The National Privacy Commission (NPC) has ordered Tools for Humanity (TFH), the company behind the World App and Orb verification system, to immediately halt the collection and processing of personal and biometric data in the Philippines after finding multiple violations of the Data Privacy Act of 2012 (DPA).
Following an investigation, the NPC issued a cease-and-desist order (CDO) to stop all activities related to the World App, Orb verification and associated systems, including the use of iris scans for identity verification.
The NPC said it found that TFH’s data practices breached the General Data Privacy Principles and infringed on the rights of data subjects under the DPA.
Among the violations cited were invalid consent, lack of transparency, excessive collection of biometric data and the risk of grave and irreparable injury to data subjects. The NPC noted that TFH’s practice of offering monetary incentives in exchange for iris scans amounted to “undue influence,” rendering any consent obtained as invalid under the DPA.
“When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice,” said NPC deputy commissioner Jose Amelito Belarmino II.
“The CDO sends a clear message that the NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives,” it said.
The agency also said that TFH failed to provide clear and accessible information about the purpose, scope, and duration of its data processing activities, and that its collection of immutable biometric identifiers such as iris patterns was excessive and unnecessary for the company’s stated goal of “proof of humanity.”
“The integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and permanent identifier,” Belarmino said.
The NPC warned that continued processing of such data could expose Filipinos to identity theft, fraud, and reputational harm, noting that unauthorized processing of biometric data is irreversible.
TFH’s operations have also faced privacy-related suspensions in other jurisdictions, including Kenya and Hong Kong. Despite these challenges, the NPC said the company failed to exercise due diligence in ensuring compliance with Philippine data protection laws before launching locally.
The NPC said that while it supports innovation, all technologies handling personal data should operate within lawful, fair and transparent boundaries. The commission reminded the public to remain vigilant and informed before providing sensitive personal data such as facial or iris scans.
