As countries such as France, Germany and the United Kingdom investigate Worldcoin, which uses eye recognition (iris scan) to verify users' identities, we'd like to inform you about the issues that need to be addressed when processing biometric data.

Biometric data is defined in the European Union General Data Protection Regulation ("GDPR") as " personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data". Both The Personal Data Protection Law (“KVKK”) and the GDPR recognize biometric data as sensitive data. In order for sensitive data to be processed in accordance with the law, a number of special conditions are set out in both regulations. However, compliance with these conditions, which are stricter than those required for the processing of general data, does not in itself make the data processing activity lawful. Another important point to consider at this point is that the data processing activity should not violate the principle of proportionality. In particular, when processing biometric data, the use of biometric data when the purpose of the processing in question can be achieved by less intrusive means will violate the principle of proportionality. Accordingly, methods such as facial recognition, eye scanning, fingerprint or hand/palm scanning should be used if the purpose of the data processing cannot be achieved by other methods. However, it is important to consider the proportionality and necessity of the method used in each concrete case.

In the light of the foregoing, if the investigations launched by the data protection authorities of France, Germany and the United Kingdom are concluded, the evaluations and decisions of these institutions will be followed and will be shared with you.