A Kenyan court has ordered WorldCoin to delete the biometric data records of thousands of Kenyan citizens and halt its data collection activities in the country following violations of Kenyan data protection laws.
In a ruling issued earlier this week (5 May), the High Court of Nairobi determined that biometric cryptocurrency venture WorldCoin had collected, processed, and transferred the biometric data of Kenyan individuals without the approval of the Office of the Data Protection Commissioner (ODPC).
Presiding judge Justice Aburili Roselyne also found that WorldCoin had gathered biometric data without conducting a proper Data Protection Impact Assessment (DPIA), as mandated by the Data Protection Act (DPA).
Founded in 2019 by DeepAI CEO Sam Altman and his San Francisco and Berlin-based company Tools for Humanity, WorldCoin operates at the forefront of the emerging digital landscape.
The company was established with the goal of addressing increasing fraud risks and becoming the “world’s largest, most inclusive identity and financial public utility, owned by everyone.” To achieve this, the company uses ‘the Orb’ to scan individuals’ irises and generate a unique identifying code, which is then uploaded to its decentralized blockchain.
Read Also: Bclb Launches Responsible Gaming Drive In Collaboration With Agok, Focused On Community Impact
In 2023, Kenya’s Ministry of the Interior and National Administration suspended the company’s activities until relevant agencies verified that there was no threat to the public. After the Directorate of Criminal Investigations (DCI) closed its criminal investigation into WorldCoin in 2024, the company sought to resume operations.
However, this case, initiated by Nairobi-based NGO the Katiba Institute along with the International Commission of Jurists (ICJ) as an interested party, has once again halted the company’s plans. The claimant challenged the legality of WorldCoin’s operations in Kenya, asserting that, in addition to the DPA breaches, WorldCoin had violated the principle of informed consent by offering cryptocurrency valued at USD 55 for participation in iris scans. Justice Roselyne has ordered WorldCoin to cease collecting Kenyans’ personal data and has mandated the “permanent deletion of unlawfully collected data under the supervision of the ODPC within 7 days.”
In a statement posted to X, Protas Saende, chair of the Kenyan Section of the ICJ, stated: “The judgment rightly underscores that even in the digital age, constitutional rights, especially the right to privacy under Article 31 of the Constitution, must be upheld.” He further remarked: “We commend the ODPC for its strong, persuasive submissions which greatly informed the Court’s deliberations. This ruling is a powerful precedent not just for Kenya but globally affirming that rights must remain paramount in technological innovation.”
Kenya is not the only country taking action against WorldCoin. On 4 May, the Indonesian Ministry of Communication temporarily suspended the company’s Electronic System Organiser Registration Certificate (TDPSE) as a “preventative measure to prevent potential risks.” An initial investigation revealed that the company, operating as PT Terang Bulan Abadi in Indonesia, had not registered as an Electronic Systems Organiser (PSE). Additionally, the company’s TDPSE was registered under a different legal entity, PT Sandina Abadi Nusantara. Commenting on the suspension, Director General of Digital Space Supervision Alexander Sabar said: “Non-compliance with registration obligations and the use of the identity of another legal entity to carry out digital services is a serious violation.”
