CID CDO 25-001: In the Matter of World App Processing of Personal Information

Order Text

IN THE MATTER OF WORLD APP PROCESSING OF PERSONAL INFORMATION CID CDO 25-001

For: Violation of the Data Privacy Act of 2012

x----------------------------------------------------x

CEASE AND DESIST ORDER

Mark Manson aptly said, “You are always choosing.” Every action, or inaction, reflects a choice – and every choice carries consequences. This Commission underscores that, in the realm of data privacy and protection, personal information controllers and personal information processors cannot evade the duty to choose compliance with the law, respect for the rights of data subjects, and adherence to the principles of legitimate purpose, transparency, proportionality and most importantly accountability, the cornerstone upon which all data protection obligations rest.

This Order resolves the application for the issuance of a Cease and Desist Order (hereinafter “CDO”) against Tools for Humanity, arising from its data privacy practices and processing of personal data in violation of the General Data Privacy Principles under Section 11 and the Rights of Data Subjects under Section 16 of Republic Act 10173, otherwise known as the Data Privacy Act of 2012 (DPA).

FACTS

On 06 February 2025, the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC) received several reports raising concerns over the data collection practices of Tools for Humanity (TFH), a limited liability corporation organized and registered in the United States of America.¹ Its local operator in the Philippines is WCPH Corporation,² a corporation organized and registered in the Philippines.³ TFH is the developer of the application called “World App” and the proprietor of a custom, state-of-the art hardware device called the “Orb.”⁴

According to CID, they received various reports including an email⁵ report regarding the personal data collection practices of World App in Plaridel, Bulacan, during the “Libreng Cyber Security at Digital Financial Literacy Program” conducted under the auspices of the Local Government Unit.⁶

The said report raised the following concerns:

(i) World App collects retinal scans, fingerprints, and personal details such as names, ages, addresses, in exchange for a digital ID which, if stolen, could lead to scam, financial fraud, or identity cloning;
(ii) Lack of approval from the National Privacy Commission and the Bangko Sentral ng Pilipinas;
(iii) World App is connected to World Coin, which faced bans and investigations in other countries due to privacy concerns and unethical data collection practices; and
(iv) The program offers a small incentive in exchange for personal data.⁷

By reason of the various reports received by CID, it conducted its investigation and docketed the same under its Security and Privacy Response and Investigation Taskforce (SPRINT).⁸

The CID noted that all the activities indicated in the reports received⁹ are tied to the website world.org, which appears to promote the creation of a virtual “digital world ecosystem” consisting of: (i) a movement for “human authentication” through the World ID,¹⁰ (ii) integration through the WORLD APP and, what appears to be, its allied applications,¹¹ (iii) a unified crypto-currency through WORLD COIN,¹² and (iv) a real-time record of transactions or blockchain for human through WORLD CHAIN.¹³ All of these components are reportedly connected to a device called the Orb.¹⁴

On 07 May 2025, the CID submitted its application for the issuance of a CDO and alleged that World App is doing some act or practice in violation of the DPA alleging that the entire processing activity conducted by TFH fail under the standards set forth under NPC Circular No. 2023-04 or the Guidelines on Consent (NPC Circular No. 2023-04) namely:

No statement on the specific purpose, nature, extent, duration, and scope of processing for which consent is used as basis, the existence of the rights of the data subject, and how these rights can be exercised were given to data subjects prior to processing.

There is no privacy policy, not even on their website. General categorical statements without specific information on the processing of data from collection to disposal are not sufficient to inform the individuals for them to properly give their consents.

The company states they have a “legitimate business purpose” but no specifics were given. Their website expresses their goals in creating a World Ecosystem, however, these are abstract explanations that give no real information on how, where, when, and why the data are being collected in the first place.

Finally, the collection of biometric data seems to be excessive since it involves even retinal and iris scans for mere authentication. Most authentications involve only facial captures. However, the team observes that even the latter can be subject to contention.¹⁵

The CID likewise alleged that the collection of biometric data by World App is detrimental to national security or public interest and that a CDO is necessary to preserve and protect the rights of data subjects. CID stated that World App’s processing of personal information, including biometric data, exposes the affected data subjects to real risks of serious harm and that the issuance of a CDO is crucial in order to preserve and protect the rights of the data subjects.¹⁶ In its application for the issuance of a CDO, the CID alleged that the continued processing of World App, which is not compliant with the general data privacy principles under the DPA, violate the “rights of the data subjects to information”. Further, they claimed that World App’s processing will cause them grave and irreparable injury because of the significant risks, serious harm, and damage to reputation and privacy that are difficult to precisely quantify.¹⁷

CID emphasized that the data elements being processed include facial captures, iris and retinal scans.¹⁸ They explained that while biometric data are not categorized as sensitive personal information under the DPA, they are, together with human fingerprints and DNA, regarded distinctively as immutable personal data.¹⁹ This means that biometric data are unchanging and that they attach to the person since before birth and after death.²⁰

Finally, the CID stated in its application for the issuance of a CDO that some of the risks involved in the processing and possible mishandling of biometric data include the following:

Since biometric data pertain to physical identity their collection raises issues on general right to privacy and the dangers of unchecked surveillance especially by the said Orb. This may expose data subjects to be possible targets for nefarious activity.

Deep fakes may also be generated using the collected data and be used for identity fraud or theft that may branch out to a number of other potential risks or illegal activities, such as access to accounts, scams, damage to reputation and the like.

Biometrics is also often linked to security and authentication processes, and may be used to illegally access sensitive accounts and information through spoofing and forgery;

The biometrics collected are also data on physical features that may place individuals under the risk of possible discriminatory practices through unethical selections based on race or physical characteristics especially when such data is sold or shared;

Finally, since biometric data does not change, the threat persists during the lifetime of the data subject and even beyond, if such data is stolen.²¹

On 08 May 2025, the Commission issued a Minute Resolution requiring TFH to comment on the CID’s application for a CDO and for the parties to appear before the Commission En Banc for a Clarificatory Hearing on 23 May 2025.²²

On 19 May 2025, the Adjudication Secretariat received a letter from TFH signed by DK. The letter provided an overview of the World Project and the World App²³. The letter indicated that the central idea of World Project is the ability to provide whether someone is human or a computer in digital interactions.²⁴ The World network consists of four basic elements which are as follows:

World App, a mobile application that functions as a simple interface between World ID and the World network.

The Orb, an advanced, purpose-built camera designed to verify proof of humanity.

World ID, an anonymous digital identity network based on such proof of humanity.

Worldcoin (WLD), a digital currency that, where laws permit, anyone can access just because they are human.²⁵

The letter submitted likewise provided an overview of the World ID creation as well as screenshots of processes required for the verification of the World ID.²⁶ This includes the requirement to be physically located in front of an Orb.²⁷ TFH further indicated that the Orb takes pictures of the person’s face and eyes and that these images are stored only momentarily and temporarily, for a few seconds on the Orb.²⁸ The Orb contains several neural networks designed to determine whether the subject is a living human being.²⁹ If the Orb determines that the images correspond to a living human, an iris code- a binary representation of the eyes characteristics is generated.³⁰ The Orb then compares that code to a previously verified anonymized data set, with the goal of ensuring that the iris has not been recorded before.³¹

TFH also stated that the Orb encrypts the photographs, generated abstractions, iris code, AMPC fragments, and certain metadata in a package called a Personal Custody Package (PCP), which is then securely transferred to the user’s device.³² The letter likewise stated that all personal data is deleted from the Orb once the PCP is sent to the device.³³ The Orb does not retain any personal data.³⁴

TFH in addressing the issues raised by CID, stated that it is not doing any act or practice in violation of the DPA 2012:

TFH does not collect the name, age or address of a person seeking to use its services. This is clearly stated in a variety of disclosures on the publicly available materials, and is verifiable by downloading the World App, onboarding through the application, and testing the verification at the Orb. Moreover, no iris scans or retinal scans are collected. The Orb takes high resolution photos of a person’s face and eyes. These photos are not retained. Thus, the statement that an incentive is given in return for personal data has no factual basis. As noted above, the optional incentive is provided to people who verify so they can fully avail of the utility of the World App and World network.³⁵

Additionally, TFH asserted that data collected is not used for AI training:

(i.e., Mini Apps) being made by thousands of developers around the world, and made available through the World App, which millions of people around the world are using every day. A list of the Mini Apps is available on the website or directly through the App Store in the World App. People can use Worldcoin through these Mini Apps for a variety of useful purposes.

Additionally, data collected is not used for AI training. As discussed with the NPC during an in person meeting with the Complaints and Investigations Division on 13 May 2025, today no data is collected or used for AI training. In the future, TFH expects to launch a feature much like the feature made available by Apple when an application crashes and needs to be debugged, to allow a user to report issues for debugging and in so doing share data for debugging, testing and improvement. The registration was made with this future feature in mind. This feature does not exist today, and therefore, no data is being used for AI training.³⁶

TFH indicated that contrary to CID’s assertion, the collection of biometric data by World App is not detrimental to national security or public interest given that the World App clearly states the purpose of collection before the data is collected thereby it is clear that the purpose of processing is made clear.³⁷

TFH finally asserted that the collection of biometric data by World App would not cause grave and irreparable injury to data subjects and indicated that if World App and proof of human technology would not be available in the Philippines, Filipinos would be at risk as AI accelerates around the world.³⁸

Further, TFH alleged that it has undertaken a Data Protection Impact Assessment (DPIA) to assess the proportionality of the data momentary collection and processing required to create a World ID.³⁹ The DPIA presented that the processing of personal data does not weigh as much as the benefits of proof of personhood (PoP) for the internet and society.⁴⁰

On 23 May 2025, as scheduled on the 08 May 2025 Minute Resolution of the Commission, the Clarificatory Hearing was conducted. The points of discussion were the personal data being processed, nature of the iris code, results of the onsite investigation, observations regarding the pecuniary incentives, TFH’s stated security measures, their documents, such as Privacy Notices, Consent Forms, DPIA, and all other points raised in the Application for a CDO.⁴¹

On the same date, 23 May 2025, the Commission issued a Minute Resolution⁴² directing TFH to submit relevant materials and documentation relating to the data processing practices involved in the operation and use of the World App and the Orb as discussed in the Clarificatory Hearing conducted. The said materials are as follows:

a) The updated Data Protection Impact Assessment (DPIA) of the World App and Orb;

b) Copies of the Orb’s operation manual, user orientation materials, and any other documents provided to third-party partners for on-site verification using the Orb;

c) Copies of actual contracts between Tools for Humanity and AI Price, as well as with other third-party partners, specifically relating to the age verification system used in connection with the World App and the Orb;

d) Copies of contracts and data processing agreements (DPAs) between Tools for Humanity and third-party partners involved in the operation of the World App and the Orb;

e) A copy of Tools for Humanity’s current privacy policy, specifically indicating the categories of personal data processed, including information relating to official government-issued identification cards and citizenship collected in the World App;

f) System audit trails or logs documenting the Orb’s momentary data storage and automatic deletion process, particularly confirming the claimed duration of no more than twelve (12) seconds for retaining personal data;

g) A report from the engineering or technical team detailing whether there have been any instances of personal data retention beyond the prescribed twelve (12) seconds;

h) A Filipino translation of the privacy consent form provided to data subjects;

i) Information on the types of personal data retained by Tools for Humanity and the Orb, and the retention periods involved;

j) A copy of the study or internal assessment conducted by Tools for Humanity (World App) which concluded that iris scans are the most effective method for verifying humanness;

k) A technical document describing the Advanced Multi-Party Computation (AMPC) process used to split and store key fragments securely;

l) Copies of official communications with the local government of Bulacan regarding several Facebook posts involving the offer of monetary incentives in exchange for using the World App and verifying identity and humanness through the Orb;

m) Information on actions taken in response to similar Facebook posts made by other groups or pages offering monetary incentives in exchange for using the World App and verifying identity and humanness through the Orb;

n) A full video demonstration of the entire personal data processing workflow employed by Tools for Humanity (World App);

o) Documentation or technical specifications of the machine-learning model used by the Orb, including its training model, performance, and limitations;

p) Technical documentation proving that, following encryption, re-identification of personal data is not reasonably possible using current technology and methods, consistent with industry best practices and data protection by design; and

q) Any other relevant materials or documentation relating to the data processing practices involved in the operation and use of the World App and the Orb.⁴³

On 08 June 2025, TFH submitted its Response⁴⁴ to the above-mentioned Minute Resolution. The Response addressed the submission of relevant documents in the conducted Clarificatory Hearing.⁴⁵

Subsequently, on 30 June 2025, through electronic mail, TFH informed the Commission that they are in the process of undertaking some updates to their Privacy Policy stating that:

x x x we are in the process of undertaking certain updates to our Privacy Policy and engaging with a South Korean and Peruvian university who will operate additional anonymized multi-party computation nodes. x x x⁴⁶

On the same date, another email was sent by TFH requesting an additional 30-day extension to supplement its earlier submission with updated and additional information to wit:

We are requesting for an additional period of thirty days to allow us to supplement our prior submissions with the updated and additional information mentioned above [updated Privacy Policy and new AMPC partners] for completeness of your review process.⁴⁷

On 03 July 2025, in response to TFH’s 30 June 2025 request for an extension, the Commission En Banc issued a Minute Resolution partially granting TFH a non-extendible period of fifteen (15) calendar days from receipt of the Order to submit to adjudication any additional documents it deems necessary.⁴⁸ It was likewise stated that no further requests for extension of submission shall be entertained by the Commission.

