The Personal Data Protection Committee (PDPC), the Thai data privacy regulator, issued a decisive administrative order today (November 24) regarding the "Iris Scan for Crypto" business. The PDPC determined that World Thailand's operations did not comply with the principles of the Personal Data Protection Act B.E. 2562 (PDPA).
Image source: Personal Data Protection Committee Office – PCSO
🛑 Non-Freely Given Consent and Usage Beyond Stated Purpose
The PDPC explained that the core issue was the provider's method of incentivizing the public with crypto tokens in exchange for consent to collect iris data. This practice constitutes consent that was "not freely given" as required by law.
Furthermore, the stated purpose during the consent process was solely to verify "humanness." However, the investigation found that individuals who had scanned their irises previously could not scan again, indicating that the true objective was to verify the individual's identity for future reference. Thus, the data usage exceeded the scope of the original consent.
📝 Administrative Order: Suspend and Delete 1.2 Million Records
Following a thorough review of evidence and explanations from the service provider, the PDPC issued the following key administrative orders:
Immediate Suspension: The service provider and associated parties must immediately "suspend" or "cease" the collection of personal data through iris scanning for crypto rewards and report the results to the PDPC within 7 days.
Total Data Deletion: The provider and associated parties must delete and destroy all iris data and related personal data belonging to the 1.2 million individuals to prevent the unlawful transfer of personal data abroad.
🔎 Investigation Expands to Other Laws: SEC and DSI Involved
In addition to the PDPA issues, joint investigations with relevant authorities revealed other suspicious activities, such as organized schemes to pay people to scan their irises for crypto which was then used by other parties.
The Securities and Exchange Commission (SEC) and Cyber Police have already detected and arrested several individuals engaged in unauthorized digital currency exchange. This raises suspicion of potential violations of other laws. The Department of Special Investigation (DSI) and other relevant agencies will further investigate and expand on this matter.
🌍 World Thailand Responds: Negative Impact on Millions of Thais
Tools for Humanity Ltd., or World Thailand, issued a press release clarifying that the company has temporarily suspended its human verification process in Thailand. The company stated that the order is effective even though it believes it has fully complied with all Thai laws and regulations and maintained full transparency with regulators.
The company expressed concern that the suspension will have a negative impact on millions of Thais who chose to use the technology to protect themselves against scams, identity theft, and AI-driven fraud. World Thailand affirmed its commitment to creating a safer digital environment and will continue close discussions with the MDES and PDPC to determine an appropriate and sustainable path forward.
