The National Privacy Commission (NPC) has ordered Tools for Humanity (TFH), the company behind the World App and its Orb verification system, to stop collecting and processing biometric data in the Philippines after finding violations of the Data Privacy Act of 2012 (DPA).
In a Cease and Desist Order (CDO), the NPC directed TFH to suspend all personal data processing related to the World App and associated systems, including the collection of sensitive biometric information such as iris scans.
“The integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and permanent identifier,” said Deputy Privacy Commissioner Jose Amelito Belarmino II. “When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice.”
The NPC said it supports technological innovation but stressed that all companies must comply with data privacy laws. The agency reminded the public to be cautious when asked to provide personal data, especially facial or iris scans, and to make sure they understand who is collecting their data, how it will be used, and what safeguards are in place.
The order stemmed from a complaint filed by the NPC’s Complaints and Investigation Division (CID). After reviewing TFH’s operations, the NPC found several violations of the DPA and its implementing rules.
One of the main findings was invalid consent due to undue influence. The NPC said that offering money in exchange for iris scans created pressure on participants and made their consent invalid under the law.
The commission also cited lack of transparency and information. It said TFH failed to clearly inform users about the purpose, scope, and duration of data collection. The privacy notice did not explain in simple or accessible terms how personal data would be used, violating the principle of transparency and the right of individuals to be informed.
Another finding involved excessive collection of biometric data. The NPC said gathering detailed iris patterns was unnecessary for TFH’s stated purpose of confirming that users are real people or authentic human users.
The commission warned that continuing to process such biometric data could expose Filipinos to “grave and irreparable injury,” such as identity theft, fraud, or long-term reputational harm. Since biometric identifiers are permanent, unauthorized use could cause irreversible damage.
The NPC also pointed out that TFH has faced similar privacy concerns in other countries, including Kenya and Hong Kong. Despite these issues, the company proceeded with its operations in the Philippines without ensuring compliance with local data privacy rules.
“This Cease and Desist Order sends a clear message that the NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives,” Belarmino said.
The NPC reiterated that data privacy is a fundamental right and that any innovation involving personal data must follow lawful, fair, and transparent processes.
“The promise of technology must never come at the expense of human dignity and data protection,” the NPC said.
Under Section 7 of the DPA, the NPC is empowered to issue a Cease and Desist Order to prevent harm to the public.