On 18 July 2025, the Adjudication Secretariat received the submissions of TFH through electronic mail which included a document captioned as Supplemental Comment/Opposition dated 18 July 2025.⁴⁹

On 04 August 2025, the Commission issued a Minute Resolution directing the CID to submit any documents it deems necessary in relation to its application for a CDO within a non-extendible period of fifteen (15) calendar days from receipt of the Order.⁵⁰

On 18 August 2025, the CID filed a Comment with Annexes.⁵¹ Pursuant to the 04 August 2025 Minute Resolution, the case entitled “CID CDO 25-001: Application for Issuance of Cease and Desist Order in the Matter of World App Processing of Personal Information” was deemed submitted for decision, to wit:

Upon submission of the documents by the CID, if any, or upon the lapse of the fifteen-day period, the case entitled “CID CDO 25 001:Application for Issuance of Cease and Desist Order in the Matter of World App Processing of Personal Information” shall be deemed submitted for decision by the Commission En Banc.⁵²

DISCUSSION

Procedural rules serve a purpose

The power of this Commission to issue a Cease and Desist Order is explicitly provided in Section 7 (c) of the DPA:

Section 7(c). Issue cease and desist orders, impose a temporary or permanent ban on the processing of personal information, upon finding that the processing will be detrimental to national security and public interest.⁵³ (Emphasis supplied)

Section 9 (f)(3) of the Implementing Rules and Regulations of the DPA (IRR), reiterated the same power of the Commission to issue a Cease and Desist Order:

Section 9. Functions. The National Privacy Commission shall have the following functions:

f. Enforcement. The Commission shall perform all acts as may be necessary to effectively implement the Act, these Rules, and its other issuances, and to enforce its Orders, Resolutions or Decisions, including the imposition of administrative sanctions, fines, or penalties. This includes:

x x x

Issuing cease and desist orders, or imposing a temporary or permanent ban on the processing of personal data, upon finding that the processing will be detrimental to national security or public interest, or if it is necessary to preserve and protect the rights of data subjects;⁵⁴ (Emphasis supplied)

In addition, based on Section 4 of NPC Circular No. 20-02⁵⁵ or the Rules on the Issuance of Cease-and-Desist Orders of the National Privacy Commission (NPC Circular No. 20-02), for a CDO to be issued, the commission or continuance of such act or practice, unless restrained, will cause grave and irreparable injury to a data subject.

It is clear from the foregoing that the Commission has the authority to issue a CDO. However, before proceeding into the substantive standards for the issuance of a CDO, it is imperative to address compliance with the procedural aspect. The Commission takes this opportunity to underscore that adherence to procedure is not incidental, but foundational—it ensures due process, fairness, and accountability in regulatory enforcement. Thus, only upon this assurance can the discussion properly shift to the substantive requisites.

First, as stated in the facts, the Commission on 08 May 2025 issued a Minute Resolution⁵⁶ ordering TFH to submit a Comment on CID’s application for the issuance of a CDO dated 07 May 2025. On 19 May 2025, the Commission, through the Adjudication Secretariat, received a letter⁵⁷ signed by DK. While submissions are allowed by the Commission to be done via electronic communications, they still require adherence to NPC’s Rules of Procedure as amended. The 19 May 2025 submission⁵⁸ of TFH did not contain any verification. The said submission likewise did not contain any proof authorizing DK as the signatory to sign and verify any pleadings on behalf of TFH.⁵⁹

Rule IV, Section 9 of the NPC Rules of Procedure⁶⁰ requires that if the respondent is a juridical person, its representative filing the comment must be authorized through a board resolution contained in a duly notarized Secretary’s Certificate, or its equivalent for a government agency. This requirement is consistent with Section 22 of the Revised Corporation Code,⁶¹ which vests corporate powers in the board of directors and provides that the corporation may act only through its board and duly authorized officers or agents.

The Rules of Court likewise require that pleadings be signed by the party or their representative.⁶²

Both the verification and authorization are absent. As such, the letter submitted by TFH on 19 May 2025⁶³ is procedurally defective and cannot take the place of a Comment as required by the Commission.

Second, on 30 June 2025, TFH, through electronic mail⁶⁴, requested an additional 30-day extension to supplement its earlier submission. In its 03 July 2025 Minute Resolution,⁶⁵ while the Commission partially granted this request in view of the nature and implications of the application for a CDO, the Commission noted that the filing made by TFH is not a proper manifestation or motion, but merely a request.

Third, on 18 July 2025, instead of submitting additional documents in relation to the foregoing, TFH submitted a Letter Response dated 18 July 2025 to “further update” its initial response with a pleading-like attachment labeled as a Supplemental Comment/Opposition and marked as Annexure 1.⁶⁶

It is worthy to note that the Commission granted the request to submit additional documents on the premise that TFH has ongoing updates regarding its Privacy Policy and new engagements with certain universities.⁶⁷ The said grant cannot be interpreted and treated as a blanket approval that allows TFH to submit any document or pleading. Clearly, the submission of a pleading is not within the purview of the said grant. Otherwise, the Commission would have stated that TFH may submit any documents or pleading it deems necessary.

Even if the Commission accepts the Supplemental Comment/Opposition,⁶⁸ it cannot be denied that there are apparent procedural and formal defects.

Section 23 of the NPC Circular No. 20-02 provides that the Rules of Court shall apply suppletorily.⁶⁹ Section 4, Rule 7 of the Rules of Court provides that a pleading should be verified by an affiant with an attached authorization of the affiant to act on behalf of a party:

Section 4. Verification. Except when otherwise specifically required by law or rule, pleadings need not be under oath or verified.

A pleading is verified by an affidavit of an affiant duly authorized to sign said verification. The authorization of the affiant to act on behalf of a party, whether in the form of a secretary’s certificate or a special power of attorney, should be attached to the pleading xxx⁷⁰ (Emphasis supplied)

The Supplemental Comment/Opposition is notably in the form of a pleading but it lacks the required formalities. Also, the Supplemental Comment/Opposition is not duly verified, and the authorization of DK as the duly authorized signatory is not attached.⁷¹

In addition, TFH did not submit any applicable motion or notice to the Commission to provide sufficient justification to admit the Supplemental Comment/Opposition. Section 6, Rule 10 of the Rules of Court provides that a court may, upon motion of a party, permit a supplemental pleading:⁷²

Section 6. Supplemental pleadings. — Upon motion of a party, the court may, upon reasonable notice and upon such terms as are just, permit him or her to serve a supplemental pleading setting forth transactions, occurrences or events which have happened since the date of the pleading sought to be supplemented. The adverse party may plead thereto within ten (10) calendar days from notice of the order admitting the supplemental pleading.⁷³ (Emphasis and underlining supplied)

TFH’s Supplemental Comment/Opposition was merely attached as an annexure in a letter response⁷⁴ of TFH without any admissible reason, without regard to the procedures of the Commission, and without any courtesy extended to the Commission.

The submission of a pleading-like document, absent compliance with the basic formal requirements prescribed by law by TFH, raises serious questions as to its intentions. If such filing is intended merely to delay the proceedings or to shift the narrative of the case, the Commission remains mindful as to any improper conduct or submissions by the parties. The procedural infirmities not only constitute a deliberate act of misconduct but also manifest a clear disregard for the procedural rules and lawful authority of the Commission.

Technical rules serve a purpose. These rules are put in place for efficient and fair disposition of a case. The issuances and procedures of the Commission are governed by the applicable laws and regulations. All parties are required to comply and demonstrate due respect for the authority of the Commission.

Despite having afforded the full opportunity and chances to TFH for the just and proper disposition of its causes, TFH has not provided any clear and persuasive reasons for this Commission to relax its technical rules.

Moreover, surreptitiously inserting an unverified Supplemental Comment/Opposition is inappropriate in the context of the Commission’s procedures. It is not an excuse that DK is a foreign national and not a member of the Philippine Bar.

Nevertheless, in spite of these procedural issues, given the nature and impact of a CDO, the Commission will take into account all the submissions of both CID and TFH. While the Commission is committed to maintaining the integrity of its processes and remains mindful as to the procedural infirmities, this Commission recognizes the equal importance to turn to the substantive standards governing the issuance of a CDO. Hence, having addressed the procedural issues and procedural safeguards, the discussion must now focus on the criteria and substantive grounds that justify such extraordinary relief.

Substantive grounds for the issuance of a CDO

Pursuant to Section 4 of NPC Circular No. 20-02⁷⁵, the issuance of a CDO requires substantial evidence showing that: (a) the adverse party is engaged in, or is about to engage in, an act or practice violative of the DPA, its IRR, or related issuances, (b) that such act or practice is either detrimental to national security or public interest, or that the order is necessary to safeguard the rights of a data subject, and (c) that unless restrained, the continuance of such act or practice will result in grave and irreparable injury to a data subject.

There is no question that TFH is engaged in acts that fall within the ambit of the DPA and the jurisdiction of the NPC. TFH processes personal data on World App and via the “Orb.” According to TFH, “World App processes personal data in a standard manner like any mobile application, and without involving sensitive personal data”⁷⁶, and that users may optionally enter their phone number but the same is purely optional.⁷⁷ As asserted by TFH, “in any case, any personal data provided on or through the World App is treated by TFH”.⁷⁸

There is likewise no question that the ongoing processing of personal and sensitive personal information by TFH constitutes a violation of the DPA, its IRR, and related issuances. These violations are set forth as follows:

Personal information controllers (PIC) who rely on consent as basis to process personal information or sensitive personal information must ensure that such consent is “freely given, specific, and an informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her”.⁷⁹

For consent to be valid, the Privacy Notice⁸⁰ and Consent Form⁸¹ must be transparent. Transparency empowers the data subject to make informed choices, and where applicable, to have reasonable control over the processing of their personal data, and to hold a PIC accountable based on the information provided at the time the data subject gave their consent.⁸²

The consent form should contain all the information required in a privacy notice and indicate that consent is the lawful criteria for processing relied on.⁸³ Consequently, it must contain a PIC’s proposal to the data subject asking the latter to consent to the processing of personal data pursuant to the terms stated in the consent form.⁸⁴ The data subject’s acceptance of the provisions of the consent form creates a contract between the data subject and a PIC on the terms of processing of the personal data.⁸⁵

To further educate on what constitute a valid consent, its elements would be discussed in detail.⁸⁶ First, consent must be specific to the processing of personal data:

SECTION 8. Specific. — A PIC must ensure that the data subject provides specific consent to the specific and declared purposes of the processing of personal data.

Consent must be granular. In cases where personal data is processed for multiple but unrelated purposes, a PIC shall present to the data subject the list of purposes and allow the data subject to select which purposes they consent to, instead of requiring an all-inclusive consent to the processing for multiple purposes.⁸⁷ (Emphasis Supplied)

In relation to this, it must be noted that a privacy notice is not an instrument of consent but merely a disclosure document.⁸⁸ A privacy notice is merely a unilateral statement that discloses the essential information on a specific processing activity while a consent form evidences a contract between the PIC and the data subject whereby the PIC proposes to process a data subject’s personal data pursuant to a specific purpose and the data subject accepts such proposal:

Privacy Notice. It is a unilateral statement that contains essential information on a specific processing activity of a PIC that involves the data subject.

xxx

Consent Form. It should contain all the information required in a privacy notice and indicate that consent is the lawful criteria for processing relied on. Consequently, it must contain a PIC’s proposal to the data subject asking the latter to consent to the processing of personal data pursuant to the terms stated in the consent form. The data subject’s acceptance of the provisions of the consent form creates a contract between the data subject and a PIC on the terms of processing of the personal data.

When required. The requirement of having a privacy statement and notice is separate and distinct from obtaining the consent of the data subject in an appropriate consent form or its equivalent for the lawful processing of personal data.⁸⁹

Moreover, the Commission had the opportunity to enlighten the public on this matter in its NPC 19-910 Decision:

[T]he fact that the data subject must agree to a privacy policy or notice fails to meet the requirement of meaningful consent. A “bundled” consent, for instance, will generally not suffice as the data subject is not empowered to make a true choice.⁹⁰

Herein and as provided by TFH on its 19 May 2025 letter, once a person downloads the World App he or she will be faced with a welcome page where the data subject must tick a single box beside the following statement “I agree with World App User Terms and Conditions and acknowledge the TFH Privacy notice.”⁹¹ This is not the consent required under the law. The tick box merely shows that the data subject acknowledges the Privacy Notice. Moreover, the Privacy notice is not an in-app feature of the World App and is only provided with a clickable link which redirects the data subject to world.org’s legal center page. Nowhere in TFH’s submissions is there an indication that the data subject consents to the specific processing purposes of TFH in the World App.

This is further supported by the data subjects’ sworn statements that they only saw a privacy notice on the WorldApp but they were not provided by TFH with a consent form.⁹² Further, the bundling of TFH Terms and Conditions with their Privacy Notice under one item deprives the data subject from making a true choice.

Moreover, both TFH’s Terms and Conditions and Privacy Notice do not contain all the specific processes that they do to the data subjects’ personal data. TFH admitted that they use a “machine learning model that looks at photos.⁹³ However, they did not declare such processing in their privacy notice.⁹⁴ Without the disclosure of the specific processes, the data subjects cannot give their specific consent.

Second, consent must be freely given. Section 7 of NPC Circular 2023-04 mandates that:

SECTION 7. Freely given. — A data subject must have a genuine choice and control over their decision to consent to the processing of their personal data.

Consent is not freely given in instances where there is any element of pressure, intimidation, possibility of adverse consequences for refusal to give consent, or any other inability to exercise free will by the data subject.⁹⁵

The National Privacy Commission Circular No. 2023-04⁹⁶ provides guidance on the issue of incentivized consent. It clarifies that offering benefits to the data subjects and similar actions of a PIC shall not be automatically construed as a deceptive method, coercion or compulsion that renders the consent as not freely given.⁹⁷ However, the validity of such consent must still be evaluated on a case-to-case basis, considering the circumstances of the case.

In this regard, the Commission has reviewed the Witnesses Affidavits submitted by the CID and is convinced that the consent provided and the subsequent registration of data subjects with the World App appears to have been primarily motivated by the financial incentives offered.

Most of the Affidavits reveal that the primary reason individuals downloaded and registered with the application was the monetary incentives and benefits promised. Notably, these incentives were not limited to the one-time reward, but included a promise of monthly compensation, further suggesting that the consent obtained may not meet the standard of being freely and voluntarily given. A Sinumpaang Salaysay duly executed by AB provided the following:

Inanyayahan ako magpa-rehistro at agad akong pumayag dahil sa money incentives at benepisyo na ipinangako nilang may buwanang kita din sa loob ng labing-isang buwan.

Noong Abril 2025, nagparehistro ako sa World App sa Pulilan Covered Court. Pagkatapos kong madownload ang mismong app, ibinigay ko ang aking cellphone sa kakilala kong naghikayat sa akin upang siya na ang maglagay ng mga impormasyon at kumuha ng schedule. Doon ako inasikaso ng mga staff ng World App.

Nagbigay sila ng orientasyon sa pamamagitan ng isang speaker at videos na nagpapaliwanag kung para saan ang World App. Base sa naging orientasyon, ang tanging naunawaan ko ay ang World App ay isang proseso upang makaiwas sa mga scam.

