Colombia Confirms Definitive Closure of World Foundation and Tools for Humanity’s Biometric Data Operations

By Castillo Grau Abogados

Colombia’s Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC) has confirmed the definitive closure of the personal data processing operations carried out by World Foundation and Tools for Humanity Corporation in the country. The decision concerns activities involving the collection and processing of sensitive biometric information, including iris data obtained through specialized devices.

The measure was initially imposed through Resolution No. 78798 of October 3, 2025, and later confirmed after the companies’ appeal was reviewed by the SIC’s Personal Data Protection Delegation through Resolution No. 45710 of June 18, 2026. With the confirmation, the administrative decision became final and no further appeals are available within the Colombian administrative process.

The investigation focused on the activities of World Foundation and Tools for Humanity related to the collection of iris images from thousands of individuals in Colombia. The companies used devices known as “Orbs” to capture biometric information as part of the World project, which seeks to provide digital identity verification through a system known as World ID. Participants received incentives linked to the registration process.

According to the SIC, the companies failed to comply with several obligations established under Colombia’s personal data protection framework, including requirements related to informed consent, transparency regarding the purposes of data processing, procedures for handling user requests and complaints, and security measures appropriate for sensitive information.

Biometric information, such as iris patterns, fingerprints or facial recognition data, is considered a particularly sensitive category of personal data because it can be used to identify individuals through unique physical characteristics. Unlike passwords or other credentials, biometric identifiers cannot easily be replaced if compromised, which has increased regulatory attention worldwide regarding their collection and storage.

The SIC also ordered the deletion of sensitive personal data collected by the companies, including iris codes stored in databases, repositories or servers used for processing the information. The authority stated that the companies may not continue carrying out activities involving personal data processing in Colombia.

The case is part of a broader international debate over biometric technologies, digital identity systems and the protection of personal information. Projects that combine artificial intelligence, blockchain-based systems and biometric verification have attracted interest from technology companies and investors, while also facing regulatory scrutiny in different jurisdictions due to concerns regarding consent, transparency and data governance.

For companies developing digital identity solutions, the Colombian decision highlights the importance of compliance with local data protection laws when collecting and processing biometric information. Colombia’s Personal Data Protection Law (Law 1581 of 2012) establishes specific obligations for organizations handling personal information and grants individuals rights over the use of their data, including access, correction and control over processing activities.