NPC Reasserts Role as Data Privacy Regulator in World/Tools For Humanity Dispute

Disclaimer: This article is for informational purposes only and does not constitute financial advice. BitPinas has no commercial relationship with any mentioned entity unless otherwise stated.

📬 Get the biggest crypto stories in the Philippines and Southeast Asia every week — subscribe to the BitPinas Newsletter.

Amid a growing policy rift over World/Tools For Humanity’s iris scanning operations in the Philippines, the National Privacy Commission (NPC) has clarified that registration with the agency does not amount to an endorsement or legal clearance of a company’s data processing activities.

NPC Reasserts Authority

In a statement issued on October 13, 2025, the NPC reaffirmed its authority as the country’s independent data protection body, explaining that registration is only one of several compliance obligations under the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations.

The process, the agency said, serves to enhance transparency and oversight but does not relieve entities of their duty to ensure lawful and fair data processing.

“Entities remain responsible for ensuring lawful processing, upholding the rights of data subjects, and implementing appropriate organizational, physical, and technical safeguards.” 

National Privacy Commission

Additionally, the NPC clarified that its official position on data privacy issues is expressed only through formal issuances, such as decisions or orders, approved by the Commission en banc after proper deliberation. Statements made outside these formal issuances, it said, should not be interpreted as the agency’s official stance.

Policy Clash?

Advertisement

Moreover, the regulatory body also asserted its exclusive jurisdiction under the DPA, stating that it is the sole government authority empowered to determine the legality of personal data processing activities. 

While the NPC collaborates with other agencies on matters of shared concern, it stressed that its authority over data privacy matters remains “exclusive and independent.”

Recently, a policy rift surfaced within the Department of Information and Communications Technology (DICT) after Secretary Henry Aguda publicly endorsed cooperation with Worldcoin’s iris-scanning technology, contradicting the CDO issued by the NPC, an attached agency of the DICT, against the project’s operators for alleged violations of the DPA.

During a Malacañang press briefing on October 7, Aguda described the system as a “unique solution” for identity verification in banking and government programs. The secretary added that the DICT is coordinating with the Cybercrime Investigation and Coordinating Center to sign a memorandum of understanding related to the technology and is exploring its potential for verifying beneficiaries in government aid programs.

However, the endorsement came just days before the NPC ordered Tools for Humanity, which is also the developer of the Orb iris scanner, to stop processing the biometric and personal data of Filipinos.

Why Were the Operations Halted?

In a 66-page CDO dated September 23, 2025, the NPC ordered Tools for Humanity to stop all data processing operations in the Philippines.

The NPC concluded that the developer’s iris-scanning project, conducted through its device called “Orb,” failed to secure informed consent, collected excessive biometric data, and lacked sufficient safeguards for data protection.

The practice of offering cryptocurrency incentives, which in this case is WLD, in exchange for iris scans created “undue” financial pressure, compromising the voluntariness of user consent. It also ruled that Tools for Humanity’s 29-page privacy notice, shown just before scanning, made the process insufficiently informed.

The agency added that collecting immutable biometric data was disproportionate to the project’s purpose of verifying “proof of personhood,” noting that simpler verification methods could achieve the same result.

Read More:

This article is published on BitPinas: NPC Reasserts Role as Data Privacy Regulator in World/Tools For Humanity Dispute

What else is happening in Crypto Philippines and beyond?