TECH NEWS | NPC halts World App data; NADPOP, PH-CERT seek audit
Contributed photo
The National Privacy Commission has issued a cease-and-desist order against Tools for Humanity, directing the company behind the World App and Orb verification system to immediately stop processing personal data in the Philippines, including the collection of biometric identifiers such as iris scans. The NPC said the action follows findings by its Complaints and Investigation Division that TFH’s practices violated the Data Privacy Act, its implementing rules and other issuances.
In its press statement dated Oct. 8, 2025, the commission cited four grounds for the order: invalid consent due to undue influence from monetary incentives; lack of transparency about purpose, scope and duration of processing; excessive collection of immutable biometric data not necessary for proof of humanity claims; and risk of grave and irreparable injury from continued processing.
“The integrity of a Filipino citizen’s biometric data is non-negotiable, as it is a unique and permanent identifier,” Deputy Privacy Commissioner Jose Amelito S. Belarmino II said. “When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice. This cease-and-desist order sends a clear message that the NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives.”
The commission noted that TFH’s operations in other jurisdictions, including Kenya and Hong Kong, have been halted over privacy concerns and said the firm failed to exercise due diligence before launching locally.
The NPC reiterated that data privacy is a fundamental right and said innovations using personal and biometric data must adhere to lawful, fair and transparent processing. “The promise of technology must never come at the expense of human dignity and data protection,” the commission said, reminding the public to know who is collecting their data, how it will be used and what safeguards are in place before consenting. The agency said its authority to issue a cease-and-desist order is grounded in Section 7 of the Data Privacy Act, Section 9 of its implementing rules and NPC Circular 2020-02.
In a separate statement Thursday, the National Association of Data Protection Officers of the Philippines and the Philippine Computer Emergency Response Team backed the NPC ruling and proposed an independent privacy and cybersecurity audit to validate findings and bolster public trust. “As advocates of data protection and responsible digital transformation, we believe transparency and fairness are essential to maintaining confidence in our cyber and digital ecosystems,” said Sam Jacoba, founding president of NADPOP and vice president of PH-CERT. “An independent audit can help clarify the facts, ensure due process, and promote accountability among all stakeholders.”
PH-CERT President Lito Averia said the initiative is intended to strengthen trust. “This is not about contesting the ruling but strengthening trust through evidence-based, transparent action. Our goal is to protect citizens’ rights while supporting innovation built on accountability,” he said.
NADPOP and PH-CERT said the proposed review would be conducted by Communities of Practice experts and volunteers in coordination with the NPC, the Department of Information and Communications Technology and other stakeholders from industry and academe. The groups added they have not launched any concrete initiative with World.Org in the Philippines and said an audit would ensure adherence to their shared commitment to secure the digital lives of Filipinos. “The best way for us to do this is for our world-class experts to conduct a full and independent review of their digital ecosystem,” Jacoba said.
——————–
WATCH TECHSABADO ON OUR YOUTUBE CHANNEL:
WATCH OUR OTHER YOUTUBE CHANNELS:
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