May nakita akong privacy notice sa app, ngunit hindi ko ito binasa ng buo dahil sobrang mahaba at mga bahaging bahagya kong binasa ay nakakalito, hindi ko naunawaan. Tapos noong nag-scroll ako nakakapagod kung tingnan at basahin dahil sobrang daming nakasulat.⁹⁸ (Emphasis Supplied)

In her Affidavit, she stated that she permitted the individual who encouraged her to register to fill out the required information on her behalf to obtain a schedule.⁹⁹

In addition, CID presented its Technical Examiner¹⁰⁰, who stated in his Report that the primary platform used to promote registration and facilitate recruitment was through Facebook. Recruiters actively offered incentives to encourage participation, and received commissions in return.¹⁰¹ It was also noted that some recruiters provided additional inducements such as free transportation and snacks, on the condition that participants used their referral codes along with an agreement to share a portion of the commission earned.¹⁰²

Based on the facts and evidence gathered and the evaluations conducted, the Technical Examiner found the following:

Most posts were from individuals seeking to recruit others in exchange for a commission. 2. Some recruiters offered additional incentives, such as free rides and snacks, for those who joined using their referral code. 3. Lastly, there were screenshots of individuals selling their accounts for the purpose of sending referral codes.¹⁰³

The CID also submitted a Joint-Affidavit of Investigation executed by its Investigators,¹⁰⁴ stating that they personally registered with World App and went through the verification process themselves. During their visit, they observed a significant number of people lining up, many of whom were asked by the staff about their referral codes.¹⁰⁵ This observation indicates that the use of referral codes was not only known to the staff but also actively acknowledged and facilitated by the local operator, thereby establishing that the referral system was an integral part of the registration process.

Upon arriving at the site, we observed a significant number of people lining up for registration. The staff members of World greeted us and asked if we have appointments before we enter the premises. 8. A member of the staff likewise inquired as to how we came to know about World App, further asking if we already have referral codes. The said staff even insisted on putting a referral code in our respective World Apps, but we all declined. x x x 25. (V) When I tried the referral process and sent the link to my co-worker I noticed the following words appear together with the link once shared, to wit:

Hi. Download World App and verify your account to get 54.06. WLD in the next year, currently worth P3,415.14.¹⁰⁶ (Emphasis Supplied)

During the Clarificatory Hearing¹⁰⁷, the Commission inquired into the Facebook posts allegedly offering monetary incentives in exchange for the use of the World App. The Commission specifically asked whether the TFH was aware of the existence of such posts and what actions, if any, had been undertaken in response thereto.¹⁰⁸

DK, representing TFH, asserted that communications had been made with the local government of Bulacan, requesting the removal of said posts.¹⁰⁹ He further committed to furnish the Commission with a copy of the alleged communication.¹¹⁰ The relevant portion of the hearing is excerpted as follows:

DK : Well, but I’m sorry. I just want to be clear, the post that’s on Facebook is a post that was posted by someone else, right?

DPC JSB : Right. That’s correct. But then you said you had a conversation with the local government.

DK : Yes.

DPC JSB : So, was this part of the discussion? Because in that post they were saying that you’ll get Php 2,000 if you have your Iris[’] scanned. So, I’m asking you, are you aware that this was going to be the post [of] your partners[?] Were your partners aware of this?

DK : No. They were not aware of this. And to be clear[,] post[s] like that, Deputy Commissioner, are actually strictly against what we advise because they are not accurate.

DPC JSB : But were you aware of that post?

DK : No. We became aware of the post after the post was published. And we did not have any involvement in the creation or the post.

DPC JSB : Right. So, were there any assertions that were done by your company with regard to this post involving your processes?

Saying that, I mean assertions in terms of asking them to take down, to correct, to change, because this is not…

DK : We did. We did send a request to ask. We did send a request for them to remove the post.

DPC JSB : Right. Can we get a proof of this request? A copy of this request?

DK : I’m sure we can check with the operator and ask for it, yes.

DPC JSB : Right. How was this request made? Just to clarify.

DK : We’ll have to check because I didn’t make the request myself Deputy Commissioner. So we’ll check how it was made and we’ll be happy to get you a copy of it. But, I sitting here today, I don’t know the mechanism of how it was made.

DPC JSB : Right. No, I understand that, but I would like to have a copy of that request that you were saying that you coordinated with them saying that, I don’t know what you said in there, but it seems that you were against the post. I would like to see [the] request that you made.

DK : Understood.¹¹¹

Pursuant to the Commission’s directive, TFH has issued a letter response dated 08 July 2025¹¹², wherein it was stated that no formal written communication had actually been issued to the local government of Bulacan.

Copies of official communications with the local government of Bulacan regarding several Facebook posts involving the offer of monetary incentives in exchange for using the World App and verifying identity and humanness through the Orb. No formal communication took place but a former employee did raise a response through facebook but unfortunately no response was received but we have attached a screenshot of the message and the supporting documentation as Exhibit I.¹¹³

Instead, TFH attached, as Exhibit “I”, a screenshot of a Facebook Messenger conversation purportedly made by a former employee, who allegedly raised the matter informally with an account labelled “Bantay Nakaw Coalition”¹¹⁴. The conversation included a request to fact-check a post and a file labeled “FAQs” referencing World Foundation, to wit:

[Alleged Former Employee] Hello po. Paki fact check po yung inyong post. Nakalap po natin itong FAQs sa World Foundation.

[Bantay Nakaw Coalition] Hi, thanks for contacting us. We’ve received your message and appreciate you reaching out.¹¹⁵

Given the lack of documentary evidence or official correspondence and the conflicting responses of DK during the clarificatory hearing and in their written response dated 08 June 2025, the Commission is constrained to conclude that TFH has not substantiated its claim of having made efforts to coordinate with the local government for the removal of said posts. Consequently, the Commission finds it proper to infer that TFH had knowledge of the existence of such postings and failed to undertake any meaningful or formal action to counter or correct the dissemination of such schemes.

Further, in the Supplemental Comment/Opposition submitted by TFH, it was asserted that the WLD tokens provided should not be construed as payments, but rather as incentives for the use of the World App and its features.¹¹⁶ However, no sufficient or further justification was provided regarding the necessity or rationale behind offering such incentives.

d. The WLD tokens are neither payments to users to surrender their personal data nor to create and verify a World ID but merely incentives for users to navigate the World App and its features. Claiming the free voluntary grant of WLD tokens is also not a pre-condition for the generation of the QR Code to initiate the World ID creation and verification process nor for the subsequent use of the World ID or World ecosystem.¹¹⁷ (Emphasis supplied)

Despite this lack of clarity, the implementation of referral codes, commission-based schemes, and other pecuniary benefits, though not fully explained by TFH, has clearly and greatly influenced Filipino data subjects to disclose their personal data, including biometric data such as facial and iris images. Given the Philippines’ socio-economic context as a developing country, where many individuals experience financial vulnerability, the promise of monetary or material gain significantly increases the risk of undue influence. In these specific circumstances, incentives functioned less as optional rewards and more as tools creating undue influence. As such, what is framed as a voluntary transaction may constitute a deceptive method, or a form of compulsion, invalidating the requirement of freely given consent under applicable data privacy standards.

As one affiant has testified, the sole reason he agreed to register was the promise of receiving a monetary consideration or incentive in exchange therefor, to wit:

Ngunit, hindi ko alam kung paano eksaktong gagawin ito, at mas lalo akong nag-aalala dahil wala akong ideya kung ano ang mangyayari o saan mapupunta ang aking datos at biometric sa sandaling hawak na nila ito. Ang tanging naging dahilan at humatak sa akin para magparehistro ay ang pangako na makakakuha ako ng pera o insentibo.¹¹⁸ (Emphasis Supplied)

These circumstances, as presented before the Commission, demonstrate that the consent obtained by TFH was not freely given in accordance with the requirements of the DPA and the provisions of the NPC Circular No. 2023-04, or the Guidelines on Consent.

Third, consent must be an informed indication of will.

SECTION 9. Informed. — A PIC should provide to the data subject all relevant information that is necessary for the data subject to make an informed decision. Such information must be easily understood by an average member of the target audience to ensure that the data subject has sufficient understanding of what they are consenting to.

xxx

SECTION 10. An indication of will. – Consent must be expressly given through a clear assenting action that signifies agreement to the specific purposes of the processing of personal data as conveyed to the data subject at the time consent was given.¹¹⁹

TFH’s attached notice¹²⁰ failed to comply with the requirements under the law. As previously discussed, TFH failed to provide the data subjects with all the relevant information necessary for them to make an informed decision under their privacy notice¹²¹.

I.C.1. Failure to provide all relevant information to data subjects

TFH’s privacy notice did not disclose the following:

Sufficient detail regarding the specific countries or jurisdictions where the data may be transferred, stored or processed; 2) Collection and storage of biometric data for other purposes like machine-learning model (despite the existence of the Data Processing Agreement with AiPrise Inc); 3) Usual risks of data transfer¹²² (which exist under their DPIA); 4) Existence of rights and how these can be exercised;¹²³

Further, TFH’s privacy notice did not contain the second purpose for the processing of the data subjects’ biometric data in the form of photos of face and of eyes, to determine whether an individual has already registered with an Orb. TFH disclosed in their DPIA dated 13 January 2025 that:

Biometric data in the form of the photos of face and of eyes are collected, and processed on the Orb x x x

Company only processes the data to determine whether an individual is human and has already registered with an Orb.¹²⁴ (Emphasis supplied)

TFH did not mention this on their Privacy Notice but only mentioned this second purpose in their Biometric Consent Form.¹²⁵ Even so, it must be noted that the data subjects said in their sworn statements that in the venue, TFH personnel did not provide them with such consent form.¹²⁶

Additionally, TFH also failed to ensure that the data subjects have sufficient understanding of what they are consenting to. This is evident in the data subjects’ sworn statements.¹²⁷ In one of the Joint-Affidavit of Investigation on the World ID Registration, the process for obtaining the data subjects’ consent for the processing of their biometric data was explained:

After the presentation, the three of us and other registrants lined up for verification with the Orb. While in front of the Orb, we clicked a button in our World App to start the verification process.

Thereafter, a prompt appeared in our respective phones through World App stating that:

“your biometrics are required to verify your World ID and will be:

a. Analyzed-Photos of your face and eyes will be analyzed to determine you are human. b. Anonymized-To ensure you only verify one World ID, photos of your eyes will be anonymized and stored. c. Encrypted-your data will be encrypted, sent to your phone, and deleted from the Orb so only you have it.”

On the bottom part of the said prompt, there is a statement that says:

“By clicking “Agree and Continue” you consent to the processing of your biometric data for the above purposes. You can learn more from our Privacy Notice.”

If the Privacy Notice link is clicked, the user will be redirected to a lengthy Privacy Notice translated in Tagalog and found in word.org’s Legal Center page. Thereafter, the user must return to the World App application to return to the verification process.¹²⁸ (Emphasis supplied)

It must be noted that the Privacy Notice submitted by TFH is 29 pages long.¹²⁹ The data subjects are only able to read this only by the time they are in front of the Orb where there is usually a line of people waiting.¹³⁰ One of the investigators even said that the registration process only took five (5) minutes.¹³¹ Evidently, TFH fails to afford their data subjects ample time to provide an informed indication of their will to have their personal data processed.

In their sworn statements, the data subjects admitted that they did not understand the purpose and actions entailed by TFH’s processing of their personal data due to the length and complexity of the privacy notice.¹³² It is also worth reiterating that the data subjects declared that while they were provided with a privacy notice through the application, they were not provided by TFH personnel with the biometric consent form.¹³³

May nakita akong privacy notice sa app, ngunit hindi ko ito binasa ng buo dahil sobrang mahaba at mga bahaging bahagya kong binasa ay nakakalito, hindi ko naunawaan. Tapos noong nag-scroll ako nakakapagod kung tingnan at basahin dahil sobrang daming nakasulat.

xxx

Pagkatapos ng proseso ng pagpaparehistro, wala akong pinirmahan na anumang dokumento. Wala rin akong nakitang consent form…¹³⁴ (Emphasis supplied)

While the data subjects saw privacy notices in the application, the TFH personnel did not ensure that they read and understood the same.¹³⁵ Others even said that they had the process done by the recruiters and just gave them their phones.¹³⁶

The foregoing accounts clearly show that TFH did not provide the data subjects with all the relevant information necessary for them to make an informed decision. TFH not only failed to disclose essential details of their processing to the data subjects; they also misrepresented certain information.

I.C.2. Misrepresentation that no sensitive data is processed by World App and that no data is stored in the World App

TFH misrepresented that no sensitive personal information is processed by World App and that no data is stored in the World App.¹³⁷

Section 3(l) of the DPA considers personal information issued by government agencies peculiar to individuals such as passports and government-issued identification cards as sensitive personal information.¹³⁸

Section 3(j) of the DPA defines processing as:

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.¹³⁹

Contrary to the assertion of TFH in its Letter dated 19 May 2025 that it does not collect the name, age, or address of a person seeking to use its services,¹⁴⁰ the technical reports of CID¹⁴¹, affidavit of investigation¹⁴², clarificatory hearing transcript dated 23 May 2025,¹⁴³ and TFH Privacy Notice¹⁴⁴ show that TFH processes both personal and sensitive personal information,. During the Clarificatory Hearing on 23 May 2025, TFH disclosed:

DPC JSB: But my question is, let’s say I choose Philippines, right? And then I’ll scan my passport. It’s saying that you have to provide the photo page of your passport, correct?

DK: So yes, that’s what it says. But I want to be clear because like obviously this is a recorded call and it’s creating a record. That’s not what is actually happening. We do not collect the data. What happens is you take a photo of the passport page, then place the passport at the back of the phone. The passport is a chip inside of it. The phone can read the chip. No data is leaving your phone. No data is leaving your phones is very important, OK. What happens is on the device on the phone, the phone reads the chip. It compares the photo of your face. The photo you took of the passport page and the data on the chip, if all of that stuff is the same, meaning it’s the same person that took the photo, the same photo page and the same data on the chip, it will create what are called proofs in your world ID. Those proofs are the ability to do a proof of age or proof of citizenship. But no personal data is retained or shared with us to our systems or our servers or any third party.

xxx

DPC JSB: I was trying to look at your privacy policy. You have a list of data elements that you’ve processed, the retention period and, identification that it’s not being stored. However, I did not see any… I might be mistaken, DK, but if you could direct me to your privacy policy as to which one covers the passport information because technically, while you claim that you’re not storing the information, You’re still processing the information. The fact that you’re scanning it, that you’re processing the information … collecting and storing are two different processes. I am sure you are aware of that, right?

