The Agency orders a precautionary measure which prevents Worldcoin from continuing to process personal data in Spain

(6 March 2024). The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation so that it ceases the collection and processing of personal data being carrying out in Spain in the framework of its Worldcoin project, and to block the data already collected. The AEPD has received several complaints against this company about insufficient information, the collection of data from minors and the fact that consent cannot be withdrawn, among other infringements.

The processing of biometric data, which under the General Data Protection Regulation (GDPR) merits special protection, given their sensitive nature, entails high risks to the rights of individuals. Consequently, this precautionary measure is a decision based on exceptional circumstances, in which it is necessary and proportionate to adopt provisional measures aimed at the immediate cessation of such processing of personal data, preventing its possible transfer to third parties and safeguarding the fundamental right to the protection of personal data.

Tools for Humanity Corporation has its European establishment in Germany. This action by the Spanish regulator is conducted under Article 66.1 of the GDPR, which establishes that, in exceptional circumstances, when a supervisory authority concerned - in this case the AEPD - considers it urgent to intervene to protect the rights and freedoms of individuals, may adopt provisional measures with legal effects in its territory and with a period of validity that may not exceed three months.

In this context, the Agency considers that the adoption of the urgent measures with the effect of temporarily prohibiting the above-mentioned activities is justified to avoid potentially irreparable damage. The lack of such measures would deprive individuals of the protection to which they are entitled under the GDPR.