Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), has ordered Worldcoin, a cryptocurrency startup, to cease collecting personal data within the country and to stop using any information already acquired. The AEPD issued a strict 72-hour deadline for compliance.
This move by the Spanish regulator comes amidst growing concerns regarding Worldcoin's data collection practices. The startup has garnered significant attention for its unique distribution model, which incentivizes users to share their personal data, including their social circles, in exchange for its cryptocurrency.
The AEPD's decision to halt Worldcoin's operations in Spain stems from its belief that the company's data collection practices violate the General Data Protection Regulation (GDPR), a European Union regulation that governs data privacy and security. The GDPR mandates that companies acquire explicit consent from individuals before collecting and using their personal data.
According to the AEPD, Worldcoin's data collection model fails to meet the GDPR's transparency requirements. The regulator has specifically raised concerns about the fact that Worldcoin collects information not only from its registered users but also from individuals within their social circles, who are not directly involved with the platform.
Furthermore, the AEPD argues that Worldcoin's data collection practices are excessive and go beyond what is necessary to fulfill its stated purpose of distributing cryptocurrency. The regulator has emphasized that companies are obligated to collect only the minimum amount of data essential for their operations.
Worldcoin has yet to publicly respond to the AEPD's decision. However, the company has previously maintained that its data collection practices are compliant with GDPR regulations. Worldcoin argues that by offering users control over their data and the option to opt out, it adheres to the GDPR's principles.
The AEPD's intervention against Worldcoin marks a significant development in the ongoing debate surrounding data privacy and the appropriate use of personal information within the cryptocurrency industry. The decision is likely to be closely monitored by other regulatory bodies around the world grappling with similar issues in the digital asset space.