The National Privacy Commission (NPC) of the Philippines has ordered Tools for Humanity (TFH), the company behind World App and the Orb verification system, to stop all personal data processing operations in the Philippines after finding violations of the Data Privacy Act of 2012 (DPA) and its implementing rules.
In a Cease and Desist Order (CDO) issued on October 8, the NPC directed TFH to “immediately stop all personal data processing activities related to the World App, Orb verification, and all associated systems and platforms in the Philippines, including the collection and processing of biometric data such as iris scans.”
The order followed an investigation by the NPC’s Complaints and Investigation Division, which found that TFH’s practices “did not adhere with the General Data Privacy Principles and violated the Rights of Data Subjects under the DPA.”
Invalid consent and undue influence
In its decision, the NPC stated that TFH obtained invalid consent from individuals who were offered cash incentives for their iris scans. Offering money in exchange for biometric data, the NPC said, “constituted undue influence,” making consent “not freely given, and therefore invalid” under the DPA.
“When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice,” Jose Amelito Belarmino II, NPC’s Deputy Privacy Commissioner, said in a statement. “This Cease and Desist Order sends a clear message that the NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives.”
The Commission said TFH’s model of providing financial rewards and referrals in exchange for iris scans breached the law’s requirement for voluntary and informed consent.
Back to the top ↑
Lack of transparency and excessive data collection
The NPC found that TFH “failed to adequately inform data subjects of the purpose, scope, extent, and duration of data processing” in its privacy notice. It said this violated the principle of transparency and the right to be informed.
It also ruled that the collection of immutable biometric identifiers, such as iris patterns, was “excessive and not necessary” for TFH’s stated goal of providing “proof of humanity.” The Commission said continued collection “exposes Filipino data subjects to serious and lifelong risks, including identity theft, fraud, and reputational harm.”
According to the NPC, “the nature of biometric data makes any unauthorized processing irreversible and enduring.”
The agency also cited privacy-related halts to TFH’s operations in Kenya and Hong Kong. “TFH, despite the challenges faced in various jurisdictions, failed to exercise due diligence in complying with the DPA,” it said.
Back to the top ↑
NPC: Biometric integrity is non-negotiable
Belarmino emphasized that protecting Filipinos’ biometric information is central to the NPC’s mandate. “The integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and permanent identifier,” he said.
The NPC said that while it supports technological innovation, it “remains steadfast in its mission to uphold the rights of data subjects, enforce the DPA, and ensure accountability among all personal information controllers and processors operating in the Philippines.”
“The promise of technology must never come at the expense of human dignity and data protection,” it added.
Guidance for the public
The NPC reminded Filipinos to stay cautious when asked for biometric information. Before giving consent, individuals should know “who is collecting their data, how it will be used, and whether proper safeguards are in place.”
The agency reiterated that its power to issue a Cease and Desist Order is granted under Section 7 of the DPA and reinforced by Section 9 of its Implementing Rules and NPC Circular 2020-02.
Back to the top ↑
DICT interest and sector response
The NPC’s move came as the Department of Information and Communications Technology (DICT) expressed interest in exploring iris-scan technology for banking and government systems.
On the same day, Belarmino announced the CDO local media ABS-CBN reported that DICT Secretary Henry Aguda stated that the technology could help ensure that beneficiaries of government aid are verified through biometrics.
However, two local IT organizations, namely the National Association of Data Protection Officers of the Philippines (NADPOP) and the Philippine Computer Emergency Response Team (PH-CERT), have expressed support for the NPC’s decision.
Tools for Humanity’s statement
Tools for Humanity responded in a blog post, saying it had “complied with all applicable laws in the Philippines, worked with regulators and formally registered with the National Privacy Commission.”
The company said Filipinos have already secured their anonymous, proof-of-human-verification, or World ID. TFH stated that Orb devices do not store biometric data. It said that when a person’s eyes are scanned, the images are processed and sent only to the user’s smartphone, while photos are deleted after verification, leaving only a cryptographic proof. The company asserted that it does not buy or sell user data and that people can use its network without undergoing iris scanning.
Global scrutiny over iris-scan systems
Worldcoin, co-founded by Sam Altman, Alex Blania, and Max Novendstern in 2019, has faced privacy investigations in several countries. It has been banned in Kenya, Spain, Germany, and Hong Kong, while India, South Korea, and Colombia have issued warnings.
Earlier this year, the NPC had already cautioned Filipinos against submitting to iris scans, warning of risks associated with storing biometric data. Biometric identifiers are unique and permanent, unlike passwords that can be reset. If compromised, they could be used for identity theft, surveillance, or impersonation.
With the new CDO, the Philippines joins countries taking a firmer stance against the collection of biometric data without clear safeguards. “Data privacy is a fundamental right, and that innovations involving personal data such as biometric data, must operate within the bounds of lawful, fair, and transparent processing,” the NPC said.
Back to the top ↑
Watch: Philippine ingenuity sparks green innovation at Shell LiveWire 2025
title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen=””>
Source: https://coingeek.com/philippines-orders-tools-for-humanity-to-halt-data-processing/