South Korea Hits Worldcoin and TFH With $830K Penalty for Mishandling Sensitive Data

• South Korea penalized Worldcoin and TFH $830,000 for violations in biometric data handling and transparency lapses.
• Worldcoin and TFH failed to properly inform users about data storage and transfers, violating South Korean privacy regulations.
• Despite the fines, TFH has adjusted practices and will continue biometric verification while complying with South Korean laws.

South Korea’s Personal Information Protection Commission (PIPC) has imposed a penalty on Worldcoin and its development firm, Tools For Humanity (TFH). The fines, totaling 1.1 billion Korean won ($830,000), stem from alleged violations regarding the collection and transfer of personal data. 

Notably, the project failed to properly inform subjects about the collection and handling of sensitive biometric data, specifically scanned iris information, sparking concern among regulators.

Insufficient Notification on Data Collection and Transfer

The PIPC highlighted that Worldcoin and TFH did not adequately communicate the purpose or duration of data storage, as required by South Korean law. Specifically, the foundation failed to provide a Korean-language version of the biometric consent form until March 22. This created gaps in transparency around how users’ personal information, including iris scans, was being collected and stored.

Further scrutiny revealed the data transfer process lacked essential disclosures. Notably, Worldcoin and TFH did not inform users of the country to which their personal information would be sent, nor did they provide details about the individuals handling that data abroad. These omissions violated South Korean regulations, prompting the fine.

Fines for Mishandling Sensitive Data and Minors

The Worldcoin Foundation faces a 725 million won ($545,000) fine for its mishandling of sensitive biometric data and the improper overseas transfer of information. TFH, the project’s developer, was fined 379 million won ($285,133) for failing to meet its duties in the overseas data transfer process.

Adding to the violations, TFH did not implement proper age-verification measures for users under 14 until April this year. The lack of a system to ensure that minors were not signing up for the platform raised additional concerns.

Remedial Actions and Compliance Moving Forward

Despite the penalties, the PIPC did not ban the collection of sensitive data, leaving room for Worldcoin to amend the identified issues. TFH has since adjusted its practices, ensuring that its operations comply with the South Korean Personal Information Protection Act. According to TFH, the company now complies with the regulations and will continue using its orb device to verify “humanness” while adhering to local laws.

In February, the PIPC launched its investigation into Worldcoin, concluding that the project must improve transparency around data collection and transfer. Although penalized, the project remains active in South Korea, with TFH expressing a commitment to meeting regulatory requirements moving forward.