Worldcoin’s Request for Injunction Denied as Spain’s AEPD Upholds Temporary Suspension

Worldcoin has been unsuccessful in obtaining an injunction against a temporary suspension imposed by Spain’s data protection authority, the AEPD. 

The authority used emergency powers granted by the European Union’s General Data Protection Regulation (GDPR) to issue the local order, which can remain in effect for up to three months, according to a report from TechCrunch. 

The AEPD stated that the suspension was a precautionary measure due to concerns about the sensitive biometric data collected by Worldcoin, which could potentially pose a high risk to individuals’ rights and freedoms. 

It also raised specific concerns regarding the potential risks to minors, based on received complaints.

Today, a Madrid-based High Court, declined to grant an injunction against the AEPD’s order, emphasizing the need to prioritize the protection of public interest. 

Worldcoin Ceases Operations in Spain

As previously reported, Worldcoin ceased its scanning operations shortly after receiving the AEPD order, which mandated compliance within 72 hours. 

With the court’s decision, Worldcoin’s services will remain suspended in Spain for a period of up to three months.

In its appeal against the AEPD’s order, Tools for Humanity, the operator of Worldcoin, argued that the Spanish authority had exceeded its jurisdiction in invoking the GDPR’s Article 66 “urgency procedure.” 

Tools for Humanity also highlighted the absence of any interventions by the German data protection authority, which serves as the lead authority under the GDPR’s cross-border oversight mechanism. 

However, the court determined that the AEPD’s suspension order was justified due to the risks associated with biometric data and the potential impact on individuals, including children. 

The court also expressed doubts about the validity of the claimed legal basis (consent) and the level of information provided regarding data processing. 

It also raised concerns regarding the impact on data subjects’ rights, such as the right to withdraw consent and have personal data deleted.

The court proceedings revealed additional details about the four complaints received by the AEPD. 

These complaints indicated that Worldcoin was capturing data from minors without sufficient information provided, lacked a mechanism for consent withdrawal, and directed data subjects to delete the app without ensuring the complete erasure of their personal data. 

One complainant also noted that the deletion procedure did not work as intended, as the company sent a code by mail that arrived late, rendering it invalid upon receipt.

Tools for Humanity Says Suspension Would Harm Global Business

In their appeal for an injunction, Tools for Humanity argued that the temporary suspension would cause irreparable harm to their global business, including economic losses, reputational damage, and potential hindrance to the success of their eyeball-scanning venture. 

However, the court dismissed these arguments as unsubstantiated, highlighting that the AEPD’s suspension was time-limited, applicable only in Spain, and compensable if Worldcoin prevails in court.

Responding to the dismissal of their appeal, Worldcoin’s spokeswoman, Rebecca Hahn, said the company is compliant with all laws and regulations governing biometric data collection and transfer, including the GDPR. 

“Since our previous attempts to engage AEPD went unanswered, we look forward to the opportunity to demonstrate this compliance and provide the regulator with accurate and important information regarding this essential and lawful technology in the Spanish High Court.”