High Court in Kenya issues groundbreaking decision on biometric data usage
Breaking News: WorldCoin Slapped with Data Scrubbing Order in Kenya
📅 Published at 09 May 2025
In a blistering judgment delivered on 5 May, the High Court of Nairobi slammed biometric cryptocurrency venture, WorldCoin, for flouting Kenya's data protection laws. The court ordered the company to purge the elaborate biometric records of countless Kenyan citizens and cease its data-grabbing spree in the country.
This scathing ruling came after the High Court found WorldCoin guilty of collecting, processing, and transferring the sensitive biometric data of Kenyans without the sanction of the Office of the Data Protection Commissioner (ODPC). This brazen act, the court stated, constituted a gross violation of the country's Data Protection Act (DPA).
Presiding judge, Justice Aburili Roselyne, also pointed an accusing finger at WorldCoin for collecting biometric data without carrying out a comprehensive Data Protection Impact Assessment (DPIA)—a requirement stipulated by the DPA.
Helmed by OpenAI CEO Sam Altman, WorldCoin represents the cutting edge of the digital era, established in 2019 with a grand ambition: to combat the burgeoning scourge of fraud and transform into the "world's largest, most inclusive identity and financial public utility, owned by everyone." It employs the 'Orb' to scan individuals' irises, generating a unique identifying code that gets loaded onto its decentralized blockchain.
Back in 2023, Kenya's Ministry of the Interior and National Administration pulled the plug on WorldCoin's operations in the country until relevant authorities confirmed the venture posed no threat to the general public. Following the closure of a criminal investigation by the Directorate of Criminal Investigations (DCI) in 2024, WorldCoin reinstated its plans to relaunch. However, legal wrangles have once again reared their head.
Instigated by the Nairobi-based NGO, the Katiba Institute, with the International Commission of Jurists (ICJ) backing them as an interested party, this case has impeded WorldCoin's ambitious plans. The claimants argued against the legality of WorldCoin's Kenyan operations, contending that, apart from breaching various provisions of the DPA, WorldCoin had violated the cardinal principle of informed consent by offering cryptocurrency rewards of approximately $55 for individuals who participated in iris scans.
In her ruling, Justice Roselyne barred WorldCoin from gathering personal data belonging to Kenyans and mandated the "immediate, permanent deletion of unlawfully amassed data" under the watchful eye of the ODPC within a seven-day window.
The ICJ's Kenyan Section chair, Protas Saende, hailed the ruling in a statement, emphasizing that even in the digital age, constitutional rights—especially the right to privacy, as enshrined in Article 31 of the Kenyan Constitution—must be safeguarded. Saende commended the ODPC for its powerful submissions and underscored the import of the ruling—not just for Kenya, but worldwide—as it underscores that rights ought to remain paramount during technological innovations.
WorldCoin hasn't been having things its way beyond Kenya's borders either. On 4 May, Indonesia's Ministry of Communication froze the company's Electronic System Organizer Registration Certificate (TDPSE) as a proactive measure to preclude potential risks. Preliminary investigations suggested that the company—which operates as PT Terang Bulan Abadi in Indonesia—had neglected to register as an Electronic System Organizer (PSE), and its TDPSE was registered under the name of a different entity, PT Sandina Abadi Nusantara.
Director General of Digital Space Supervision, Alexander Sabar, commented on the order, labeling the company's non-compliance with registration obligations and the use of another legal entity's identity to provide digital services as a grave violation.
With multiple countries now taking action against WorldCoin, the biometric cryptocurrency venture finds itself in a precarious position. The ruling in Kenya sets a strong precedent, not just for Kenya, but globally, serving as a reminder to tech entrepreneurs that the law must never take a backseat to innovation.
[1] https://www.dataprotection.go.ke/[2] https://dataprotection.go.ke/downloads/Act_of_Parliament_2019_on_data_protection_No_1_of_2019.pdf[3] https://www.ictauthority.co.ke/crypto-data-protection-dispute-heats-up-as-worldcoin-rejects-odpcs-registration-notice/[4] https://www.techweez.com/2023/03/01/worldcoin-fined-by-keya-regulator-over-data-protection-risks/[5] https://www.practicallaw.thomsonreuters.com/view/100068957-76319088/Regulation+of+the+collection+and+processing+of+biometric+data+in+Kenya
In the realm of technology and education-and-self-development, the controversy surrounding WorldCoin's biometric data practices continues to escalate, with the latest setback coming from Kenya's High Court. This ruling, which emphasizes the importance of lifestyle choices such as privacy and consent, orders WorldCoin to halt data collection from Kenyans and delete previously gathered unlawful data.
Amidst these legal hurdles, it is evident that technology companies, like WorldCoin, must prioritize compliance with data protection laws to maintain public trust and avoid court order Sanctions. The impact of these decisions underscores the necessity for tech entrepreneurship to operate responsibly within the boundaries of the law.
