Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Office of the Data Protection Commissioner (ODPC) sought a preservation order for personal data collected by the Worldcoin project. Citing non-compliance with the Data Protection Act, the ODPC aimed to secure data collected from Kenyan residents between April 2022 and August 2023. The court allowed the application, issuing the preservation order.

Facts

The Office of the Data Protection Commissioner (ODPC) applied for a preservation order against the respondents concerning the Worldcoin project. The ODPC sought to "preserve all personal data and sensitive personal data collected from Kenyans and Kenyan residents pertaining to the Respondent’s operation of the Worldcoin project for the period from 19th April 2022 to 8th August 2023". They also requested any "ancillary order the court may deem appropriate" to effect the preservation order, along with an order for costs.

The application was opposed by all respondents.

• The 1st and 2nd respondents argued that the application was sub judice because similar proceedings were pending. They also claimed the matter was overtaken by events due to the ODPC's investigations and cancellation of their registration certificates. They asserted that they ceased operations in Kenya after the cancellation, eliminating any risk of data loss or modification.
• The 3rd respondent, Sense Marketing, claimed to be an "experiential marketing agency" hired to recruit people onto the Worldcoin Project but denied collecting any personal data. They stated that they assisted people in downloading the app and using the Orb to verify proof of humanity, understanding that the Orb does not store any data.

The court allowed the ODPC's application for a preservation order. The court ordered the respondents, their employees, agents, or representatives, to preserve all personal data and sensitive personal data collected from Kenyans and Kenyan residents related to the Worldcoin Project from 19th April 2022 to 8th August 2023.

The court, however, declined to make an order for costs.

The court reasoned that despite other similar proceedings, this matter was not fully sub judice because the present suit predated the High Court Judicial Review Application and there were additional parties involved in the Judicial Review Application who were not parties to this Miscellaneous Criminal Application.

The court also expressed doubts that participants provided fully informed consent for the use of their data, especially given the incentive of WLD Tokens. The court noted that sensitive personal data had been transferred to third parties, such as the Worldcoin Foundation, and was now housed outside of Kenya, increasing the risk of data breaches.

<aside> ➡️

Link to related ODPC ruling

Tools for Humanity Corporation

</aside>

The court commented on potential negligence by the Office of the Data Protection Commissioner (ODPC).

The court stated that the alleged breaches by the respondents revealed the laxity of the ODPC. It noted that "no proper diligence was done before issuing the 1st and 2nd respondents with a Certificate of Registration No. 00379 on 15th September 2022".