High Court orders Worldcoin to delete biometric data collected from Kenyans
Katiba Institute had sued firm for failing to conduct Data Protection Impact Assessment
The High Court has ordered Worldcoin Foundation and its agents to permanently delete – under the supervision of the Data Protection Commissioner – within seven days any biometric data collected in Kenya without undertaking (or using an inadequate) Data Protection Impact Assessment contrary to section 31 of the Data Protection Act, 2019 and by consent obtained through inducement of a cryptocurrency—Worldcoin.
Lady Justice Roselyne Aburili allowed Judicial Review Application filed by Katiba Institute, which challenged the collection, processing, and transfer of iris and facial images (biometric data) using the Worldcoin App and the Orb technology.
In its application, Katiba Institute had accused Tools for Humanity Corporation (US) and Tools for Humanity GmbH of venturing to unlawfully collect, process, or transfer biometric data (iris scans and facial recognition) in Kenya: (i) without undertaking (or using an inadequate) Data Protection Impact Assessment; without registering as a “data processor” or “controller”; using consent obtained by inducement of a cryptocurrency—Worldcoin (approximately worth Ksh 7,000 or US$50; and without the Communication Authority’s type approval of the Orb.
Worldcoin Foundation (registered in the Cayman Islands) holds the patents to the Orb technology, owns all user data, and issues all Worldcoin token (through a subsidiary World Assets Ltd registered in the British Virgin Islands.
On the other hand, Tools for Humanity shares personal data with Worldcoin Foundation and World Assets Ltd.
But neither Worldcoin Foundation nor World Assets Ltd is registered as a data processor or controller in Kenya.
In her ruling, Justice Aburili also restrained Worldcoin Foundation and its agents from further processing, collecting or dealing in Biometric data without undertaking (or using an inadequate) Data Protection Impact Assessment.
She further issued an order quashing Worldcoin Foundation and its agent’s decision to collect or process biometric data in Kenya without undertaking (or using an inadequate) Data Protection Impact Assessment contrary to section 31 of the Data Protection Act, 2019 and by consent obtained through inducement of a cryptocurrency—Worldcoin.
While collecting the data, Worldcoin said it aimed to build the “world’s largest identity and financial network” by scanning biometric data and using it to generate and store a unique code to identify one individual from the next. The iris and facial images scanned through the Orb were processed for machine learning on an Amazon web service cloud infrastructure.
Katiba Institute and the Law Society of Kenya, however, query the omission by the Cabinet Secretary (in consultation with the Data Commissioner) to prescribe practice guidelines for commercial use of personal data, by entities like Worldcoin, under section 37(3) of the Act.
Since Worldcoin launched in 2023, millions of people have had their iris patterns scanned despite being under scrutiny in various countries.
Indonesia is the latest country to stop Worldcoin, which was co-founded by OpenAI chief Sam Altman, from collecting personal data in the country with the government saying its suspension was a preventive measure to prevent potential risk to the public.
Other countries that have cracked down on Worldcoin are Spain, Portugal and Hongkong even as it recently expanded operations to the United States.
The court ruling came after hearing submissions from ICJ Kenya,Katiba Institute, and the Office of the Data Protection Commissioner (ODPC) on Wednesday