DK: I am aware of that.¹⁴⁵ (Emphasis supplied)

TFH disclosed the following in their Privacy Notice:

Credential Verification Data refers to the data processed when verifying a credential to add it to your self-custodial World ID. This means e.g. reading the NFC chip of your passport to securely store your passport’s information on your device. This data is under your control and after verifying the validity of your credential, TFH stores an anonymized fragment of a hash value of a unique cryptographic signature of your credential (e.g. passport) to ensure that each credential can only be added to a World ID once.¹⁴⁶ (Emphasis supplied)

Based on the foregoing, it is evident that TFH processes sensitive personal information as defined under the DPA. TFH admitted that it collects the photo page of the passport, compares the photo of the data subject’s face and the photo of the passport, and creates proofs of age and citizenship in the World ID.¹⁴⁷ It must be noted that the definition of processing of personal data is not merely confined to storing personal data.¹⁴⁸ It also includes the collection and verification done on the photos of the passports as these are operations performed upon personal data.¹⁴⁹ When TFH verifies the passport information it effectively processes sensitive personal information as defined under the law.

Further, the statement of TFH that no data is stored in the World App is misleading. TFH disclosed the following in their privacy notice:

Location information. You may decide to enable a location-based service (such as a feature allowing you to find an Orb Operator near you). Only with your specific consent, we may then collect information about your location through GPS to enable the location based service to show you an Orb near you. You can change your permissions any time in your device’s settings. If you are not based in South Korea we may also store your approximate location disassociated from your World App account. We use this data to improve our services particularly but not limited to the selection of Orb locations.

xxx

7.¹ Data Transfer. When you provide us with your data, it may be transferred, stored, or processed in a location outside of where your data was originally collected. The country in which your data is transferred, stored, or processed may not have the same data protection laws as the country in which you initially provided the data.

xxx

How We Use Cookies We use cookies to help our Services work better. In addition to cookies, we may use other similar technologies, like web beacons, to track users of our Services. Web beacons (also known as “clear gifs”) are tiny graphics with a unique identifier, similar in function to cookies. Our Cookie Policy, incorporated herein by reference.

We also use Google Analytics. More information on how Google uses your data when you use its partners’ websites and applications: https://policies.google.com/technologies/partner-sites. By using the Services, you consent to us storing and accessing cookies and other data on your computer or mobile device and the use of Google Analytics in connection with such activities. Please read the information at the link provided so you understand what you are consenting to.¹⁵⁰ (Emphasis supplied)

This is further bolstered by the fact that biometric data is analyzed to ensure uniqueness before World ID is issued and data is retained based on user content and for necessary service operations.¹⁵¹ Evidently, TFH stores data contrary to their claim. In this case, there is no valid consent absent an indication that TFH properly informed the data subjects of the details of the totality of personal data processed.

All of the foregoing discussions taken, it is apparent that TFH did not obtain the valid consent from which they base their processing of the data subjects’ personal data whether in the World App or in the Orb. Absent a valid consent, they lack a legal basis for the processing of the personal data of data subjects. Hence, the processing of TFH is unauthorized under Section 28 of the DPA.

II. Violation of the Data Privacy Principles of Transparency, Proportionality, and Legitimate Purpose

Transparency

II.A.1. Privacy notices employed technical and ambiguous language

The general privacy principle of transparency requires that the PIC’s interest is communicated to the data subject, as Section 11 of the DPA provides.¹⁵²

SEC. 11. General Data Privacy Principles. – The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:,

(a) Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only xxx

This principle requires that a PIC should inform the data subject of the nature, purpose, and extent of the processing, using clear and plain language that is easy to understand.¹⁵³

Section 18 of the IRR of the DPA¹⁵⁴ elaborates on the data privacy principle of transparency:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

a. Transparency. The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing

of personal data should be easy to access and understand, using clear and plain language.¹⁵⁵

The requirement to use clear and plain language means that information should be provided in as simple a manner as possible.¹⁵⁶ In NPC 19-450, the Commission emphasized the “clear and plain language” requirement:

The requirement to use clear and plain language does not mean using layman’s terms to substitute technical words at the risk of not capturing the complex concepts they represent. Rather, this requirement means that information should be provided in as simple a manner as possible, avoiding sentence or language structures that are complex. The information provided should be concrete and definitive; it should not be phrased in abstract or ambivalent terms or leave room for different interpretations such as in the above-cited provision which uses the word ‘any’ several times, as well as wordings like ‘including but not limited to’.¹⁵⁷ (Emphasis Supplied)

The TFH Privacy Notice¹⁵⁸ and World Privacy Notice¹⁵⁹ employed technical terminology and relied on broad, ambiguous definitions, thus generating confusion and failing to comply with the fundamental legal requirement that such notices be presented in clear, concise, and easily understandable language.

Both Privacy Notices made use of highly technical terms, including but not limited to “Blockchain Data,” “Anonymized and Aggregated Data,” “Zero Knowledge Infrastructure,” and “Anonymized Shard of a Hashed Value of a Unique Cryptographic Signature”, among others. To illustrate the application and context of these terms within the notices, excerpts from the relevant paragraphs are provided below:

x x x

5.2 Data We Collect From Third-Party Sources

From time to time, we may obtain information about you from the following third-party sources:

Blockchain Data. We may analyze public blockchain data to ensure parties utilizing our Services are not engaged in illegal or prohibited activity under the User Terms, and to analyze transaction trends for research and development purposes.

Identity Verification Services. We may obtain information from third-party services using your data to verify your identity if required by law (such as applicable know-your-customer requirements). To clarify, we do not use your biometric data when we verify your identity as required by law.

Talent data bases. We may collect data from various sources to make job offers to talented individuals.¹⁶⁰

x x x

Please note: Blockchains are public ledgers of transactions that are maintained on decentralized networks operated by third parties that are not controlled or operated by World. Due to the public and immutable nature of blockchain ledgers, we cannot guarantee the ability to amend, erase, or control the disclosure of data that is uploaded and stored on a blockchain.¹⁶¹

x x x

The excerpts provided above not only illustrate the use of highly technical terminology that contributes to ambiguity and confusion, but also contain vague and non-committal language such as “we may obtain,” “we may analyze,” and “we cannot guarantee.” Such phrasings introduce significant uncertainty for data subjects regarding the manner, extent, and timing of the processing of their personal data, thereby undermining the principles of transparency required under the DPA.

Moreover, in accordance with the NPC Circular 2023-04 and Section 18 (a) of the IRR of the DPA on transparency, it is again emphasized that the processing of personal data should be easy to access and understand, using clear and plain language. The information should be provided in the simplest manner possible and avoid using complex sentences or language structures. The use of layman’s terms is encouraged to ensure that the data subject understands the processing. A PIC must not use vague or blanket wording, convoluted information, technical jargon, confusing terminologies, double negatives, and deliberately providing information in a circuitous manner.

World and TFH’s Privacy Notices fail to provide a highly readable and accessible explanation for data subjects, especially given the novelty of the technology, the nature of the data collected, and the complexity of the processing involved.

Providing the data subjects with information that is difficult to understand, long-winded, or complex is inconsistent with obtaining informed consent and incompatible with the principle of transparency. Transparency requires personal information controllers and processors to ensure that privacy notices, consent forms, and related communications are drafted in a manner that is straightforward, easily comprehensible, and tailored to the level of understanding of their intended audience. Failure to do so may render the consent invalid and constitute non-compliance with the overarching transparency requirement of the law—precisely the deficiency present in this case.

The Biometric Consent Form¹⁶² submitted by the TFH is a 29-page document written in Filipino. Notably, the Commission finds that it is without a signature field and includes provisions not applicable to Filipino data subjects.

TFH’s Biometric Consent Form¹⁶³ likewise lacked a clear and explicit request for the data subject’s consent and failed to include any mechanism through which the data subject can perform a positive act indicating acceptance of its terms and conditions. The absence of signature field, or any other affirmative action unjustifiably assumes that the data subject has read, understood, and consented to the processing of their personal data. This implied consent falls short of the standards for valid and informed consent under the DPA and its issuances.

The Biometric Consent Form¹⁶⁴ likewise is written in a manner that is unreasonably lengthy and vague for the reader to easily understand what they are consenting to. Considering the complexity of the processing involved, it is paramount that the consent form be as clear and reader-friendly as possible. Providing a consent form that is lengthy and vague could result in consent fatigue as it tends to overwhelm data subjects. Hence, the consent obtained by TFH may have been improperly given by the data subjects.

The Consent Form, being vague, could mislead data subjects that they may not be providing their personal data. The Consent form provided the following:

Ang datos na aming kinokolekta (na inilarawan sa itaas) ay maaaring ituring o hindi ituring na personal na datos o biometric data depende sa mga naaangkop na batas sa lugar kung saan ka nakatira. Gayunpaman, pagdating sa seguridad, tinuturing namin ang mga ito bilang biometric data at pinangangasiwaan namin ang mga ito nang may karagdagang seguridad at pag-iingat. Sa kontekstong ito, mahalagang malaman ang mga panganib ng pagproseso ng biometric data. Mangyaring tandaan na ang sumusunod ay isang mataas na antas lamang na paglalarawan ng mga panganib na nauugnay sa pagproseso ng biometric data at hindi isang kumpletong listahan.¹⁶⁵ (Emphasis supplied)

Further, the section which supposedly disclosed data subjects’ rights merely stated that the applicability of the mentioned rights depends on their jurisdiction, without providing a full disclosure of the rights guaranteed under the DPA of 2012.

Depende sa iyong hurisdiksyon, karaniwan kang may karapatan sa ilang mga bagay tungkol sa iyong data. Mangyaring basahin ang impormasyon sa ibaba kasama ang seksyon ng Addenda para malaman ang mga karapatan na mayroon ka ayon sa iyong hurisdoksyon.¹⁶⁶

These statements above are contrary to Section F.⁸ of the DPIA of TFH stating that “data subjects are presented with friendly experience which prioritize informing them and presented in plain English or localized appropriately based on the country of the data subject”.¹⁶⁷

It is also worth reiterating here that TFH misrepresented that no sensitive personal information is processed by World App and that no data is stored in the World App.¹⁶⁸

The technical reports of CID¹⁶⁹ and affidavit of investigation¹⁷⁰ show that TFH processes such information, contrary to their claim under their DPIA that they do not process sensitive personal information. Further, the technical reports of CID¹⁷¹ show that data is stored in the World App.

The presence of such contradictory provisions in the documents submitted to the Commission strongly suggest that TFH purports to offer safeguards only in form.

Moreover, the Commission highlights the absence of any presentation, proof or record demonstrating that such biometric consent form was made available to data subjects prior to collection of their biometric data. The data subjects stated in their sworn statements that they did not see nor sign a biometric consent form.¹⁷² Neither the application nor any of the submitted documents submitted to the Commission indicate that the form was provided or explained to the data subjects before biometric data processing commenced. This shows that TFH is without any genuine intention of implementing them in practice or ensuring the effective protection of data subjects’ rights, as required under the DPA.

II.A.3. DPIAs submitted do not reflect the true nature of TFH’s processing

During the Clarificatory Hearing,¹⁷³ the DPIA submitted as part of the letter response dated 19 May 2025 was reviewed and discussed by the Commission. During the course of the discussion, it was clarified that personal data collected by TFH was being shared with the following third-party recipients: TFH Corp, TFH GmbH and AWS.¹⁷⁴

During the same hearing, TFH informed the Commission that the DPIA previously submitted was no longer the most recent version, as an updated DPIA had allegedly been prepared in December 2024¹⁷⁵. Consequently, TFH committed to furnish the Commission with a copy of this updated DPIA for proper evaluation.¹⁷⁶ Excerpts of the Clarificatory Hearing is provided, to wit:

DPC JSB : So, in your Data Protection Impact Assessment (DPIA), the one that you submitted in Section 3. (Let me just get my notes). In Section 3 (C) (1), it says, you had a question where you responded, is it being shared to your third parties, to your third partners and it mentioned that you needed to share encrypted photos of face and eyes. They’re being shared with TFH Corp., TFH GMBH and your third-party recipients, which is AWS. So, meaning to say, you do not store the photos in the Orb, but based on your DPIA you’re sharing them with TFH Corp. with TFH GMBH and with AWS.

DK : No apologies, Deputy Commissioner, and so, I can see why this is confusing. So, if you go to the top of the DPIA, what you will see at the very top of this DPIA, it says DPIA of the World Foundation. Okay. So, when this DPI was created, if you look at the date of creation, DPIA last updated 2024-05-08. At that point in time, when this DPIA was created, there was a separate controller that was involved in the processing. When the anonymized technology that we have discussed with the CID team was fully implemented, that additional party was removed because the data could be fully decentralized and made self-custodial. So, the only….

DPC JSB : So, DK, sorry to stop you. So, are you saying that with this, with the app now, the one that you have provided is a DPIA for a previous setup for your previous system?

DK : No. So, it is accurate as to the system. The difference is that there is a controller who was removed from the system, right? And so that is what this reflects. And we are happy to provide an updated one to reflect that removal that happened in December, that was also flagged for, I believe, when we met with Commissioner Naga before Christmas. I explained to him what was being done at the time, and I explained the changes that were underway with the controllers, and I explained that was why TFH would register with the NPC, which we did, and that is why TFH is the listed controller.

DPC JSB : So, do TFH Corp. and TFH GMBH still exist?

DK : Yes. Yes, TFH GMBH is a wholly owned subsidiary of TFH Inc.

DPC JSB : Right. Is this still accurate with your response and in the Item C2 of your DPIA? That you’re storing data, particularly the encrypted photos of face and encrypted photos of eyes.

DK : But that’s, that’s not what it says, your Honor. Unfortunately, like we’re taking some things out of context. So, if you look at C2, so what C2 says is, if the data will be shared, list the name of all the parties, recipients and the personal data they receive them for what purpose? Foundation. Foundation, meaning the controller at the time, the controller will share the following data with the following processors. Processor in this scenario was TFH, the entity that operates the Orb.

Today, there is no longer the Foundation. There is only the entity that operates the Orb. Therefore, the entity that operates the Orb, the controller TFH. That’s it. So, TFH Corp. receives this data through the Orb when you seek to verify, and it deletes this data as it as it describes further down in the DPIA.

