The Spanish Data Protection Agency orders an injunction preventing Worldcoin from continuing to process personal data in Spain

The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation to cease the collection and processing of personal data being carried out in Spain as part of its Worldcoin project, and to block the data already collected. The AEPD has received several complaints against this company denouncing, among other aspects, insufficient information, the collection of data from minors or that the withdrawal of consent is not allowed.

High risks to the rights of individuals

“The processing of biometric data, considered in the General Data Protection Regulation (GDPR) as of special protection, entails high risks to the rights of individuals, given the sensitive nature of the data. Consequently, this precautionary measure is a decision based on exceptional circumstances, in which it is necessary and proportionate to adopt provisional measures aimed at the immediate cessation of such processing of personal data, prevent its possible transfer to third parties and safeguard the fundamental right to the protection of personal data”, stated in an AEPD press release.

Tools for Humanity Corporation has its European establishment in Germany. This action by the Agency is carried out within the framework of the procedure established in Article 66.1 of the RGPD, which establishes that, in exceptional circumstances, when a supervisory authority concerned – in this case the AEPD – considers it urgent to intervene to protect the rights and freedoms of individuals, it may adopt provisional measures with legal effects in its territory and with a period of validity that may not exceed three months.

In this context, the Agency understands that the adoption of urgent measures of temporary prohibition of activities is justified to avoid potentially irreparable damage and that not taking them would deprive individuals of the protection to which they are entitled under the GDPR.