France's privacy watchdog, CNIL (Commission Nationale de l'Informatique et des Libertés), has expressed apprehension over the biometric data collection practices of the recently launched Worldcoin project.
Founded by Sam Altman, the project requires users to provide their iris scans in exchange for a digital ID and, in select countries, free cryptocurrency. While the Worldcoin Foundation claims to have signed up 2.1 million people during a two-year trial period, CNIL is raising questions about the legality and storage conditions of the collected biometric data.
Following Worldcoin's high-profile launch on last week, regulatory bodies worldwide have been scrutinising the project's data collection methods. The Information Commissioner's Office in Britain has already announced its intentions to inquire about Worldcoin after its debut.
In response to a Reuters inquiry about Worldcoin, CNIL addressed the project's biometric data collection, stating, "The legality of this collection seems questionable, as do the conditions for storing biometric data." Consequently, CNIL has initiated investigations, though it has determined that the jurisdiction for the inquiry falls under the Bavarian state authority in Germany. As such, the Bavarian authority is currently leading the investigation, with support from CNIL.
The Worldcoin Foundation, based in the Cayman Islands, oversees the project and emphasises its commitment to individual privacy protection. The foundation claims to have built a robust privacy program to ensure compliance with regulatory requirements in markets where Worldcoin operates.
"The Worldcoin Foundation complies with all laws and regulations governing the processing of personal data in the markets where Worldcoin is available," the foundation stated via email.
The project's operations in the European Union fall under the supervision of the Bavarian State Office for Data Protection Supervision, according to the Worldcoin Foundation. The foundation has also pledged to cooperate with governing bodies and provide additional information about its privacy and data protection practices as requested.
(Inputs from Reuters)