Kenya Issues Directive to Worldcoin: Cease Gathering Biometric Information
Kenya's High Court puts a halt to biometric data collection by Sam Altman's company, World (previously known as Worldcoin), unless the company performs a proper Data Protection Impact Assessment. This court decision also bars the company from using cryptocurrency as a motivator for collecting users' data.
In essence, the court has demanded that World and its agents erase any biometric data amassed without a proper assessment, and they have seven days to do so. If not, they must face the consequences under the supervision of the Data Protection Commissioner.
Katiba Institute, a legal advocacy group focusing on upholding the Kenyan constitution, brought forward the case. In agreement with Katiba, the court determined that World had breached section 31 of Kenya's Data Protection Act by acquiring iris and facial scans without adequate safeguards.
Justice Aburili Roselyne issued the ruling, referring to World's practices as invalid under the law. In her decision, she granted "An order of Mandamus compelling the Worldcoin Foundation and its agents to permanently delete (under the supervision of the Data Protection Commissioner) within seven days any biometric data collected in Kenya without undertaking (or using an inadequate) Data Protection Impact Assessment contrary to section 31 of the Data Protection Act, 2019 and by consent obtained through inducement of a cryptocurrency-Worldcoin."
The legal proceedings began back in August 2023, when Katiba first filed a judicial review. Alerted by the Kenya authorities, World temporarily suspended its activities, and a police investigation ensued. The court case continued until the recent decision.
This ruling comes shortly after Indonesian officials took similar action against World. The Indonesian government accused World of breaking electronic system regulations and of operating unlawfully.
In short, the ruling highlights Kenya's strict enforcement of its Data Protection Act, especially for technologies dealing with sensitive biometric data. World and other international tech firms planning to collect or process such high-risk personal data in Kenya must comply with local data protection regulations and secure legitimate consent without the use of incentives like cryptocurrency. This case underscores Kenya's increasing regulatory focus on data privacy, particularly in relation to new technologies and biometric data collection practices.
The court's decision mandates World and its agents to delete any collected biometric data in Kenya within seven days, under the supervision of the Data Protection Commissioner, as they failed to perform a proper Data Protection Impact Assessment. This ruling underlines Kenya's strict enforcement of its Data Protection Act, requiring international tech firms to comply with local data protection regulations and secure legitimate consent without cryptocurrency incentives when dealing with high-risk personal data, especially biometric data.
