Kenyan High Court Orders Worldcoin Foundation to Delete All Biometric Data Collected from Citizens

The Kenyan High Court has ordered the Worldcoin Foundation to permanently delete all biometric data collected from Kenyan citizens and to cease further data collection without proper authorization, according to a Monday ruling that marks a significant setback for the controversial cryptocurrency and digital identity project.

Lady Justice Roselyne Aburili also prohibited Worldcoin, which is co-founded by Sam Altman, CEO of OpenAI, and Alex Blania, from collecting or processing biometric data in Kenya without first conducting a mandatory Data Protection Impact Assessment (DPIA) and securing valid, non-incentivised consent from users.

The ruling, which follows a case brought by the Katiba Institute and the International Commission of Jurists (ICJ) Kenya, comes amid growing global attention on Worldcoin and its unique economic model, which aims to grant a universal basic income to all humans in the age of artificial intelligence.

Worldcoin's initiative in Kenya began in April 2024 with the goal of registering at least 1 million people in order to launch its token, which is designed to be used for transactions and identity verification on a blockchain network. In exchange for iris scans performed using proprietary devices called "Orbs," the Foundation offered Kenyans cryptocurrency tokens valued at roughly KSh 7,000 ($45).

These scans were used to generate a unique "World ID," which is intended to distinguish humans from bots in an era increasingly dominated by AI, with the Foundation later deleting the raw iris and facial data to retain only the cryptographic hash of the World ID.

The project quickly drew attention from local and global regulators and privacy advocates, leading to the Katiba Institute, a Kenyan civil society organisation, and the ICJ to file a judicial review application. Their case focused on violations of the country's Data Protection Act of 2019.

The Institute's lawyers argued that Worldcoin's activities infringed on Kenya's constitutionally guaranteed right to privacy by failing to conduct a DPIA, a legal requirement for processing sensitive data like biometrics, which is covered by Chapter 5, Part 1 of the Act.

"The Foundation's actions in collecting and processing biometric data without a DPIA constitute a breach of the Data Protection Act 2019, specifically Section 10 of the Act, which mandates a DPIA for any data processing operation that is likely to present a high risk of violation of a natural person's personal data protection interests," the ruling stated.

The court also found that Worldcoin's use of financial inducements to obtain consent undermined the principle of informed, freely given consent, rendering the process unlawful.

"Consent issued after an inducement, monetary offers, and cryptocurrency is not free and is illegal," said Joshua Malidzo Nyawa, counsel for the Katiba Institute, calling the ruling "a win for the right to privacy in Kenya."

The High Court's orders include a mandamus compelling Worldcoin to delete all iris and facial data collected within seven days, under the supervision of Kenya's Office of the Data Protection Commissioner (ODPC). Deputy Data Commissioner Oscar Otieno, in an affidavit, highlighted the significant risks posed by Worldcoin's operations.

"Unless this honorable court intervenes, the fate of the collected data and the privacy rights of the affected individuals hang precariously in the balance," said Otieno, adding that the data could be misused, altered, or erased.

The ruling also quashed Worldcoin's prior data collection activities and barred further processing without compliance with Kenyan law.

Worldcoin's troubles in Kenya began shortly after its launch in April 2024, quickly drawing attention from local and global regulators and privacy advocates. The Katiba Institute, a Kenyan civil society organisation, and the International Commission of Jurists (ICJ)

Later that month, police raided a Worldcoin warehouse and confiscated machines and documents, further escalating scrutiny.

Despite a brief reprieve in June 2024, when the Director of Public Prosecutions closed a criminal investigation, allowing Worldcoin to resume operations, the recent court ruling has dealt a severe blow to its ambitions in Kenya.

The ruling sets a powerful precedent for data protection, not only in Africa but globally, as countries around the world are grappling with the implications of new technologies like cryptocurrency, blockchain, and AI.

"This is a landmark victory for digital rights advocates," ICJ Kenya said in a statement, adding that technological innovation must prioritise constitutional rights.

The case arose from a joint initiative by the Katiba Institute and ICJ Kenya to challenge Worldcoin's data collection practices, which they argued violated the Data Protection Act 2019 and the right to privacy.

The Institute's lawyers asserted that Worldcoin's actions in collecting and processing biometric data without a DPIA constituted a breach of the Act, especially considering the magnitude of the project and the potential impact on a large segment of the population.

"The Foundation's actions present a sufficiently