Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The court barred Worldcoin and its affiliates from collecting biometric data in Kenya without a valid DPIA or registration. It found the data collection methods unlawful and ordered all data erased within seven days. The ruling reaffirmed protections under Kenya’s Data Protection Act and the constitutional right to privacy.

Facts

The five ex parte applicants—Katiba Institute, Law Society of Kenya, Kenya Human Rights Commission, International Commission of Jurists, and African Centre for Open Governance—filed a judicial review application in August 2023.

They claimed that Tools for Humanity Corporation (US), Tools for Humanity GmbH, Worldcoin Foundation (Cayman Islands), World Assets Ltd (BVI), and Platinum De Plus Ltd, were unlawfully collecting and processing biometric data (iris scans) from Kenyans using a device called the Orb. The data was allegedly collected without a valid Data Protection Impact Assessment (DPIA) as required by Section 31 of the Data Protection Act, 2019, and that consent was induced by offering cryptocurrency (Worldcoin tokens).

They also claimed that key data processing entities had not registered with the Office of the Data Protection Commissioner (ODPC), and that the Cabinet Secretary and the ODPC had failed to issue mandatory guidelines on the commercial use of personal data.

<aside> ➡️

Link to the ODPC decision | Tools for Humanity Corporation & 2 Others in respect of the Worldcoin Project - ODPC Complaint No. 1394 of 2023

</aside>

The 1st to 4th Respondents denied wrongdoing, arguing that participation was voluntary and with informed consent. They claimed to have submitted a DPIA and to be in the process of registration as required. They challenged the jurisdiction of the court, asserting the doctrine of exhaustion had not been met and that the matter should have first been addressed by the ODPC.

The 5th Respondent (Platinum De Plus) maintained it was only involved in marketing, not data processing, and reiterated that judicial review was not available against private entities.

The 6th Respondent (ODPC) supported the application in part, confirming that TFH US and its affiliates had collected sensitive personal data without meeting statutory requirements for registration, consent, or DPIA, and that enforcement action had already been taken.

The court found that:

• There was sufficient public interest and evidence of rights violations to justify hearing the matter despite issues of standing and the exhaustion doctrine.
• The 1st to 5th Respondents had processed biometric data without a valid DPIA, informed consent, or proper registration.