Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Tools for Humanity Corporation, Tools for Humanity GmbH and Worldcoin Foundation were found liable for violating the provisions of the Data Protection Act, 2019 in failing to implement a proper framework for data protection as regards the Worldcoin Project.

Facts

An investigation was instituted against Tools for Humanity Corporation, Tools for Humanity GmbH and Worldcoin Foundation (collectively the “Respondents), in respect of the Worldcoin Project. The investigation related to the processing of personal data including sensitive data, by the Respondents under the Worldcoin Project in respect of its Proof of Personhood protocal. The Worldcoin Project aimed to create a globally-inclusive identity and financial network with the potential of increasing economic opportunity, scaling a reliable solution for distinguishing humans from AI online and therefore showing a potential path to global universal basic income.

To facilitate this mission, the Worldcoin Project set about collecting personal data comprised of iris scans, facial images, email addresses, phone number, date of birth, Country of residence, phone book contacts, feedback and correspondences inferred data (age range, skin colour and gender) geolocation data (GPS, IP address), WiFi access point, cell tower information, device information.

The ODPC reviewed the operations of the Worldcoin Project through a Data Protection Impact Assessment submitted by Tools for Humanity Corporation. It is indicated that during the pendency of the review of the DPIA by Tools for Humanity Foundation, Worldcoin Foundation took over the operations of the Worldcoin Project and continued with data collection activities but without first submitting their DPIA to the ODPC for review as required.

The ODPC subsequently asked the Respondents to cease further activities under the Worldcoin Project which was not adhered to. In fact, it is stated that the recruitment activities escalated with the introduction of the Worldcoin Token. The situation persisted until five (5) other government agencies including the Ministry of Interior & National Administration got involved with the issue. Thereafter, the government set up a multi agency taskforce to review the activities of the Respondents under the Worldcoin Project.

Holding

The following are the findings:

• Tools for Humanity Corporation is registered as a data controller and Processor in Kenya.
• Worldcoin Foundation which took over registration activities from Tools for Humanity Corporation is not registered as a data controller or data processor in contravention of the DPA,19.
• Worldcoin Project did not obtain free, unequivocal, specific, informed consent from data subjects prior to processing their personal data. The award of Worldcoin Tokens to data subjects prior to and as a condition to registration controverted their free will. Also, the orb operators were observed assisting data subjects to download the Worldcoin App and in most cases accepted the terms and conditions for registration on their behalf.
• Informed consent was not achieved as information should have been given to the data subjects covering purpose of processing, transfer of data and its risks, right to withdraw consent, type of data being collected, consequences of providing withholding & withdrawing consent etc prior to the collection exercise being undertaken. This information should have been simplified having regard to the realities of the data subject's socio-economic backgounds.
• Transfer of data subject's personal data outside Kenya, which requires stringent requirements to include consent of the data subject, did not meet the thresholds set by the DPA,19 due to invalidated consent as stated above.