DPC JSB : Right. Okay. Can you provide us an updated DPIA rather than the one that you have in 2024?

DK : Of course. Happy to.¹⁷⁷ (Emphasis supplied)

Subsequently, through a response letter¹⁷⁸ dated 08 June 2025, TFH submitted the alleged updated DPIA, which was attached therein as Annex A.

The updated Data Protection Impact Assessment (DPIA) of the Orb data processing is attached as Exhibit A.¹⁷⁹

Upon scrutiny of both the DPIA¹⁸⁰ and the purported updated DPIA¹⁸¹, the Commission finds that the documents are substantially identical, except for the first page (particularly the Project Team Member and Contact, Privacy Team Member and Contact, DPIA last updated) and Item C.2. This aligns with the findings of the CID that the “updated” DPIA submitted by TFH was, in substance, the same document as the earlier version.¹⁸² No new analysis, risk assessment, or mitigating measures responsive to the Commission’s directive are reflected.¹⁸³

The Commission expresses concern over the credibility of the claim that data transfers to the aforementioned third-party recipients have ceased, especially in the absence of newly submitted structural or procedural documentation to support such assertion. Furthermore, there is no objective indication, such as uneditable timestamps, or change history—that would validate the updated status of the submitted DPIA. In light of the asserted structural changes implemented and absence of adequate audit trails, the Commission finds the DPIA submitted by TFH to be unreliable given that no evidence was presented to demonstrate that the DPIA was, in fact, changed or updated.

Clearly, despite claiming to have updated its DPIA and committing to submit the same to the Commission, upon direction during the Clarificatory Hearing, TFH failed to submit a genuinely updated version of its DPIA. Failure to adhere with the directive of the Commission constitutes non-compliance.

To add, the Commission, in this case, notably relays that TFH should have been diligent and should have extended extra care to the submissions and compliance made with the Commission as a regulatory body. Such diligence portrays not only their respect to the Commission but also their commitment to follow and observe the Philippine law. TFH ought to have exercised due diligence and exhibited a higher degree of care and accuracy in its submissions to, and compliance with, the regulatory requirements of the Commission. This not only undermines the integrity of TFH’s representations but also reflects a disregard for the principle of accountability and the respect due to regulatory processes under the Data Privacy Act of 2012.

In view of the foregoing, the Commission cannot give weight to the assertion of TFH as regards data transfer and storage. The DPIAs submitted by TFH do not reflect the true nature of its processing. As such, they cast doubt on the lawfulness of TFH’s processing operation. With TFH’s non-compliance with the Commission’s directive to submit an updated and reliable DPIA, TFH has not afforded this Commission to verify or assess with confidence its actual and precise data processing operations nor its compliance with DPA, its IRR, and other issuances. Consequently, the Commission, based on the evidence before it, cannot give credence to the submitted DPIAs of TFH to conclude that TFH is not engaged in practices that violate the DPA, nor that its processing of personal data is not detrimental to public interest.

II.A.4. TFH remains to be the sole controller of the Biometric Data

TFH in its Supplemental Comment/ Opposition¹⁸⁴ has communicated that they do not retain any personal data. According to them, the photographs taken by the Orb are encrypted, transferred to the user’s device as part of the encrypted PCP, and are deleted from the Orb.¹⁸⁵ Moreover, they stated that high resolution photographs are further fragmented into multiple new and unique codes by the AMPC process which are decentralized and distributed to independent third-party nodes.¹⁸⁶ This is further discussed through TFH’s submission of the WorldCoin Private by Design document¹⁸⁷, to wit:

It only takes a smartphone to create a World ID, but proving the holder is a unique human who hasn’t created multiple World IDs—while keeping their identity private is a complicated challenge.

Biometric data, when appropriately anonymized, provides the solution. The very usefulness of biometric data means it should

be collected and used minimally and when it is the only viable path, it must be handled with care.

Worldcoin does this via SMPC.

When a person verifies their World ID via an orb, the orb takes pictures of their iris and face. It uses these pictures to make an iris code, which is essentially a series of 1s and 0s. No two iris codes are the same nor do they reveal direct identifiers such as name, gender, age, etc.

This iris code is split into different pieces and permanently encrypted using SMPC, which makes data anonymous by splitting it into multiple abstracted values (SMPC shares) and storing them in separate locations managed by two legally distinct entities. In the near future additional storage partners (including universities and non-profits) will be added, meaning that the iris codes will be split into even more abstracted values stored and managed by even more independent entities. No single party has access to a part of an iris code. Rather they only have access to the SMPC share stored under their control and management.¹⁸⁸ (Emphasis supplied)

Although TFH has consistently asserted that it does not store personal data, claiming that the photographs captured by the Orb are anonymized, fragmented and stored across different entities or providers, the Commission finds otherwise. Despite these assertions, it is the Commission’s position that TFH remains the sole PIC of the data processed by the Orb.

Under the DPA, the PIC is responsible for personal information under its control or custody, including information that have been transferred to a third-party for processing, whether domestically or internationally.¹⁸⁹ The PIC is defined as:

(h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. The term excludes: (1) A person or organization who performs such functions as instructed by another person or organization; and

(2) An individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs.¹⁹⁰

In this context, TFH exercises exclusive control over the photographs taken by the Orb and retains the sole capability to re-identify and decrypt the so-called anonymized personal data. Notably, during the verification process, a QR code is generated from the World App and scanned through the Orb, and thereby creates a World ID. This process clearly establishes the connection between World App and World ID whose PIC is both TFH.

Further, the iris code is split into different pieces and permanently encrypted using SMPC and are stored in separate locations managed by two legally distinct entities. These entities qualify as Personal Information Processors (PIPs) under the definition of the DPA.

Under the DPA, a PIP is defined as:

Personal information processor refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.¹⁹¹

These processors operate under the authority and control of TFH, and do not possess independent discretion in the handling of the personal data. As such, their involvement does not alter TFH’s status as the PIC. TFH remains to be accountable for complying with the requirements of the DPA, its IRR, and issuances.

Accordingly, the assertion that no personal data is being stored due to anonymization and fragmentation is without merit, as TFH possesses the technical means to reverse the anonymization and re-associate the data with identifiable individuals.

Therefore, pursuant to the general data privacy principle of transparency, TFH bears the obligation to inform data subjects of its capacity to access, re-identify, and store such personal data. TFH’s failure to disclose this capability in their Privacy Notice and Biometric Consent Form constitutes a breach of transparency obligation under the DPA. Thus, TFH should be held accountable.

II.B. On Proportionality and Legitimate Purpose

Section 11 of the DPA provides:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

(a) Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only;

(b) Processed fairly and lawfully;

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed.¹⁹² (Emphasis supplied)

Section 18 of the IRR also elaborates on legitimate purpose and proportionality:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

x x x

b. Legitimate purpose. The processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.¹⁹³ (Emphasis supplied)

The DPIA submitted by the TFH regarding the Orb processing explicitly states that the purpose of processing images of the data subject’s face and eyes (iris) is to determine humanness and uniqueness to provide proof of personhood.¹⁹⁴ The processing aims to confirm that the data subject is real and is a unique human being.

The DPIA further provides a specific example, stating that such proof of humanness may be used to log in to platforms such as Reddit and Discord servers.¹⁹⁵ It is expressly discussed in the DPIA that:

The use cases i.e. purposes for processing the data are to determine humanness and uniqueness to provide a proof of personhood.

While this is the distinct purpose of processing, it may be helpful to consider the uses which a data subject may make of their proof of personhood. For example, a data subject may use their proof of personhood to log into a third party service (e.g., Reddit, Discord server, etc) to prove they are human and not a machine, without sharing personal data, like name, email address or other information with the third party service.¹⁹⁶

x x x

The interests of the Company to conduct the processing is the interest of providing a Proof of Personhood (“PoP”)

Proof of personhood is the process or mechanism used to certify that an individual is a real, unique human being. Unlike traditional identity verification methods, proof of personhood does not require linking to a specific digital identity or revealing personal information. It is primarily concerned with establishing

the authenticity and uniqueness of a human participant in a digital or online context.¹⁹⁷

x x x

Why does Company want to process the data (what are we trying to achieve) and does the processing achieve the purpose?

Company processes data concerned to certify that data subjects are real, unique human beings. The primary goal is to provide a PoP to ensure that the internet can continue to function as it does currently (or even better). This means preparing platforms for an abundance of AI generated content and interactions that are steered by autonomous agents (bots). These would significantly alter the shared experience of online spaces. A PoP can help alleviate those issues by:

● Preventing fraud and abuse in digital interactions by ensuring that participants in online activities are genuine and occurring between humans.

● Enhancing the trust and credibility of online interactions and transactions.¹⁹⁸ (Emphasis supplied)

Further, it is likewise argued by the TFH that the Proof of Personhood is used for combating fraud and abuse in online activities by the data subject as AI contents and interactions rapidly increase.¹⁹⁹ CID, in its application of the CDO, argued that such purpose was excessive and unnecessary to the gathering of the data subject’s images of face and eyes (iris).²⁰⁰

The Commission finds that the processing of the data subject’s facial and iris images is excessive and not necessary for the purpose asserted by TFH.

As argued by the CID in its application for the CDO, the data in question has been characterized as unique and belonging to a distinct category of personal information.²⁰¹ These are not merely incidental pieces of data about an individual but are directly tied to their physical identity.²⁰²

Although TFH claims that the images of the face and eyes (iris) are used solely to confirm whether an individual is human and not to authenticate their specific identity, TFH has failed to demonstrate that such processing is the only viable method of achieving that purpose:

Finally, with respect to the allegation that TFH’s collection of biometric data is excessive since it involves even retinal and iris scans for mere authentication, NPC CID is once again misguided. As previously explained, biometric data (i.e. photographs of user’s face and eyes) is used not to authenticate a person’s identity but rather to confirm that they are human and generate a unique iris code as part of the World ID. The World ID, in turn, is used to verify personhood. The process of using the World ID to verify personhood with relevant third-party application does not involve the further use of biometric data as these are all deleted from the Orb once the World ID is created.²⁰³ (Emphasis supplied)

The primary argument consistently advanced by TFH is that no further processing occurs because the data is deleted from the Orb once the World ID is generated.²⁰⁴ However, the necessity of collecting such data has not been adequately justified, nor has it been established that processing such data is the only available or proportionate means of confirming a person’s humanity.

The Commission is unconvinced of the necessity of processing facial and eyes (iris) images for this purpose. It has not been established that less intrusive alternatives were adequately considered or that such data collection complies with the principles of legitimate purpose and proportionality under the DPA. Specifically, the objective of confirming an individual’s humanness could plausibly be achieved through alternative, non-biometric methods such as the observation of human-specific behavioral cues or physical interactions, without resorting to the processing of facial and eyes (iris) images.

Furthermore, the Commission questions whether humanness could not have been reasonably ascertained by the use of non-biometric methods mentioned above combined with personnel present at their verification schedules with the Orb, at the point of interaction, without the need to permanently capture facial or eye (iris) imagery. Such an approach would have constituted significantly less intrusive means of achieving the same objective.

Given the sensitive nature and importance of the facial and iris images, it must be properly argued and substantiated how such processing is the sole or most appropriate means of determining human status, and how this directly relates to the legitimate purpose for which the data is being collected. This justification must be made in accordance with the data privacy principles of proportionality and legitimate purpose. In this case, however, no such justification was adequately presented. Instead, TFH focused on the alleged inability of the CID to provide conclusive proof of violations of the DPA rather than addressing the substantive concerns and clarifications raised by the Commission during the Clarificatory Hearing.

Since the purpose of the processing of the biometric data was not proven and addressed by TFH to be necessary and not excessive, it remains to be illegitimate in this case. The Commission agrees with the contention of the CID that it would be contrary to morals and public policy to gather, collect, and potentially retain such a special class of immutable personal information if the stated purpose could have been fulfilled through other means.²⁰⁵

Moreover, TFH’s actual operations in the Philippines seem to be different from and incompatible with their declared purpose and processes under their DPIA. The sworn statements of the data subjects likened TFH’s operation in the country to a recruitment scheme where they entice people to give their personal data in exchange for monetary incentives, contrary to their declared purpose of determining humanness and uniqueness to provide a proof of personhood.²⁰⁶ Based on the technical report, some recruiters also offered free rides and snacks if data subjects used their code, with an agreement to share an amount that they would earn as commission.²⁰⁷ There were also instances of individuals selling accounts associated with referral codes.²⁰⁸ The investigation revealed that Facebook was being used as a platform to promote recruitment for the World App application, and the application was being used primarily for monetary gain.²⁰⁹

TFH cannot deny accountability for these schemes as the provision of monetary incentives are found in their privacy notice and application and knowledge of these schemes were admitted by them during the Clarificatory Hearing dated 23 May 2025.²¹⁰ In their privacy notice, TFH provides:

Our Commitment to Protecting your Privacy and Data

We are deeply committed to protecting your privacy and securing your data. We recognize that we can only fulfill our mission of distributing our digital tokens fairly to as many people as possible if people trust us, and privacy and data security are central to earning your trust.”²¹¹ (Emphasis supplied)

In their application, data subjects can find a statement saying, “Verify Your World ID Find an Orb to unlock benefits”.²¹² Moreover, the screenshot of the message when a referral link is sent states:

“Hi. Download World App and verify your account to get 54.06 WLD in the next year, currently worth PhP 3,415,14. Enter my code in settings.²¹³ (Emphasis supplied)

During the Clarificatory Hearing on 23 May 2025, TFH admitted that they were aware of the Facebook post regarding the monetary incentive offered for the processing of the data subjects’ biometric data.²¹⁴ They were also made aware of other similar Facebook posts during the said hearing.²¹⁵ However, as earlier discussed, they themselves admitted that they did not undertake specific actions against such posts thereby tolerating such actions:

x x x No formal communication took place but a former employee did raise a response through facebook but unfortunately no response was received x x x

Information on actions taken in response to similar Facebook posts made by other groups or pages offering monetary incentives in exchange for using the World App and verifying identity and humanness through the Orb. While there were no specific actions taken against such posts, educational material at locations were ramped up and locations were more closely monitored. x x x²¹⁶ (Emphasis supplied)

Thus, in violation of the principle of proportionality and legitimate purpose, TFH failed to establish that there are less intrusive means to achieve its purpose and failed to prove the relation between the provision of monetary incentives and the determination of proof of personhood.

