On January 11, 2024, the Argentinian data protection authority (AAIP) provided an update on its investigation into the handling of personal data by the Worldcoin Foundation. The investigation stemmed from concerns over Worldcoin's collection of facial and iris scans in exchange for cryptocurrency, raising concerns over violations of Decree No. 1558/2001 Regulating Law No. 25.326 (the Decree).

What steps has the AAIP taken since the investigation began?

The AAIP began its investigation by requesting, in writing, information from Worldcoin's operations, including:

• what categories of data are processed and for what purposes;
• how compliance with the principles relating to the correct processing of personal data is guaranteed, and what the deadlines are;
• what technical and organizational measures are applied to guarantee the confidentiality and security of data; and
• what devices are used to perform facial and iris scanning, and whether they have carried out the corresponding impact evaluation.

Subsequently, the AAIP mentioned that it had taken the following actions after receiving Worldcoin's first and second responses:

• met with Worldcoin's representatives and requested additional information regarding data processing practices, security measures, and compliance with personal data protection laws;
• requested the incorporation of a privacy policy for Argentina;
• requested registration in the national database for foreign-based managers;
• requested a data impact assessment for biometric scanning;
• analyzed Worldcoin's responses in line with Argentinian personal data protection laws; and
• formed a working group within the Ibero-American Data Protection Network (RIPD) to share concerns and coordinate investigation efforts.

Finally, the AAIP reminded the Argentinian citizens of their data protection rights under the Decree and the opportunity to make a complaint to the AAIP in the event of a data controller's non-compliance.

You can read the press release, only available in Spanish, here.