High Court in Kenya hands down significant decision concerning biometric information
Published at 09 May 2025
WorldCoin Takes a Knock: Kenyan Court Halts Biometric Data Collection Amidst Data Protection Act Breaches
In a stunning blow, the High Court of Nairobi has chastised biometric cryptocurrency venture WorldCoin for violating Kenya's Data Protection Act (DPA). The verdict issued this week (5 May) states that WorldCoin collected, processed, and transferred the sensitive biometric data of Kenyan citizens without obtaining proper consent.
Presiding judge Justice Aburili Roselyne further noted that WorldCoin neglected to conduct a Data Protection Impact Assessment (DPIA) as required by the DPA.
Born in 2019 by OpenAI CEO Sam Altman and Tools for Humanity, WorldCoin is a trailblazer in the burgeoning digital age. Designed to address rampant fraud risks and emerge as "the world's largest, most inclusive identity and financial public utility, owned by everyone," the firm utilizes 'Orb' to scan individual irises and generates a unique identifying code that gets uploaded to its decentralized blockchain.
Its Kenyan operations initially faced hurdles in 2023 when the Ministry of the Interior and National Administration suspended its activities. Following the closure of the Directorate of Criminal Investigations (DCI) criminal investigation in 2024, WorldCoin attempted to restart its operations. However, the doors have been slammed shut once again with this landmark case, brought forward by the Katiba Institute and the International Commission of Jurists.
In the preliminary hearing, the complainants took objection to the legality of WorldCoin's Kenyan operations. They claimed that, apart from the other DPA infractions, WorldCoin had breached the principle of informed consent by providing cryptocurrency valued at USD 55 for participation in iris scans.
True to form, Justice Roselyne has forbidden WorldCoin from gathering the personal data of Kenyans and ordered the "permanent deletion of illegally obtained data under the supervision of the Office of the Data Protection Commissioner within 7 days."
The Katiba Institute's chair, Protas Saende, hailed the decision: "This judgment underscores the crucial importance of protecting constitutional rights, particularly the right to privacy." He further asserted that the ruling serves as a powerful testament to the ongoing need for privacy rights in the digital era, highlighting the role of the Office of the Data Protection Commissioner.
In a parallel context, Indonesia has also moved against WorldCoin. On 4 May, the Indonesian Ministry of Communication temporarily revoked WorldCoin's Electronic System Organiser Registration Certificate (TDPSE) as a preventative measure to avert potential risks. The preliminary probe indicated that the local operators, who go by PT Terang Bulan Abadi in Indonesia, had failed to register as an Electronic Systems Organiser, and the company's TDPSE was misleadingly registered under the name of a different entity, PT Sandina Abadi Nusantara.
Alexander Sabar, the Director General of Digital Space Supervision, expressed his concerns: "Non-compliance with registration obligations and the use of the identity of another legal entity to provide digital services is a serious offense."
These dramatic turn of events underscore the growing importance of adhering to data protection laws in the digital age. As more countries strengthen their commitment to protecting sensitive biometric data, it's clear that compliance, transparency, and informed consent are essential to avoiding legal entanglements and economic repercussions.
- The High Court of Nairobi's verdict against WorldCoin indicates that the company violated Kenya's Data Protection Act by gathering sensitive biometric data without proper consent.
- In addition to DPA infractions, the Katiba Institute and the International Commission of Jurists claimed that WorldCoin offered cryptocurrency in exchange for iris scans, thereby breaching the principle of informed consent.
- Amidst these developments, the Indonesian Ministry of Communication temporarily revoked WorldCoin's Electronic System Organiser Registration Certificate due to non-compliance with registration obligations and using another entity's identity for digital services.
- The ruling by Justice Roselyne serves as a reminder of the crucial role of privacy rights in the digital era, emphasizing the need for compliance, transparency, and informed consent to prevent legal entanglements and economic repercussions, as more countries prioritize protecting sensitive biometric data.