III. Violation of Data Subject Rights

The Commission finds that TFH, on multiple occasions, violated Section 16 of the DPA which outlines the guaranteed rights of data subjects.

The guaranteed rights of the data subjects are listed under Section 16 of the DPA:

SEC. 16. Rights of the Data Subject. – The data subject is entitled to:
(a) Be informed whether personal information pertaining to him or her shall be, are being or have been processed;
(b) Be furnished the information indicated hereunder before the entry of his or her personal information into the processing system of the personal information controller, or at the next practical opportunity.

x x x

(c) Reasonable access to, upon demand xxx
(d) Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable

x x x

(e) Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, the personal information controller may notify third parties who have previously received such processed personal information; and
(f) Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.²¹⁷ (Emphasis supplied)

III.A. On the violation of the right to be informed

First, TFH’s Privacy Notice²¹⁸ and Biometric Consent Form²¹⁹ failed to fully disclose all the guaranteed rights of the data subjects under the DPA. It is a legal requirement that the data subjects are informed of their rights and the existence of those rights as an essential component of their right to be informed.²²⁰ Any failure to disclose all the guaranteed data subject rights constitutes a violation of the DPA.²²¹ Clearly, TFH failed to uphold the rights of the data subjects when it failed to disclose these rights in their key documents.

Second, the Commission finds that TFH’s Privacy Notice²²² and Biometric Consent Form²²³ failed to meet the standards set forth under NPC Circular No. 2023-04. The non-compliance to NPC Circular No. 2023-04 is evident and proven by the Witness Affidavits of TFH’s data subjects (Witness Affidavits)²²⁴ to wit: 1) data subjects admitted to not thoroughly reading the Privacy Notice due to its length and complexity²²⁵; 2) orientation²²⁶ and signing of biometric consent form²²⁷ were not implemented across all Orb sites; 3) data subjects conveyed concerns²²⁸ as to the use of their biometric data and lack of understanding of the processing²²⁹. These clearly reflect the quality of information provided to the data subjects and serve as strong indicators of the violation of their right to be informed. Further, TFH’s Privacy Notice does not disclose collection and storage of biometric data for other purposes like AI machine-learning model. Also, nothing in TFH’s declared purpose states that their processing includes user verification without retaining any identifiable personal data.²³⁰

It bears emphasizing that among the obligations of the PICs is the duty to ensure, whether through its documents or representatives, that data subjects fully comprehend the information disclosed to them. This obligation extends beyond the mere act of disclosure for compliance purposes; it requires meaningful communication that enables an informed understanding.

Third, the Commission gives weight to the investigation and findings of the CID which concluded that TFH and its local operator failed to provide data subjects with sufficient time to read the Privacy Notice and that staff instructed data subjects to press the “Agree” button²³¹.

These acts constitute a deliberate disregard of the obligation to ensure data subjects are fully informed.

Considering the sensitive nature of the personal data being processed, the novelty of the technology, and its implementation in the Philippines, as well as the varying levels of AI literacy among Filipinos, TFH is expected to exercise the highest standard of diligence in informing its data subjects.

III.B. On the violation of the right to access

TFH’s Privacy Notice²³² and Biometric Consent Form²³³ provide that a data subject has the right to access:

You have the right to obtain from us at anytime upon request information about the personal data we process concerning you. You have the right to receive from us personal data concerning you.

TFH’s Biometric Consent form includes a notice stating that data subjects have certain rights to some of the information regarding their personal data, depending on their jurisdiction:

Depende sa iyong hurisdiksyon, karaniwan kang may karapatan sa ilang mga bagay tungkol sa iyong data.²³⁴

However, a plain reading of this statement suggests that data subjects may only have rights over certain information about their personal data, rather than rights over the personal data itself. This phrasing creates ambiguity and misleads individuals regarding the full scope of their data protection rights under the DPA.

Further, TFH claims that the biometric data are deleted from the Orb and transferred and stored on the data subjects’ mobile phones.²³⁵ In essence, TFH asserts that given this, they do not need to provide data subjects with mechanisms to exercise their rights to access and erasure with respect to their photos and iris codes anymore. However, TFH failed to prove that it does not store the photos and iris scans collected during verification with the Orb. Contrary to their claim, TFH stated in their Biometric Consent Form that the image data are retained for a maximum period of ten (10) years:

Bukod pa rito, ipinapangako naming na idelete ang lahat ng Image Data pagkatapos ng maximum na sampung taon matapos ang koleksyon bagaman nag pad develop ng algorithm at ang kaakibat na pagdelete ng lahat ng Image Data ay malamang na matatapos nang mas maaga. (Emphasis supplied)²³⁶

This concern is further supported by the fact that the Orb is capable of storing and retaining biometric data and there is no proof of deletion within 12 seconds provided by TFH. In fact, TFH’s security audit²³⁷ provides that they have no procedure to scrub or erase iris data in the Orb:

However, in the current iris data processing process, there is no procedure to scrub or erase iris data that remains in memory after its use. As a result, an attacker with temporary access to physical or logical memory could potentially exfiltrate plaintext iris data.²³⁸

Aside from the data subjects’ photos and iris scans, data subjects should also have the right to access the encrypted photos of their faces, eyes, abstractions of the photos, and certain metadata. These personal data are under the custody and within the sole control of TFH. Accordingly, TFH is obligated to uphold the data subjects’ right to access their personal data, as guaranteed under the DPA.

TFH’s Privacy Notice²³⁹, World’s Privacy Notice²⁴⁰, and Biometric Consent Form²⁴¹ provide for the right to demand deletion:

Right to demand that we delete the personal data concerning you. There prerequisites provide in particular for a right to erasure if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, provided the requirements for deletion under the applicable laws are given (e.g. several jurisdiction’s laws oblige us to retain transaction information for a certain period of time. (Emphasis supplied)

Based on the above, the right to deletion or erasure afforded to the data subjects is dependent on whether the personal data is no longer necessary for the purposes for which they were collected. This is incorrect. The basis of TFH in processing its data subjects’ personal data is consent. Therefore, the right to erasure should be absolute – once consent is withdrawn, there remains no legal basis for the PIC to process the data. If TFH has any other legal basis to retain the data, such basis should have been declared to the data subjects. Thus, TFH has clearly violated data subjects’ rights to withdraw consent and their right to erasure.

To add, the Consent Form and the Privacy Notice provide vague and, at times, contradictory guidance on how to withdraw consent and to request the deletion of personal data, leaving data subjects without the essential information to effectively exercise their rights. For instance, the Privacy Notice fails to include any reference to the necessity of accessing the designated portal requesting data deletion, as mentioned in the Consent Form.²⁴²

Moreover, the rules on withdrawal of consent require that, “consent can be withdrawn at any time and without cost to the data subject”.²⁴³ In this case, while data subjects can cancel the Orb verification to read the privacy notice, such cancellation would cost them their time and resources. This is because the data subjects have already travelled to the place where the Orb was located. For those who invested their time to line up, rescheduling would mean forfeiting both the immediate financial incentive and valuable hours of their day. Hence, the most logical thing to do for them is to proceed notwithstanding the lack of information and understanding as to what they were giving away.

The Commission also concludes that the processing of personal data in question is irreversible. To fully exercise the right to erasure, data subjects must be furnished with documentation or evidence confirming the deletion of their personal data. In this case, the Commission finds that TFH failed to provide the same.

Notably, TFH’s Privacy Notice and Biometric Consent Form outline certain rights afforded to its data subjects. However, these are not fully aligned with the rights guaranteed under the DPA. While TFH includes the right to access, right to demand correction, right to deletion and right to object, it omits key statutory rights, specifically the right to rectification and right to damages.

Guaranteed rights are rendered meaningless and remain to be mere concepts without adequate enforcement mechanisms and genuine efforts to inform data subjects.

Based on the foregoing, TFH clearly violated the data subjects’ rights. The inadequate and ambiguous disclosures contained in TFH’s Privacy Notice and Biometric Consent Form constitute a violation of the right to be informed. These vague and unclear statements have, in turn, resulted in further violation of other data subject rights, including the right to access, right to withdrawal of consent, and right to erasure. Data subjects cannot reasonably exercise these rights due to the absence of mechanisms and clear guidance on how such rights may be exercised. Moreover, TFH’s assertion that personal data are deleted in the Orb and transferred to data subject’s phones, amounts to a denial of the right to access and right to erasure, particularly in light of the fact that that the processing is irreversible.

Second requirement: That such act or practice is either detrimental to national security or public interest, or that the order is necessary to safeguard the rights of a data subject

The Commission finds that TFH’s grave and serious violations of the DPA, its IRR, and other related issuances are detrimental to public interest and warrant the issuance of a CDO to preserve and protect the rights of the data subjects.

I. Necessary to safeguard the rights of data subjects

Consistent with the CID’s Comment dated 18 August 2025, this section satisfies the requisites under Section 7 (c) of the DPA and NPC Circular No. 20-02 for the issuance of a CDO. TFH’s grave and serious violations of the DPA, its IRR, and other related issuances warrant the issuance of a CDO to preserve and protect the rights of the data subjects.

Based on the foregoing discussions, the very foundation of TFH’s processing, or its legal basis of consent, failed to meet the standards required under the DPA, its IRR, and other related issuances. Therefore, TFH has no other lawful basis for its processing. Given the nature of the processing involved, the combination of invalid consent and failure to uphold the right to be informed amounts to a systemic violation of Section 16 of the DPA, not a mere technical defect. Consent is the sole legal basis applicable to it under the DPA. If the very core of the processing is not in compliance with the law, then the rights of the data subjects are at serious risk of being infringed.

Further one of the key assertions made by TFH is that the Orb deletes biometric data within twelve (12) seconds after verification. Despite being afforded the opportunity to prove the same²⁴⁴, TFH failed to prove that it is technically impossible for the Orb to store biometric data. More concerningly, the Orb was found to possess storage capacity²⁴⁵ which means it may and can retain data, thereby exposing data subjects to the risk of unauthorized processing. The capacity of the Orb to store data is a critical factor in assessing TFH’s processing operations, as TFH declares that the processing ends approximately twelve (12) seconds after the verification process with the Orb. The claim that the mere purpose of the processing is to verify that a person is a unique human is undermined by the substantial storage capacity of the main processor – the Orb.

The Commission agrees with the CID that TFH’s processing does not cease once the initial registration in the Orb is complete.²⁴⁶ TFH’s processing of personal data is sustained in two aspects: first, through the data subjects’ continuous usage of World App; and second, through the distribution, storage and organization of the AMPC shares, or the anonymized fragments by TFH’s trusted third-parties, which are its PIPs under the DPA.²⁴⁷ Once again, TFH failed to prove that no processing occurs after the verification in the Orb. Also, TFH failed to substantiate its claim that it is technically impossible for them to combine these anonymized fragments, despite being given the opportunity to do so.

Given the immutability of the personal data processed by TFH, any compromise would cause grave and irreversible harm to data subjects. Further, since TFH’s processing remains ongoing and without a lawful basis, the risks to data subjects are continuous and escalating. Thus, in line with the CID’s findings, the Commission finds that the processing involved in TFH’s operations constitutes harm that is grave, irreversible, and ongoing.

In sum, the Commission finds that TFH’s practices necessitate the protection of the rights of data subjects. The following, among other findings, support this conclusion: 1) The legal basis for the processing, which is consent, is not in compliance with the DPA, and therefore TFH has no legal basis to process personal data both in the World App and in the Orb; 2) TFH practices violate the principles of transparency, proportionality, and legitimate purpose; 3) Multiple data subject rights were violated; 4) TFH failed to prove that the Orb deletes biometric data within 12 seconds; 5) The stated purpose of verifying that a person is a unique human is undermined by the Orb’s substantial storage capacity and failure to prove the same; and 6) TFH has the exclusive control and discretion over the anonymized data fragments.

Thus, this ongoing processing, absent any lawful basis and compliance with the DPA, its IRR, and related issuances, poses a continuing risk to the rights of the data subjects. Consequently, the risks and harm associated to the processing of TFH necessitate the Commission to preserve and protect the rights of the data subjects through the issuance of a CDO pursuant to NPC Circular No. 20-02.²⁴⁸

II. Detrimental to public interest

As Mark Manson writes, “Our values determine the metrics by which we measure ourselves and everyone else.” By this measure, TFH’s actions suggest that it places greater value on rapid deployment and global expansion than on ethical, lawful, and transparent data processing. Its disregard for key data rights signals that compliance with local data protection laws, including the DPA, may be strongly viewed as a secondary concern, if not a mere formality.

To reiterate, the Commission finds that TFH cannot deny exclusive control and discretion over the anonymized fragments even though these anonymized data are distributed to multiple parties. There is nothing more concerning than a controller turning a blind eye to the risks associated with its processing or misrepresenting the extent of the data it controls. Such conduct justifiably prompts this Commission to take heightened measures to safeguard the fundamental right to privacy of the data subjects.

To add, TFH confirmed the location of its database in Germany and that it is subject to an ongoing data protection investigation with German Data Protection Authority²⁴⁹. Also, TFH claims that AMPC shares, or the anonymized fragments, are distributed and stored securely across multiple independent and trusted parties and thus eliminates the risks.²⁵⁰ The Commission disagrees.

The distribution of fragments across multiple independent and trusted parties does not, in itself, eliminate the presence or risk of threat actors. On the contrary, the fact that these parties process biometric data, particularly immutable biometric identifiers, renders them high-value targets and highly attractive to malicious actors. The same concern applies to TFH’s database.

TFH has portrayed itself as employing technically secure processing methods and involving trusted parties in its operations. However, with the rapid evolution of technology, it is well understood that no system can be considered entirely secure. Rather than relying on unsubstantiated claims of security, TFH should have demonstrated greater transparency, cooperation, and due diligence.

Lastly, it is public knowledge that TFH’s operations in various jurisdictions have been halted for several privacy-related concerns. Regardless of how it is denominated, either stopped, halted, or under investigation, all these compel the Commission to err on the side of caution and serve as the very reason for the necessity to preserve and protect both the rights of the data subjects and the general well-being of the public. TFH, despite the challenges faced in various jurisdictions, failed to exercise due diligence in complying with the DPA, its IRR, and its related issuances before launching its operations in the Philippines. TFH’s registration with the NPC does not, by itself, constitute compliance with the requirements of the law. Registration is only one of the many obligations imposed upon personal information controllers under the Data Privacy Act and its IRR. It allows transparency and enables the NPC to perform its oversight and enforcement role among others. It does not, however, serve as a blanket assurance that the entity has fully complied with its substantive obligations, such as ensuring lawful processing, upholding the rights of data subjects, and implementing appropriate organizational, physical, and technical security measures. In other words, registration is an important procedural step, but it is not in itself a badge of full compliance with the law.

