Controversial eyeball scanning startup Worldcoin failed to obtain a temporary suspension order ordered by Spain’s data protection authority, AEPD, on Wednesday.
The authority used emergency powers contained in the European Union’s General Data Protection Regulation (GDPR) to make the local order, which can last for up to three months. It said it is taking the precautionary measures against Worldcoin’s operator, Tools for Humanity, in light of the sensitive nature of the biometric data collected, which could put the rights and freedoms of individuals at high risk. It also raised specific concerns about risks to minors, citing complaints received.
Today, a Madrid-based High Court refused to issue an injunction against the AEPD’s order, saying priority should be given to “ensuring the public interest”.
As we reported on Friday, the cryptocurrency blockchain biometric digital identity firm shut down its market sweep shortly after the AEPD order – which gave it 72 hours to comply. Today’s court ruling means Worldcoin’s services remain suspended in Spain — for up to three months.
In its appeal against the AEPD’s order, Tools for Humanity had tried to argue that the Spanish authority had bypassed the “urgent procedure” of Article 66 of the GDPR — in light of an open investigation by the Bavarian data protection authority, the head of the DPA under the GDPR mechanism to streamline the supervision of cross-border complaints. It also pointed to the lack of any interference in its operations by the German authority so far.
However, the court ruled that AEPD’s suspension order was justified due to the risks surrounding biometric data and how many people are being put at risk by Worldcoin’s processing, including children. It also noted doubts about the validity of the requested legal basis (consent) and the level of information provided about the processing and raised concerns about the impact of the business on the rights of data subjects, such as the right to withdraw consent and erasure of personal data.
The filing provides a few more details about the four complaints received by AEPD — which the court said show that data from minors is being captured by Worldcoin. insufficient information is provided; there is no way for people to withdraw their consent. and, with regard to data deletion, data subjects are simply prompted to delete the application (ie, which would not result in the deletion of all their personal data). Additionally, the court notes that one of the complainants told AEPD that a purported erasure process doesn’t work because it requires the company to send a code by mail that always arrives late, rendering it invalid when it reaches them.
In appealing for an injunction, Tools For Humanity also sought to argue that the temporary suspension would cause “irreparable harm” to its global business, including suggesting it would cause financial harm, damage its reputation and make future success less likely of her bulb scan venture. .
Again, the Court was unimpressed, rejecting what it described as “baseless allegations” and noting that AEPD’s suspension is time-limited. valid only in Spain. and it is compensable (ie there is a way to claim compensation in the future if it prevails in court).
Tools for Humanity spokeswoman Rebecca Hahn, seeking comment on the denial of her injunctive relief, emailed a statement she said was attributed to Worldcoin:
Worldcoin fully complies with all laws and regulations governing biometric data collection and data transfer, including the European General Data Protection Regulation (“GDPR”). Since our previous attempts to engage AEPD have gone unanswered, we look forward to the opportunity to demonstrate this compliance and provide the regulator with accurate and important information about this essential and legal technology in the Spanish Supreme Court.
