In a landmark ruling, the High Court of Kenya has declared the data collection activities of the WorldCoin Foundation illegal, ordering the organization to permanently delete all biometric data—specifically iris and facial scans—collected from Kenyan citizens.
Lady Justice Roselyne Aburili delivered the judgment, emphasizing that WorldCoin’s operations violated Kenyans’ constitutional right to privacy. The court directed that all collected data must be erased within seven days, under the supervision of the Office of the Data Protection Commissioner (ODPC).
Court Orders and Key Directives
The High Court issued three major directives against WorldCoin and its agents:
- A prohibition on further biometric data processing in Kenya.
- A mandatory directive to delete all previously collected biometric data.
- An Order of Certiorari, effectively nullifying any prior decisions to collect and process such sensitive personal information in the country.
The ruling specifically noted that WorldCoin failed to conduct a legally required Data Protection Impact Assessment, breaching Section 31 of Kenya’s Data Protection Act, 2019. Additionally, the court found that consent for data collection was improperly obtained through financial inducement, offering cryptocurrency tokens in exchange for sensitive biometric information.
Background of the Case
The legal challenge was brought forward by the Katiba Institute, a constitutional advocacy organization. The institute raised concerns about WorldCoin’s collection, processing, and transfer of Kenyans’ biometric data using its Orb devices and mobile application without adequate safeguards.
“Today, Lady Justice Aburili Roselyne has allowed our Judicial Review Application, where we challenged the collection, processing, and transfer of iris and facial images (biometric data) using the Worldcoin App and the Orb,” the Katiba Institute confirmed in a statement following the ruling.
WorldCoin’s Controversial Presence in Kenya
WorldCoin, backed by Tools for Humanity, made headlines in March 2023 after it drew massive crowds at Nairobi’s Kenyatta International Convention Centre (KICC). Thousands of Kenyans queued for hours, enticed by the promise of receiving approximately KES 7,000 (~$52) in $WLD cryptocurrency tokens in exchange for their biometric data.
The exercise was abruptly suspended by the Kenyan government after chaotic scenes raised public safety and security concerns.
Despite the suspension, WorldCoin had signaled intentions to resume its activities. In June 2024, the company pointed to the Director of Public Prosecutions’ decision to close investigations as an opening to re-engage the Kenyan government and potentially restart operations.
However, the Directorate of Criminal Investigations advised WorldCoin to properly register as a business entity with the Registrar of Companies before considering any resumption of activities within Kenya.
What This Means for Data Protection in Kenya
The High Court’s decision sets a significant precedent for data privacy enforcement in Kenya and reinforces the role of the ODPC in protecting citizens’ rights in the digital age. The ruling underscores Kenya’s commitment to upholding strong data privacy standards, especially when it comes to handling sensitive biometric information.
As of now, WorldCoin must comply with the deletion order, and any attempt to resume operations will likely face heightened regulatory scrutiny.
