Kenyan court orders Worldcoin to delete all biometric data

A Kenyan high court has ruled that decentralized identity protocol Worldcoin’s collection of biometric data violated the country’s data protection laws.

The court has now ordered the firm to permanently delete all biometric data it has collected within seven days of the ruling. 

The details 

• According to reports in Kenyan media, Worldcoin failed to conduct a mandatory data protection impact assessment as stipulated by the country’s data protection act. 
• The Office of the Data Protection Commissioner (ODPC) had petitioned the court to call Worldcoin to order after the firm had begun collecting biometric data in the country without first registering as a data processor. 
• Reports say the deputy data commissioner, Oscar Otieno, presented a sworn statement in court to affirm that he had investigated Worldcoin’s operations and found them illegal and unsafe for Kenyans. 
• Otieno argued that Worldcoin lacked proper accountability and transparency in handling the data it collects and could jeopardize public safety. 
• The presiding judge, Justice Rosen Abili, proceeded to order Worldcoin to cease the processing of any of the data it had collected. 
• The judge also commanded the company to delete all the data it had collected while the ODPC was charged with supervising the deletion process. 

Key context 

• Worldcoin, a blockchain-based identity project using biometric eye scans, launched in Kenya in April 2023 but began iris scans in August.
• Even before entering Kenya, the company faced controversy over how it handles and secures user data.
• A group of engineers accused Worldcoin of allowing unauthorized third-party access to user data, raising concerns about data misuse.
• Worldcoin claims that iris scan data is not stored in a readable format but converted into cryptographic hashes and then deleted.
• According to the company, this process ensures that even in the event of a breach, the personal information remains inaccessible and unusable.

More controversy 

• Following Worldcoin’s launch, Kenya’s data authority (ODPC) issued a public warning urging citizens to be cautious before sharing personal data.
• The then ICT Cabinet Secretary, Eliud Owalo, stated that Worldcoin was operating legally and had been in communication with the data protection office.
• Worldcoin was registered under its parent company, Tools for Humanity, as a data processor — granting it initial legal clearance to collect personal data.
• However, its license was later revoked by lawmakers who argued the company exploited loopholes in Kenya’s data protection laws to operate without proper oversight.