NPC halts TFH biometrics collection

MANILA, Philippines — The National Privacy Commission (NPC) said it has issued a cease and desist order against Tools for Humanity (TFH), the entity behind the World App and the Orb identity verification system, for violations of the Data Privacy Act of 2012 (DPA).

Jose Amelito Belarmino II, NPC deputy commissioner, said TFH was the group that has been enticing Filipinos to subject themselves to iris scan, face scan and other biometric data in exchange for P2,000 up to $100 (approximately P5,600) worth of WorldCoin cryptocurrency at different “collection points” in the country for some time.

Belarmino said TFH has set up 31 Orb kiosk locations where they collect people’s private data, in exchange for the WorldCoin cryptocurrency which is convertible to cash by downloading the World app.

The order, issued on Oct. 6, directs TFH to immediately cease and desist from all processing of personal information, including biometric data, related to the World App and Orb verification process, and its associated ecosystem in the Philippines.

The NPC, following an application for the cease and desist order by its complaints and investigation division, found TFH’s data processing activities to be in violation of the General Data Privacy Principles and the Rights of Data of the 2012 DPA.

The commission issued the cease and desist order after finding the group to have solicited invalid consent due to undue influence.

“The Commission found that the offering of monetary incentives, in exchange for submitting to the Orb verification process, constituted undue influence, rendering the consent obtained from data subjects not freely given and therefore invalid under the DPA and NPC guidelines,” the NPC said.

The NPC also found a lack of transparency and information when TFH informed people who allowed their personal data to be collected.

“TFH failed to provide adequate and specific details regarding the purpose, nature, extent, duration and scope of data processing, including the existence of a clear privacy policy, thus violating the data subjects’ right to information and the principle of transparency,” the NPC said.

The commission noted the operations of TFH involved excessive collection of biometric data.

“The collection of biometric data, specifically iris scans, was deemed excessive and disproportionate for the stated purpose of ‘proof of humanity’ or mere authentication,” the NPC said, adding it posed the risk of grave and irreparable injury.

“The continued collection and processing of immutable biometric data exposes Filipino data subjects to significant risks of serious harm, including identity fraud, theft, and damage to reputation, which are difficult to precisely quantify and persist for the data subject’s lifetime,” the NPC said.

Belarmino said the integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and immutable identifier.

“When consent is compromised by the lure of compensation, it ceases to be a true expression of choice. This cease and desist order is a clear signal that the NPC will not permit practices that exploit socioeconomic vulnerability or compromise fundamental data privacy rights in the pursuit of business objectives. Accountability and compliance with the DPA are the cornerstones of trust in the digital age,” he said.