- The AEPD, which requires the cessation of the collection and processing of special categories of personal data as well as the blocking of data already collected, has received several complaints denouncing, among other aspects, insufficient information, the collection of data from minors or that the withdrawal of consent is not allowed.
- This decision is based on exceptional circumstances, in which it is necessary to adopt measures aimed at the immediate cessation of processing, to prevent the possible transfer of data to third parties and to safeguard the fundamental right to the protection of personal data.
- The temporary prohibition of activity in Spain is valid for a maximum period of three months.
The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation to cease the collection and processing of personal data that it is carrying out in Spain in the framework of its Worldcoin project, and to block the data already collected. The AEPD has received several complaints against this company complaining, among other aspects, about insufficient information, the collection of data from minors and the fact that consent cannot be withdrawn.
The processing of biometric data, considered in the General Data Protection Regulation (GDPR) to be of special protection, entails high risks for the rights of individuals, given their sensitive nature. Consequently, this precautionary measure is a decision based on exceptional circumstances, in which it is necessary and proportionate to adopt provisional measures aimed at the immediate cessation of the processing of personal data, preventing its possible transfer to third parties and safeguarding the fundamental right to the protection of personal data.
Tools for Humanity Corporation has its European establishment in Germany. This action by the Agency is carried out within the framework of the procedure established in Article 66.1 of the GDPR, which establishes that, in exceptional circumstances, when a supervisory authority concerned – in this case the AEPD – considers it urgent to intervene to protect the rights and freedoms of individuals, it may adopt provisional measures with legal effects in its territory and with a period of validity that may not exceed three months.
In this context, the Agency considers that the adoption of urgent measures temporarily prohibiting activities is justified in order to avoid potentially irreparable damage and that not taking them would deprive individuals of the protection to which they are entitled under the GDPR.