Ultimately, the Commission finds that TFH’s practices are detrimental to public interest. The following, among other findings, support this conclusion: 1) TFH has the exclusive control and discretion over the anonymized data fragments; 2) TFH, as thoroughly discussed in the foregoing section of this Order, has been found to have engaged and is currently engaging in practices violative of the DPA; 3)The irreversible processing of immutable biometric data concerns the public interest; and 4) Various international data protection authorities have taken action in response to data-privacy concerns arising from the operations of TFH.

The multiple violations, misrepresentations, and non-compliance with the Order of the Commission constitute serious and grave concerns that compel the Commission to act in fulfillment of its mandate to uphold the fundamental right to privacy of the Filipino people, particularly where the processing of personal data poses a detriment to the rights of the data subject and that of the public interest. Hence, these warrant the issuance of a cease-and-desist order.

Third requirement: Unless restrained, the continuance of such act or practice will result in grave and irreparable injury to a data subject

The general data privacy principles are anchors and guiding frameworks to ensure lawful, moral, and ethical processing of data. These principles are not merely aspirational, but foundational requirements under the DPA that govern all stages of data processing.

In this case, TFH was found to have violated all three (3) general data privacy principles. To restate, TFH failed to uphold the principle of transparency by deploying privacy notices, the content and form of which were not in compliance with the requirements set forth under the DPA. Also, TFH’s misrepresentation, ambiguous and inadequate disclosures, and contradictory claims run afoul the principle of transparency. Furthermore, TFH’s failure to establish the relation between the provision of monetary incentives and the determination of proof of personhood contravenes the principles of proportionality and legitimate purpose. Absent proof, that the processing is proportionate to its declared purpose, and is neither excessive nor unnecessary, TFH fails to meet the standards imposed under the principle of proportionality and legitimate purpose of the DPA. These violations reveal comprehensive disregard for its core obligations and demonstrate more than mere noncompliance. These show a systemic failure to uphold basic standards of data protection.

TFH’s violation of all three is deeply alarming. Quoting Mark Manson once again, as he sharply puts it, “With great responsibility comes great [failures] if you’re not careful.” TFH, as an international and large-scale data controller, bears great responsibility for safeguarding the personal data it processes, particularly immutable biometric data. Its failure to meet even the minimum privacy standards does not justify carelessness; it underscores a dangerous level of institutional complacency that places its data subjects at grave risk that will result in grave and irreparable injury to Filipino data subjects.

Further, the processing of personal data in question is irreversible and TFH fails to implement adequate mechanisms through which data subjects can ensure that upon withdrawal of consent, their biometric data are deleted. This irreversibility results in the complete transfer of control over such data from the data subjects to TFH, raising significant concerns regarding the protection of fundamental data privacy rights.

TFH asserted that the collection of biometric data by WorldApp would not cause grave and irreparable injury to data subjects and indicated that if World App and proof of human technology is not available in the Philippines, Filipinos would be at risk as AI accelerates around the world.²⁵¹ This assertion is speculative. The Commission does not give credence to this assertion without any substantial or persuasive evidence.

The consequences of TFH’s data privacy violations are neither speculative nor hypothetical. The Commission agrees with the CID, in its Comment, that some of the real risks involved in the processing and possible mishandling of biometric data include that deepfakes may be generated using the collected data and used for identity fraud or theft.²⁵²

The credentials being processed by TFH is an immutable biometric identifier. The compromise of biometric identifier cannot be remedied through password reset, replacement ID, or digital remedy to undo any potential harm. The harm resulting from such exposure is inherently irreparable and cannot be adequately compensated by any amount of monetary award, lacking a reliable standard for measurement that would render a legal remedy proportionate to the possible harm it may cause to the data subjects.

As such, the continued processing of biometric identifiers by TFH exposes data subjects to grave and irreparable injury. A single breach would result in permanent and lifelong exposure to harm. Unless restrained, the harm is irreversible, and the consequences enduring, thereby warranting the issuance of a CDO.

Considering the totality of the foregoing, the Commission finds that the CID, by substantial evidence, has established the presence of the grounds warranting the issuance of a cease-and-desist order. It is clear to this Commission that TFH is engaged in practices violative of the provisions of the DPA, its IRR, and related issuances. Specifically, the consent relied upon by TFH as its sole legal basis for processing is not specific, freely given and an informed indication of the data subjects’ will.

Further, aside from TFH’s misrepresentation that no sensitive data is being processed and stored in the World App, TFH also failed to adhere to all three (3) data privacy principles of transparency, proportionality, and legitimate purpose. Aggravating the matter further, the Commission found numerous violations of the guaranteed rights of the data subjects, particularly the rights to be informed, access, and withdrawal of consent and erasure.

Furthermore, the lack of adequate mechanisms to ensure deletion of data upon withdrawal of consent and the irreversibility of the processing of immutable biometric data, among others, expose the data subjects to continuing harm and grave and irreparable injury.

All of these taken together, it is clear that TFH’s processing is detrimental to public interest and a CDO is necessary to safeguard the rights of data subjects.

WHEREFORE, premises considered, TFH, and its local operator WCPH Corporation, is hereby ORDERED to CEASE and DESIST from the processing of personal information within the Philippines through the Orb and the World App.

This Cease and Desist Order covers the following:

Making the World App available for download, whether through the Apple App Store, Google Play Store, or any other platform, and from any further use of the same within the jurisdiction of the Philippines;
Conducting any form of identity verification using the Orb device in all verification locations, including but not limited to biometric scanning, registration, or processing activities associated with World ID; and
Transferring, disclosing, or in any manner sharing any personal data that it has already collected or processed prior to the issuance of this Cease-and-Desist Order.

Additionally, TFH is ORDERED to SUBMIT the total number of Filipinos registered in the World App and verified through the Orb and to SUBMIT all the locations where they are currently operating.

Further, in accordance with Section 9 of NPC Circular No. 20-02, TFH is hereby ORDERED to SUBMIT a comment on the Order and to file the same within ten (10) days from receipt hereof.

Finally, the Enforcement Division of the NPC is hereby tasked to ensure the implementation of this Order no later than seventy-two (72) hours from receipt of TFH and to submit to the Commission a report within forty-eight (48) hours after the completion of the implementation.

This Order is immediately executory upon receipt and shall remain in effect until lifted or modified by the Commission.

SO ORDERED.

Quezon City, Philippines.
23 September 2025.

SGD.
JOSE AMELITO S. BELARMINO II
Deputy Privacy Commissioner

WE CONCUR:

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner

Copy furnished:

