Βy Jaspreet Singh and Niket Nishant 

MADRID (Reuters) – Spain has banned Worldcoin for up to three months, drawing a sharp rebuke from Sam Altman‘s company, amid perceived privacy risks from the venture which scans irises in exchange for a digital ID and free cryptocurrency.

Spanish data protection regulator AEPD said on Wednesday it demanded Worldcoin immediately cease the collection of personal information and stop using data it has already gathered.

Worldcoin said in response to the ban that the AEPD was “circumventing EU law” and “spreading inaccurate and misleading claims about our technology”.

The AEPD said its action came after several complaints regarding insufficient information, the collection of data from minors or not allowing for the withdrawal of consent.

More than 4 million people in 120 countries have signed up to have their irises scanned by Worldcoin’s “orb” devices, according to its website. But the project has drawn criticism from privacy campaigners from Argentina to Germany over the collection, storage and use of personal data.

Worldcoin’s Data Protection Officer Jannick Preiwisch said in a statement that efforts to engage with AEPD had gone unanswered for months,

“We are grateful to now have the opportunity to help them better understand the important facts regarding this essential and lawful technology,” Preiwisch said.

The Spanish regulator said the processing of biometric data, which has special protection under the European Union’s General Data Protection Regulation (GDPR), “entails high risks for people’s rights, taking into account their sensitive nature”.

It said that urgent measures temporarily prohibiting Worldcoin’s activities were justified “in order to avoid potentially irreparable damage”, adding that not acting would deprive people of the protection to which they are entitled.

Preiwisch said Worldcoin has been in communication for months with the state data agency in Bavaria, where its owner Tools for Humanity has a German subsidiary.

As the lead authority in the EU investigating Worldcoin, Bavaria was analysing documents and carrying out onsite checks for an investigation begun in November 2022.

Its president Michael Will told Reuters that this “should allow us to present the procedure to our European colleagues very soon with a final evaluation”.

Portugal’s data authority said it was liaising with its counterpart in Bavaria while it analysed whether Worldcoin’s data processing complied with GDPR and said it was speaking with companies involved in the project.

A spokesperson for the UK Information Commissioner’s Office said organisations must conduct a so-called Data Protection Impact Assessment (DPIA) before starting to process data.

They “need to have a clear lawful basis to process personal data. Where they are relying on consent, this needs to be freely given and capable of being withdrawn without detriment,” the spokesperson said, adding that the ICO’s inquiries were ongoing.

Altman says Worldcoin’s ID will allow users to, among other things, prove online that they are human, notably in a future world dominated by artificial intelligence.

Worldcoin is backed by some of the most prominent venture capital names, including a16z crypto and Bain Capital Crypto.