NPC issues cease and desist order to World, after DICT shows interest in collaborating with it

• Photo from World

By San Matildo

The National Privacy Commission (NPC) has issued a Cease and Desist Order (CDO) against Tools for Humanity (TFH), the company behind the World App and Orb verification system, after finding multiple violations of the Data Privacy Act of 2012 (DPA) and its implementing rules.

The order directs TFH to immediately stop collecting and processing personal data, including sensitive biometric information such as iris scans, from individuals in the Philippines. The NPC said the company’s data processing practices failed to follow core principles of transparency, proportionality, and lawful consent under the DPA.

According to the Commission, TFH’s offer of monetary incentives in exchange for biometric information constituted undue influence, rendering the consent obtained from participants invalid.

It also found that TFH failed to adequately inform users about the purpose, scope, and duration of its data collection, violating the principle of transparency and the right of data subjects to be informed.

Moreover, the NPC determined that the collection of immutable biometric identifiers, such as iris patterns, was excessive and unnecessary for TFH’s stated goal of proving “humanness.”

The Commission warned that the continued processing of such data exposed Filipinos to serious and irreversible risks, including identity theft, fraud, and reputational harm.

It also noted that TFH’s operations had already been halted in other jurisdictions, including Kenya and Hong Kong, for similar privacy concerns, but the company still failed to exercise due diligence before launching in the Philippines.

“The integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and permanent identifier,” said Deputy Privacy Commissioner Jose Amelito S. Belarmino II.

“When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice. This Cease and Desist Order sends a clear message that the NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives,” he added.

The NPC reiterated that data privacy is a fundamental right and that innovations involving personal data, including biometric information, must operate within the bounds of lawful, fair, and transparent processing. “The promise of technology must never come at the expense of human dignity and data protection,” the Commission said.

The agency reaffirmed its commitment to uphold the rights of data subjects, enforce the DPA, and ensure accountability among personal information controllers and processors in the country. It also reminded the public to remain cautious when providing sensitive information such as facial or iris scans and to understand how their data will be used and safeguarded before giving consent.

Under Section 7 of the DPA, the NPC is empowered to issue cease and desist orders to prevent violations of privacy laws. The full decision, “In the Matter of World App Processing of Personal Information,” is available on the NPC website at privacy.gov.ph .

On October 7, just a day before the NPC’s announcement, the Department of Information and Communications Technology (DICT) expressed interest in collaborating with World.

“We’re collaborating with the Cybercrime Investigation and Coordinating Center (CICC), and we’ll be signing an MOU. We’re encouraging banks to use it—and not just them, there are many others as well,” said DICT Secretary Henry Aguda during a Malacañang press briefing on Tuesday. “That’s just one example. We’ll also be using AI technology to help address online scams,” he added.

Aguda made the statement when asked about the government’s initiatives to strengthen online security, particularly as digital activity is expected to surge during the Christmas season.

According to World’s website, World ID serves as an anonymous “proof of human” for the age of AI, allowing users to securely and anonymously verify that they are real and unique individuals online.

Verification takes place through an Orb—a device that scans a user’s retina to confirm identity.

Once verified, the user’s “World ID” is stored on their phone via the World App, enabling them to log in to supported online services. The system ensures privacy by encrypting personal data, transmitting it only to the user’s phone, and permanently deleting it from the Orb.