Kenyan high court orders Worldcoin to delete biometric data of citizens over privacy concerns

The Kenyan High Court has ordered the Worldcoin Foundation to permanently delete all biometric data it collected from Kenyan citizens, citing violations of the country’s Data Protection Act of 2019. The decision, delivered by Lady Justice Roselyne Aburili, marks a significant setback for the controversial cryptocurrency and digital identity project co-founded by Sam Altman, CEO of OpenAI, and Alex Blania. The court also prohibited Worldcoin from further collecting or processing biometric data in Kenya without conducting a mandatory Data Protection Impact Assessment (DPIA) and securing valid, non-incentivised consent from users.Worldcoin, launched in Kenya in April 2023, gained widespread attention by offering Kenyans cryptocurrency tokens valued at roughly KSh 7,000 ($45) in exchange for iris scans performed using proprietary devices called “Orbs”. These scans were used to generate a unique “World ID”, intended to verify users as human rather than bots in an era increasingly dominated by artificial intelligence.The project saw thousands of Kenyans flock to scanning stations at locations like the Kenyatta International Convention Centre (KICC) and shopping malls, drawn by the financial incentive. By August 2023, over 350,000 Kenyans had signed up, making Kenya the global leader in Worldcoin interest, according to a February 2024 CoinJournal study analysing Google Trends data, which gave Kenya a score of 100 for engagement with the project.However, the initiative quickly sparked concerns among regulators and privacy advocates. The Katiba Institute, a Kenyan civil society organisation, alongside the International Commission of Jurists (ICJ) Kenya, filed a judicial review application challenging Worldcoin’s data collection practices. They argued that the project violated Kenya’s constitutional right to privacy by failing to conduct a DPIA, a legal requirement for processing sensitive data like biometrics. Additionally, the court found that Worldcoin’s use of financial inducements to obtain consent undermined the principle of informed, freely given consent, rendering the process unlawful.“Consent issued after an inducement, monetary offers, and cryptocurrency is not free and is illegal,” said Joshua Malidzo Nyawa, counsel for the Katiba Institute, calling the ruling “a win for the right to privacy in Kenya.”Worldcoin to delete Kenyans’ data within seven daysThe High Court’s orders include a mandamus compelling Worldcoin to delete all iris and facial data collected within seven days, under the supervision of Kenya’s Office of the Data Protection Commissioner (ODPC). Deputy Data Commissioner Oscar Otieno, in an affidavit, highlighted the significant risks posed by Worldcoin’s operations, warning that without intervention, the data could be misused, altered, or erased. The ruling also quashed Worldcoin’s prior data collection activities and barred further processing without compliance with Kenyan law.Worldcoin’s troubles in Kenya began shortly after its launch. In August 2023, the Kenyan government suspended the project’s operations, with Interior Cabinet Secretary Kithure Kindiki citing concerns over public safety and the integrity of financial transactions. The ODPC issued warnings urging citizens to seek clarity on how their data would be used, while one official labelled Worldcoin “a gang of criminals” harvesting data from young people.A police raid on a Worldcoin warehouse later that month confiscated machines and documents, further escalating scrutiny. Despite a brief reprieve in June 2024, when the Director of Public Prosecutions closed a criminal investigation, allowing Worldcoin to resume operations, the recent court ruling has dealt a severe blow to its ambitions in Kenya.The Kenyan case reflects broader global concerns about Worldcoin’s biometric data practices. Countries like Spain, Portugal, Brazil, and Germany have imposed bans or investigations, citing issues such as insufficient transparency, data collection from minors, and the inability to withdraw consent. In March 2024, Spain’s data protection authority temporarily halted Worldcoin’s operations, while Germany ordered the deletion of non-compliant data in December 2024. The project’s claim that iris data is converted into cryptographic hashes and deleted has done little to assuage regulators, particularly given the immutable nature of biometric data, which cannot be changed if compromised.In response to earlier criticisms, Worldcoin stated in 2023 that it complied with Kenyan laws and was committed to transparency and dialogue with local authorities. However, the company did not immediately respond to requests for comment following the Monday ruling. The decision has also impacted Worldcoin’s market performance, with its WLD token dropping over 10% in value within 24 hours of the ruling, trading at $0.8816.The Kenyan ruling sets a powerful precedent for data protection, not only in Africa but globally. “This is a landmark victory for digital rights advocates,” ICJ Kenya stated, emphasising that technological innovation must prioritise constitutional rights.