Court orders Worldcoin to delete Kenyans’ data
This ruling follows findings that the company violated the Data Protection Act by failing to safeguard the privacy and rights of Kenyan citizens.
The High Court of Kenya has ordered Worldcoin, a cryptocurrency and digital identity company co-founded by OpenAI CEO Sam Altman, to delete all biometric data it collected from Kenyans.
This ruling follows findings that the company violated the Data Protection Act by failing to safeguard the privacy and rights of Kenyan citizens.
Worldcoin had launched operations in Kenya by collecting sensitive biometric data, primarily iris scans and facial recognition, in exchange for a token payment of roughly Sh 7,000.
The initiative drew thousands of Kenyans, many lured by the financial incentive, raising serious concerns about whether their consent was truly informed and voluntary.
In its ruling, the court found that Worldcoin had not conducted a mandatory Data Protection Impact Assessment (DPIA), a legal requirement when handling data that poses a high risk to individuals.
The absence of this assessment meant the risks to participants’ privacy had not been properly identified or mitigated.
Additionally, the court noted that the biometric data was stored outside of Kenya, in countries such as the United States, Italy, and South Africa.
This cross-border data transfer raised further concerns over jurisdiction and the security of Kenyans’ personal information.
Worldcoin also ignored orders issued by the Office of the Data Protection Commissioner (ODPC) to halt its operations, continuing data collection until an official government suspension in August 2023.
The court criticized the ODPC for initially registering Worldcoin without adequate due diligence.
Although the ODPC later revoked the registration and issued enforcement notices, these steps were deemed too late to prevent harm.
As a result, the court ruled that all biometric data collected from Kenyans must be permanently deleted, and affirmed the need for stronger enforcement of data protection laws.
The judgment is a landmark decision that underscores the importance of data privacy and sets a precedent for how emerging technologies must operate within legal and ethical boundaries.