The National Privacy Commission (NPC) has ordered Tools for Humanity (TFH), the company behind the World App and its Orb biometric verification system, to immediately stop collecting and processing personal and biometric data in the Philippines for allegedly violating the Data Privacy Act of 2012 (DPA).
In a Cease-and-Desist Order (CDO) issued upon the recommendation of the NPC’s Complaints and Investigation Division, the commission cited multiple breaches of the law’s general privacy principles and data subject rights.
According to the NPC, TFH’s data-gathering practices under its “proof of humanity” project were found to be coercive, opaque, and disproportionate to their stated purpose.
Invalid consent through undue influence
The commission ruled that TFH’s practice of offering monetary incentives in exchange for undergoing Orb verification — which involves iris scanning — constituted “undue influence.”
The agency said such compensation compromised the voluntariness of consent, making it invalid under the DPA and NPC guidelines.
Lack of transparency and excessive data collection
Investigators also found that TFH failed to provide sufficient information about how personal data was collected, processed, and stored, including the absence of a clear privacy policy. The commission said this violated the right of data subjects to be informed.
Furthermore, the collection of biometric data such as iris scans was deemed “excessive and disproportionate” for TFH’s stated goal of verifying humanity or identity.
Risk of grave and irreparable harm
The NPC warned that the continued processing of such immutable data could expose Filipino users to “serious risks of identity fraud, theft, and lasting reputational damage.”
“The integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and immutable identifier,” said NPC deputy privacy commissioner Jose Amelito S. Belarmino II.
“When consent is compromised by the lure of compensation, it ceases to be a true expression of choice. This order is a clear signal that the NPC will not permit practices that exploit socioeconomic vulnerability or compromise fundamental data privacy rights.”
