The Philippines’ National Privacy Commission (NPC) has directed Tools for Humanity (Worldcoin) to stop processing biometric data, emphasizing that biometric information is not a commodity for trade.

“Biometric data is a unique and permanent identifier. When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice“.

According to the NPC, Tools for Humanity’s program — which offered financial incentives in exchange for consent to collect iris biometrics — constituted undue influence. Consent obtained under such circumstances cannot be considered freely given.

The NPC also cited additional compliance gaps:

  • The privacy notice lacked accessible and complete information about the purpose, scope, extent, and duration of processing.
  • The collection of biometrics was deemed unnecessary to achieve the company’s stated goal of “proof of humanity.”
  • Continued processing of the biometric data was found to present a risk of grave and irreparable injury.

Why It Matters in the United States

While this ruling arose under Philippine law, its reasoning aligns with key U.S. privacy principles:

  • Freely given consent. In many U.S. state privacy statutes, processing of sensitive data, including biometric data, requires valid, freely given unmanipulated consent. However, consent is generally not necessary if you can show that the processing is necessary for the stated purpose
  • Data minimization and necessity. Even when consent is not required, regulators increasingly expect businesses to demonstrate that data processing is necessary, proportionate, and adequate for a legitimate purpose and that you can’t accomplish your purpose through less privacy-invasive means. You would also need to conduct a data protection impact assessment.
  • Purpose limitation. Under laws such as Maryland’s and others, companies must show that sensitive-data processing is strictly necessary for the service requested by the individual.

The NPC’s reasoning underscores a global convergence on the sensitivity of biometric data and the need to abide by additional limitations to use it legally.

Reference: Biometric Update Article