Key Highlights
- Thai authorities halted the iris-scan crypto scheme and ordered the deletion of 1.2 million records due to major PDPA privacy violations.
- The PDPC found consent unlawful because participants were rewarded with crypto tokens, and the data was misused for unauthorized identity verification.
- The Department of Special Investigation (DSI) is now expanding the probe into suspicious activities, including organized reward claims and illegal crypto exchange arrests.
Thailand authorities have ordered an immediate halt to a nationwide “iris-scan for crypto tokens” project and mandated the permanent deletion of 1.2 million citizen biometric records.
The Ministry of Digital Economy and Society (DES) and the Office of the Personal Data Protection Committee (PDPC) issued the administrative order following an investigation that found the scheme in major breach of the nation’s Personal Data Protection Act (PDPA), citing risks to biometric data security and concerns over unlawful consent.
Crypto tokens as rewards
The PDPC’s investigation was initiated after irregularities in the scheme triggered widespread public concern. The findings concluded that the operator failed to secure clear and freely given consent from participants. Specifically, the PDPC determined that the use of crypto-token rewards as an incentive meant that consent was “not freely given.”
The operator’s declared purpose for data collection, solely human verification, was challenged by the system’s design. The system did not permit repeat scans from the same individual, which led regulators to believe the data was being used for identity verification, a purpose that went “beyond the declared purpose.”
Following these findings, the PDPC issued two binding administrative orders to the operator. The first requires the immediate suspension of all iris-data collection activities and submission of a compliance report within seven days. The second order mandates the deletion of the biometric data of 1.2 million users “to prevent unlawful transfer abroad.”
Commenting on the action, DES Minister Chaichanok Chidchob stated that while the government supports the use of AI technology and human-verification systems, “the collection of biometric data must be clear, transparent, and strictly compliant with the Personal Data Protection Act (PDPA).”
An investigation into these initial suspicions has reportedly revealed further suspicious activities in conjunction with the scheme. The authorities say that organized groups, in return for being paid for undertaking iris scans, were benefiting people who received crypto rewards for such participation. The probe also led to the arrests of individuals involved in unlicensed digital-asset exchange activities.
These findings are currently being expanded upon by the Department of Special Investigation (DSI) and other relevant authorities. The PDPC also noted that Thailand is not alone in regulating such technologies, citing that several other countries, including Germany, Spain, South Korea, Indonesia, and Brazil, have also suspended similar systems.
China’s warnings on biometric data
China’s Ministry of State Security (MSS) has also previously flagged iris-scanning crypto projects, such as the one resembling Worldcoin’s model, as a national security risk. In an official advisory, the MSS described a case where a foreign firm collected citizens’ sensitive biometric data by offering cryptocurrency token incentives and then transferred that information overseas.
Creating a safer environment in Thailand
In response to the order, the company responsible for the iris-scan system issued a statement asserting that it had fully complied with all Thai regulations and maintained complete transparency with the authorities. The service provider cautioned that the mandatory suspension “could affect ‘millions of users’ who rely on the technology to protect themselves from fraud and AI-driven cyber threats.”
The company indicated its intention to “continue discussions with DES and the PDPC to develop a safe, appropriate, and sustainable operational framework in Thailand, reaffirming its commitment to building a secure digital environment for the public in the long term.”
Suraphong Plengkham, Secretary-General of the PDPC, provided clarity on the committee’s goal, stressing that the priority is “protecting the public’s biometric data and maintaining trust in the regulatory system.” He underlined that the objective “is not to block new technologies but to ensure legal compliance to prevent future harm.” He reiterated that the PDPC “gives the highest importance to safeguarding sensitive data” and confirmed that the suspension aims to “stop unlawful collection practices and reinforce cooperation among agencies to maintain public confidence—while ensuring innovative human-verification technologies can still be used legally.”
Also Read: Thai Crypto Exchange Bitkub Considers $200M Hong Kong IPO Listing
