CNPD orders suspension of biometric data collection by worldcoin

The CNPD ordered the company responsible for processing the data to temporarily limit the collection of biometric data within 24 hours, for a period of 90 days, until the CNPD completes its investigation and issues a final decision.

The adoption of this urgent provisional measure comes in the wake of dozens of reports received by the CNPD in the last month, reporting the collection of data from minors without the authorization of their parents or other legal representatives, as well as deficiencies in the information provided to data subjects, the impossibility of deleting data or revoking consent. It is estimated that more than 300,000 people in Portugal have already provided their biometric data, a prerequisite for receiving a certain amount of cryptocurrency, known as Worldcoin.

The data collection points using the “Orb” device, located in large shopping centers, have almost doubled in six months. The large turnout of people, including minors, to join the Worldcoin project and receive tokens has led to the need to pre-book the registration and biometric data collection process. There is no mechanism for verifying the age of members. Biometric data is classified as special data in the GDPR and therefore enjoys increased protection, and the risks of processing it are high. On the other hand, minors are particularly vulnerable people and are also subject to special protection by the European and national legislator, as they may be less aware of the risks, consequences and guarantees of the processing of their personal data, as well as their rights. 

Given the current circumstances, in which the processing of minors' biometric data is unlawful, coupled with potential violations of other GDPR rules, the CNPD considered that the risk to citizens' fundamental rights is high, justifying urgent intervention to prevent serious or irreparable damage.

However, the CNPD is still investigating aiming to conclude the process. The CNPD's decision can be read here​.