Kenya Court Orders Worldcoin to Delete All Biometric Data Collected from Local Users

Worldcoin extracts sensitive data from users, which includes both facial images and iris scans. Worldcoin received the ruling from Justice Aburili Roselyne

Kenya's High Court has ordered blockchain startup Worldcoin to delete all biometric data collected from local users permanently. The ruling, issued by Justice Aburili Roselyne on Monday, follows a case brought by the Katiba Institute and ICJ Kenya to defend constitutional rights and ensure transparency.

The court granted a seven-day time frame for this operation, which will be overseen by Kenya's Data Protection Commissioner.

The ruling began with a case brought by the Katiba Institute and ICJ Kenya to ensure human rights and transparency in the process. The organizations sued the State to intervene in a case filed by the Worldcoin Foundation in April 2024, after the High Court approved a case by the Center for Human Rights and Economic Justice (CHREJ) to halt Worldcoin's activities in December 2023.

The case focused on the startup's violation of privacy through unauthorized data collection, in addition to establishing its procedures for collecting data from users. Worldcoin is a project founded by former members of the cryptocurrency startup Bitshares and artificial intelligence research lab DeepMind.

The startup's project aims to create a universal digital identity and grant every person a World ID. To use this service, users must undergo iris scanning and have their facial data collected by a specially designed device called "Omni." After the process is completed, a cryptocurrency called "Worldcoin" is granted to users.

However, this procedure and the startup's overall approach to data collection drew criticism from legal experts, who asserted that Worldcoin did not sufficiently disclose the nature of its activities to users. Moreover, the startup's practices were deemed unethical by the legal authorities, who believed this method lacked transparency, especially when considering the startup's mandatory obligations under the 2019 data protection legislation in Kenya.

The startup performed incorrectly on its mandatory Data Protection Impact Assessment responsibilities under Kenya’s Data Protection Act of 2019, the court ruled.

The startup also engaged in the practice of using cryptocurrency offers as a means to collect personal data from unsuspecting people. Earlier consent procedures used to collect data were also ruled on and canceled by the court.

In addition to the deletion order, the court issued several key rulings. The court ordered Worldcoin to cease collecting and processing additional biometric data in Kenya unless it performs a valid assessment process. The court removed every piece of data that was obtained from an illegal process, which the court itself declared unlawful.

The organization received an order to delete all existing data with immediate effect, though the process required official oversight at all times.

The startup's activities faced backlash in Kenya, which is part of a broader pattern of international pushback against Worldcoin’s technology. Earlier this year, Indonesia decided to halt the startup's operations.

On May 4, officials from the Indonesian Ministry of Communications and Digital Technology approved the startup's operation suspension. The officials observed suspicious activity and noted violations of the regulatory process.

This led to the startup's registration certificates, including those for its World ID service, being suspended.

Meanwhile, Brazilian authorities have raised concerns about Worldcoin's payment system for exchanging biometric data with users. In April, the South Korean government imposed an operational ban and a $800,000 fine on the startup for breaches of data protection regulations.

The startup is encountering increasing international resistance due to its methods of collecting personal information. The company began trying to connect with regulators in 2024, but many areas still do not have complete operational approval.

Worldcoin promotes universal digital identity through its platform, but critics argue that its processes lower standards of privacy and data protection. As governments worldwide appear to increase their efforts to safeguard their citizens from practices they deem invasive or deceptive, the startup is now facing the consequences.

The Kenyan court decision highlights the growing global focus on technology projects that handle personal data and the potential for misuse. With several countries highlighting the startup's lack of transparency and its violation of data protection rules, the startup now faces significant challenges in maintaining trust and following international standards.

As an increasing number of countries demand higher transparency and accountability, technology startups will need to adapt their strategies to ensure sustainable operations in various legal jurisdictions.