DK
TOOLS FOR HUMANITY

NM
TOOLS FOR HUMANITY

JP
TOOLS FOR HUMANITY

COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT

Footnotes

See TFH Submission for CID CDO No. 25-001, dated 19 May 2025; See also TFH Supplemental Comment/Opposition CID CDO No. 25-001, dated 18 July 2025. ↩ ↩²
Onsite visits for SS 25-007, 09 and 13 May 2025; Annexes “G,” and “G-1” CID Comment, 18 August 2025. ↩
See Certificate of Incorporation and Registration Documents from SEC in file “Letter from SEC dated 04 June 2025.” ↩
World Website available at https://world.org/orb (last accessed 08 September 2025). ↩
Initial Report, 19 February 2025, SPRINT 2025-00270. ↩
Initial Report, SPRINT 25-00270 (Retina Scan Plaridel Bulacan), 19 February 2025l See Annex “N”, of CID Comment 18 August 2025. ↩
Id. at Annex “A” thereof. ↩
CID Comment, p.2, 4, 18 August 2025. ↩ ↩²
Application for the Issuance of the Cease and Desist Order dated 07 May 2025. ↩
World Website available at Http://world.org/world-id (last accessed 08 September 2025). ↩
World Website available at Http://world.org/world-app (last accessed 08 September 2025). ↩
World Website available at Http://world.org/worldcoin-token (last accessed 08 September 2025). ↩
World Website available at Http://world.org/world-chain (last accessed 08 September 2025). ↩
World Website available at Http://world.org/orb (last accessed 08 September 2025). ↩
Application for the Issuance of the Cease and Desist Order dated 07 May 2025, p. 7. ↩
Id at p. 8. ↩
Id at pp. 8-9. ↩
Id. at p. 3. ↩
Id. at p. 9. ↩
Id. ↩
Application for the Issuance of the Cease and Desist Order dated 07 May 2025, p.10. ↩
Minute Resolution CID CDO No. 25-001, dated 08 May 2025. ↩
Letter dated 19 May 2025 signed by TFH in relation to CID CDO No. 25-001. ↩
Id. ↩
Id. at p.2. ↩
Id. at p.3. ↩
Id. ↩
Id. at p.4. ↩
Letter dated 19 May 2025 signed by TFH in relation to CID CDO No. 25-001 at p. 4. ↩
Id. ↩
Id. ↩
Id. at p.5. ↩
Id. ↩
Letter dated 19 May 2025 signed by TFH in relation to CID CDO No. 25-001. ↩
Id. at p.7. ↩
Id. at p.8. ↩
Id. ↩
Id at p. 10. ↩
Id. at p.8. ↩
DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Annex A, at Item G.5, TFH letter dated 19 May 2025. ↩
See Transcription, Clarificatory Hearing CID CDO No. 25-001, Adju-25-00178, 23 May 2025. ↩
Minute Resolution dated 23 May 2025, CID CDO 25-001. ↩
Id. ↩
TFH Response Letter dated 08 June 2025 in compliance to Minute Resolution dated 23 May 2025. ↩
Id. ↩
See email from NM dated 30 June 2025 at 12:43 pm. ↩
See email from NM dated 30 June 2025 at 6:23 pm. ↩
Minute Resolution dated 08 May 2025, CID CDO 25-001. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
Minute Resolution dated 04 August 2025, CID CDO No. 25-001. ↩
CID Comment, 18 August 2025. ↩
Id. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 7 (c), Chapter II (2012). ↩
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, Section 9 (f)(3), Rule III (2012). ↩
NPC Circular No. 20-02, Rules on the issuance of Cease and Desist Orders, dated 06 October 2020. ↩
Minute Resolution issued by the Commission dated 08 May 2025. ↩
Letter dated 19 May 2025 from Tools for Humanity. ↩
Id. ↩
Id. ↩
National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission, As Amended [2021 NPC Rules of Procedure], Section 9, Rule IV (28 January 2021). ↩
An Act Providing for the Revised Corporation Code of the Philippines, [Revised Corp. Code of the Philippines], Republic Act No. 11232, Section 22. ↩
Rules of Procedure, A.M. No. 19-10-20-SC, Section 4, Rule 7. ↩
Letter dated 19 May 2025 from Tools for Humanity. ↩
See email dated 30 June 2025 from NM ↩
Minute Resolution issued by the Commission dated 03 July 2025. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
See email from NM dated 30 June 2025 at 12:43 pm. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
NPC Circular No. 20-02, Rules on the issuance of Cease and Desist Orders, dated 06 October 2020, Section 23. ↩
Section 4, Rule 7 of A.M. No. 19-10-20-SC or the Rules of Court. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
NPC Circular No. 20-02, Rules on the issuance of Cease and Desist Orders, dated 06 October 2020, Section 23. ↩
Section 6, Rule 10, A.M. No. 19-10-20-SC or the Rules of Court. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
NPC Circular No. 20-02, Rules on the issuance of Cease and Desist Orders, dated 06 October 2020, Section 4. ↩
TFH Letter Response dated 19 May 2025, at p. 2, in CID CDO 25-001 (NPC 2025). ↩
Id. at p. 3. ↩
Id. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 3 (b), Chapter I (2012). ↩
See TFH Privacy Notice and World Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025. ↩
Form ng pahintulot ng biometric data ng World Foundation, Exhibit F, Compliance of TFH the NPC Minute Resolution dated 23 May 2025. ↩
NPC Circular No. 2023-04, Guidelines on Consent dated 07 November 2023, Section 3. ↩
Id. at Section 3 (D.4). ↩
Id. ↩
Id. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 3 (b), Chapter I (2012). ↩
NPC Circular 2023-04, Guidelines on Consent dated 07 November 2023, Section 8. ↩
Id. at Section 3 (D)(3)(4). ↩
Id. ↩
In re: FLI, NPC 19-910 (NPC 2020) citing Advisory Opinion 2018-013, dated 18 April 2018. ↩
Letter dated 19 May 2025 from Tools for Humanity. ↩
See P. 5, 7 of Annex C-1, Sinumpaang Salaysay, P. 6, 7 Annex C-2, Sinumpaang Salaysay, P. 7, 8, 10 Annex C-4, Sinumpaang Salaysay, P. 6, 9 Annex C-8, Sinumpaang Salaysay, of the Comment submitted by CID dated 18 August 2025, in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
23 May 2025 Clarificatory Hearing Transcript, p. 17. ↩
TFH Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025. ↩
Id at Section 7. ↩
Id. ↩
Id. at Section 7 (A). ↩
”Sinumpaang Salaysay” executed by AB dated 08 August 2025. ↩
Id. ↩
Technical Report, Annexed E-3 of the CID Comment dated 18 August 2025. ↩
Id. ↩
Id. ↩
Id. ↩
Joint-Affidavit of Investigation dated 13 August 2025, Annex D-1 of the CID Comment dated 18 August 2025. ↩
Id. ↩
Id. ↩
23 May 2025 Clarificatory Hearing. ↩
Id. ↩
Clarificatory Hearing on 23 May 2025 Transcript, p. 56-57. ↩
Id. ↩
Id. ↩
TFH Letter Response dated 08 June 2025 to Minute Resolution dated 23 May 2025, p. 2-3. ↩
Id. ↩
Exhibit I of the TFH Letter Response dated 08 June 2025 to Minute Resolution dated 23 May 2025. ↩
Id. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025, p. 4. ↩
”Sinumpaang Salaysay” executed by JS, dated 01 August 2025, marked as Annex C-7. ↩
NPC Circular No. 2023-04, Guidelines on Consent dated 07 November 2023, Section 9-10. ↩
Letter dated 19 May 2025 from Tools for Humanity, at p.3-4. ↩
Id. ↩
See DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, at Item G.1, Compliance to the Minute Resolution dated 23 May 2025. ↩
TFH Privacy Notice marked as Exhibit E and K, Compliance of TFH on the NPC Minute Resolution dated 03 July 2025. ↩
See DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, p. 4, 6, Compliance to the Minute Resolution dated 23 May 2025. ↩
Form ng pahintulot ng biometric data ng World Foundation, Exhibit F, Compliance of TFH the NPC Minute Resolution dated 23 May 2025, p. 8. ↩
See P. 5, 7 Annex C-1, Sinumpaang Salaysay, P. 6, 7 Annex C-2, Sinumpaang Salaysay, P. 7, 8, 10 Annex C-4, Sinumpaang Salaysay, P. 6, 9 Annex C-8, Sinumpaang Salaysay, of the Comment submitted by CID dated 18 August 2025, in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See Annex C-1(4)(5)(7), Annex C-2(4)(6)(7)(8)(9)(11), Annex C-3(4)(5)(6)(8)(9), Annex C- 4(5)(7)(8)(9)(10)(11), Annex C-5(4)(6)(7)(9)(10), Annex C-6(7)(8)(9), Annex C-7(4)(6)(7)(8)(9)(13), Annex C-8(3)(6)(7)(9), Annex D-1(17), Annex D-2(17), Annex D-3(17) of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See Annex D-1, p. 2 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
TFH Privacy Notice marked as Exhibit E and K, Compliance of TFH on the NPC Minute Resolution dated 03 July 2025. ↩
See Annex D-1, p.3, par 19 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Id. ↩
Annex C-1 (4)(5)(7), Annex C-2(4)(6)(7)(8)(9)(11), Annex C-3(4)(5)(6)(8)(9), Annex C-4(5)(7)(8)(9)(10)(11), Annex C-5(4)(6)(7)(9)(10), Annex C-6(7)(8)(9), Annex C-7(4)(6)(7)(8)(9)(13), Annex C-8(3)(6)(7)(9), Annex D-1(17), Annex D-2(17), Annex D-3(17) of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See P. 5, 7 Annex C-1, Sinumpaang Salaysay, P. 6, 7, Annex C-2, Sinumpaang Salaysay, P. 7, 8, 10 Annex C-4, Sinumpaang Salaysay, P. 6, 9, Annex C-8, Sinumpaang Salaysay of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See P. 5, 7, Annex C-1, Sinumpaang Salaysay, of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Id. at para. 3. ↩
Id. ↩
See DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, at Item G.1, Compliance to the Minute Resolution dated 23 May 2025, p. 4. ↩
Data Privacy Act of 2012, Section 3(l). ↩
Data Privacy Act of 2012, Section 3(j). ↩
TFH Letter dated 19 May 2025, p. 7, Compliance to Minute Resolution dated 08 May 2025. ↩
Annex E, E-1 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Annex D (4) of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Clarificatory Hearing on 23 May 2025 Transcript. ↩
TFH Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025. ↩
Clarificatory Hearing on 23 May 2025 Transcript at 17-18. ↩
TFH Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025 at 1. ↩
Clarificatory Hearing on 23 May 2025 Transcript at 17-18. ↩
Data Privacy Act of 2012, Section 3(j). ↩
Id. ↩
TFH Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025. ↩
Annex E-1 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 11 (a) Chapter III (2012). ↩
Rules and Regulations Implementing the Data Privacy Act of 2012, Rule IV, Section 18 (a). ↩
Id. ↩
Id. ↩
Id. ↩
In Re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, dated 16 May 2022, at p. 34, available at https://privacy.gov.ph/wp- content/uploads/2024/05/NPC-SS-21-006-2022.05.16-In-re-Wefund-Lending-Corporation- Decision-FinalP.pdf (last accessed 06 September 2025). ↩
TFH Privacy Notice marked as Exhibit E, Compliance of TFH to the Minute Resolution dated 23 May 2025. ↩
World Privacy Notice marked as Exhibit E, Compliance of TFH to the Minute Resolution dated 23 May 2025. ↩
TFH Privacy Notice marked as Exhibit E, Item 5.2, Compliance of TFH to the Minute Resolution dated 23 May 2025. ↩
World Privacy Notice marked as Exhibit E, p. 9/27, Compliance of TFH to the Minute Resolution dated 23 May 2025. ↩
Form ng pahintulot ng biometric data ng World Foundation, Exhibit F, Compliance of TFH the NPC Minute Resolution dated 23 May 2025. ↩
Id. ↩
Id. ↩
Form ng pahintulot ng biometric data ng World Foundation, Exhibit F, Item 1.4, p. 5/29, Compliance of TFH to the NPC Minute Resolution dated 23 May 2025. ↩
Id. at Item 9, p.18/29. ↩
DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, at Item F.8, Compliance to the Minute Resolution dated 23 May 2025. ↩
Id at Item B.4. ↩
Annex E, E-1 of the Comment submitted by CID in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Annex D of the Comment submitted by CID in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Annex E of the Comment submitted by CID in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Annex C-1, C-2, C-3, C-4, C-5, C-6, C-7, C-8 of the Comment submitted by CID in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Clarificatory Hearing on 23 May 2025 Transcript. ↩
Id at p. 10-11 ↩
Id. ↩
Id. ↩
Id. ↩
TFH Letter Response dated 08 June 2025 to Minute Resolution dated 23 May 2025. ↩
Id at Item 1. ↩
TFH DPIA Annexed to Letter dated 19 May 2025. ↩
DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, Compliance to the Minute Resolution dated 23 May 2025. ↩
CID Comment, p.17, 18 August 2025. ↩
Id. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩
Id at p. 19. ↩
Id. ↩
WorldCoin Private by Design, Annex M of TFH Letter Response dated 08 June 2025 to Minute Resolution dated 23 May 2025. ↩
Id at p. 8. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 21 (h), Chapter VI (2012). ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 3 (h), Chapter I (2012). ↩
Id at Section 3 (i). ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 11 (c) (d) Chapter III (2012). ↩
Rules and Regulations Implementing the Data Privacy Act of 2012, Rule IV, Section 18 (b) (c). ↩
DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, Compliance to the Minute Resolution dated 23 May 2025. ↩
Id. ↩
Id. ↩
Id. at Item G.1. ↩
Id. ↩
Id. ↩
Application for the Issuance of the Cease and Desist Order dated 07 May 2025. ↩
Id. ↩
Application for the Issuance of the Cease and Desist Order dated 07 May 2025, p. 10. ↩
TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025, p. 15. ↩
Id. ↩
Comment submitted by CID dated 18 August 2025, p.40, in Compliance to Commission’s Minute Resolution dated 04 August 2025. ↩
DPIA of TFH on the “Orb Processing” in the Context of the verification of a Proof of Personhood, Exhibit A, at Item G.1, Compliance to the Minute Resolution dated 23 May 2025. ↩
Technical Report, Annex E-3, Compliance to the Minute Resolution dated 04 August 2025. ↩
Id. ↩
See Annex C-5(3), Annex D(6), Annex D-2(24), Annex E-3) of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Clarificatory Hearing Transcript dated 23 May 2025, page 56. ↩
TFH Privacy Notice marked as Exhibit E, Item 4, Compliance of TFH to the Minute Resolution dated 23 May 2025. ↩
Annex A of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
Id at Annex B. ↩
Clarificatory Hearing Transcript 23 May 2025, p. 56. ↩
Id. ↩
TFH Letter Response dated 08 June 2025 to Minute Resolution dated 23 May 2025, Item 12 & 13. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 16, Chapter IV (2012). ↩
TFH Privacy Notice, Annex E in the Compliance to Minute Resolution dated 23 May 2025. ↩
Form ng pahintulot ng biometric data ng World Foundation, Annex F in the Compliance to Minute Resolution dated 23 May 2025. ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 16, Chapter IV (2012). ↩
Id. ↩
TFH Privacy Notice, Annex E in the Compliance to Minute Resolution dated 23 May 2025. ↩
Form ng pahintulot ng biometric data ng World Foundation, Annex F in the Compliance to Minute Resolution dated 23 May 2025. ↩
CID Comment (To the 19 May 2020, 8 June 2025, and 18 July 2025 Submissions and all the declarations made by Tools for Humanity during the clarificatory Hearing and Onsite Visit Conferences) dated 18 August 2025, Annex C Series. ↩
See Annex C-1, par. 5; Annex C-2, par. 7; Annex C-3, par. 6; Annex C-4 par. 10; Annex C-5, par. 7 and 9; Annex C-6, par. 8; Annex C-8, par. 9 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See Annex C-4, par. 11 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See Annex 1, par. 7; Annex C-2 par. 6; Annex C-3, par. 8; Annex C-4, par. 7 and 8; Annex C-5, par. 6; Annex C-6, par. 7; Annex C-7, par. 8; Annex C-8, par. 6 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See Annex C-2, par. 10 and 11; Annex C-5, par. 10 and 11; Annex C-6, par.9; Annex C-7, par. 13; Annex C-8, par. 7 and 10 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
See Annex C-1, par. 7; Annex C-2, par. 8; Annex C-3, par. 9; Annex C-4, par. 9; Annex C-5, par. 4; Annex C-7, par. 6; Annex C-7, par. 9; Annex C-8, par. 7 of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
TFH Letter Response dated 08 June 2025 to Minute Resolution dated 23 May 2025, p. 4. ↩
Joint Affidavit of Investigation by L, V, and P.; Affidavit of Investigation by R; and Affidavit of Investigation by H; Annex D of the Comment submitted by CID dated 18 August 2025 in compliance with the Minute Resolution issued by the Commission dated 04 August 2025. ↩
TFH Privacy Notice, par. 14, Annex E in the Compliance to Minute Resolution dated 23 May 2025. ↩
Form ng pahintulot ng biometric data ng World Foundation, Annex F in the Compliance to Minute Resolution dated 23 May 2025. ↩
TFH Biometric Consent form, at p. 18. ↩
Clarificatory Hearing dated 23 May 2025 Transcript, p. 67. ↩
TFH Biometric Consent form, at p. 16. ↩
2025 Worldcoin Orb Security Audit, Exhibit M of the Compliance to the Minute Resolution dated 23 May 2025. ↩
Id. ↩
TFH Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025. ↩
Id. ↩
Biometric Consent Form, Exhibit F, Compliance to the Minute Resolution dated 23 May 2025. ↩
TFH Privacy Notice, Exhibit E, Compliance to the Minute Resolution dated 23 May 2025. ↩
NPC Circular No. 2023-04, Guidelines on Consent dated 07 November 2025 ,Section 13. ↩
Clarificatory Hearing dated 23 May 2025 Transcript, p. 20-21; TFH Letter dated 08 June 2025, par. 7, stating that TFH “team is not aware of any recorded instance” of retention of personal data beyond twelve (12) seconds. ↩
See Annex G, at p. 48, Comment submitted by CID dated 18 August 2025. ↩
Comment submitted by CID dated 18 August 2025, p.26, in Compliance to Commission’s Minute Resolution dated 04 August 2025. ↩
Id. ↩
NPC Circular No. 20-02, Rules on the issuance of Cease and Desist Orders, dated 06 October 2020. ↩
Clarificatory Hearing on 23 May 2025. ↩
TFH Updates to Response dated 08 June 2025, par. 8. ↩
Letter dated 19 May 2025 signed by TFH in relation to CID CDO No. 25-001. ↩
Comment submitted by CID dated 18 August 2025, p.48, in Compliance to Commission’s Minute Resolution dated 04 August 2025. ↩

NPC Issuance Wiki

Corpus

CID CDO 25-001: In the Matter of World App Processing of Personal Information

Order Text

FACTS

DISCUSSION

Procedural rules serve a purpose

Substantive grounds for the issuance of a CDO

I.C.1. Failure to provide all relevant information to data subjects

I.C.2. Misrepresentation that no sensitive data is processed by World App and that no data is stored in the World App

II. Violation of the Data Privacy Principles of Transparency, Proportionality, and Legitimate Purpose

Transparency

II.A.1. Privacy notices employed technical and ambiguous language

II.A.3. DPIAs submitted do not reflect the true nature of TFH’s processing

II.A.4. TFH remains to be the sole controller of the Biometric Data

II.B. On Proportionality and Legitimate Purpose

III. Violation of Data Subject Rights

III.A. On the violation of the right to be informed

III.B. On the violation of the right to access

Second requirement: That such act or practice is either detrimental to national security or public interest, or that the order is necessary to safeguard the rights of a data subject

I. Necessary to safeguard the rights of data subjects

II. Detrimental to public interest

Third requirement: Unless restrained, the continuance of such act or practice will result in grave and irreparable injury to a data subject

Footnotes

Table of Contents

Backlinks

NPC Issuance Wiki

Corpus

CID CDO 25-001: In the Matter of World App Processing of Personal Information

Order Text

FACTS

DISCUSSION

Procedural rules serve a purpose

Substantive grounds for the issuance of a CDO

First requirement: TFH is engaged in, or is about to engage in, an act or practice violative of the DPA, its IRR, or related issuances

I. Just in time consent obtained from data subjects did not comply with the requirements of the law

I.A. Consent must be specific

I.B. Consent must be freely given

I.C. Consent must be an informed indication of will

I.C.1. Failure to provide all relevant information to data subjects

I.C.2. Misrepresentation that no sensitive data is processed by World App and that no data is stored in the World App

II. Violation of the Data Privacy Principles of Transparency, Proportionality, and Legitimate Purpose

Transparency

II.A.1. Privacy notices employed technical and ambiguous language

II.A.2. Biometric consent form not in compliance with requirements of the DPA, its IRR, and related issuances

II.A.3. DPIAs submitted do not reflect the true nature of TFH’s processing

II.A.4. TFH remains to be the sole controller of the Biometric Data

II.B. On Proportionality and Legitimate Purpose

III. Violation of Data Subject Rights

III.A. On the violation of the right to be informed

III.B. On the violation of the right to access

III.C. On the violation of the right to withdraw consent and right to erasure

Second requirement: That such act or practice is either detrimental to national security or public interest, or that the order is necessary to safeguard the rights of a data subject

I. Necessary to safeguard the rights of data subjects

II. Detrimental to public interest

Third requirement: Unless restrained, the continuance of such act or practice will result in grave and irreparable injury to a data subject

Footnotes

Footnotes

Table of Contents

Backlinks