ pursuant to Article 4(14) GDPR. Processing of such data is generally prohibited under Article 9(1) GDPR, and the Garante cautioned that in this case consent was unlikely to suffice as a justifying legal basis pursuant to Article 9(2) GDPR. It noted that the controller provided insufficient information about risks related to processing for data subjects to form adequate consent pursuant to Article 7 GDPR. In addition, the Garante considered that the promise of free tokens adversely affected conditions for consent. It thus concluded that consent is probably an insufficient legal basis. In addition, the Garante considered that the high risks of processing were exacerbated by the absence of filters preventing children under the age of 18 from accessing Orbs or World App.