Worldcoin fails to get injunction against Spain’s privacy suspension

Controversial eyeball scanning startup Worldcoin has failed to get an injunction against a temporary suspension ordered Wednesday by Spain’s data protection authority, the AEPD.

The authority used emergency powers contained in the European Union’s General Data Protection Regulation (GDPR) to make the local order, which can apply for up to three months. It said it was taking the precautionary measure against Worldcoin’s operator, Tools for Humanity, in light of the sensitive nature of the biometric data being collected, which could pose a high risk to the rights and freedoms of individuals. It also raised specific concerns about risks to minors, citing complaints received.

Today a Madrid-based High Court declined to grant an injunction against the AEPD’s order, saying that the “safeguarding of public interest” must be prioritized.

As we reported Friday, the crypto blockchain biometrics digital identity firm shuttered scanning in the market shortly after the AEPD order — which gave it 72 hours to comply. Today’s court decision means Worldcoin’s services remain suspended in Spain — for up to three months.

In its appeal against the AEPD’s order, Tools for Humanity had sought to argue the Spanish authority had overstepped by triggering the GDPR’s Article 66 “urgency procedure” — in light of an open investigation by the Bavarian data protection authority, its lead DPA under the GDPR’s mechanism for streamlining oversight of cross-border complaints. It also pointed to the lack of any interventions on its operations by the German authority so far.

However the court found the AEPD’s suspension order to be justified on account of the risks around biometric data and how many individuals are being put at risk by Worldcoin’s processing, including children. It also noted doubt over the validity of the legal base claimed (consent) and the level of information provided about the processing, and cited concerns about the business’ impact on data subjects’ rights, such as the right to withdraw consent and to have personal data deleted. 

The proceeding provides a few more tidbits of detail on the four complaints received by AEPD — which the court said indicate data from minors is being captured by Worldcoin; insufficient information is being provided; there is no way for people to withdraw consent; and, on data deletion, data subjects are just being directed to delete the app (i.e. which would not result in all their personal data being erased). Additionally, the court notes one of the complainants told the AEPD that a supposed deletion procedure does not work, as it requires the company to send a code by mail that always arrives late, rendering it invalid when it reaches them.

In appealing for an injunction, Tools For Humanity also sought to argue the temporary suspension would cause its global business “irreparable harm”, including suggesting it would cause economic harm, damage its reputation and make the future success of its eyeball-scanning venture less likely.

Again, the Court was unimpressed, dismissing what it described as “unsubstantiated assertions” and pointing out the AEPD’s suspension is time-limited; only applies in Spain; and is compensable (i.e. there’s a route for it to claim compensation in future if it prevails in court).

Reached for comment on the dismissal of its appeal for an injunction, Tools for Humanity’s spokeswoman, Rebecca Hahn, emailed a statement she said is attributable to Worldcoin:

Worldcoin is fully compliant with all laws and regulations governing biometric data collection and data transfer, including Europe’s General Data Protection Regulation (“GDPR”). Since our previous attempts to engage AEPD went unanswered, we look forward to the opportunity to demonstrate this compliance and provide the regulator with accurate and important information regarding this essential and lawful technology in the Spanish High Court.