The Kenyan High Court issued an order directing Sam Altman’s World to stop processing, collecting, or handling biometric data until it completes a Data Protection Impact Assessment. The court also mandated the permanent deletion of biometric data previously gathered in Kenya without proper assessment within seven days.
The Kenyan High Court issued an order prohibiting Sam Altman’s World (formerly known as Worldcoin) from collecting, processing, or handling biometric data without first completing a Data Protection Impact Assessment. The same directive, which also restricted the organization from incentivizing users through the distribution of cryptocurrency, indicated that its actions were in violation of Section 31 of the Data Protection Act.
Worldcoin Found in Violation of Data Protection Regulations
The May 5 ruling marked a victory for the Katiba Institute, an advocacy group committed to defending the Kenyan constitution. The organization filed a challenge in August 2023 against World’s operations, specifically targeting the transfer of facial and iris data through the Worldcoin app and Orbs. The court upheld the Katiba Institute’s stance, reinforcing its firm opposition to World, even as the Kenyan government appeared to ease its position toward the company.
News reported in 2023 that Kenyan authorities took enforcement actions against World, suspending its operations after officials accused it of operating without proper licensing. After the shutdown, police carried out an investigation and later closed it, which then enabled World to resume its activities.
However, authorities officially concluded the investigation less than a year after the Kenyan High Court granted the Katiba Institute’s judicial review application.
The Katiba Institute stated that Kenyan Lady Justice Aburili Roselyne issued an order on May 5, giving World a seven-day deadline to delete user data it unlawfully collected.
An order of Mandamus compelling the Worldcoin Foundation and its agents to permanently delete (under the supervision of the Data Protection Commissioner) within seven days any biometric data collected in Kenya without undertaking (or using an inadequate) Data Protection Impact Assessment contrary to section 31 of the Data Protection Act, 2019 and by consent obtained through inducement of a cryptocurrency—Worldcoin.
The Kenyan High Court issued a ruling just days after Indonesia took similar action against the company, further intensifying the international regulatory pressure on World. In Indonesia, government authorities declared the company’s operations illegal, citing violations of electronic system implementation laws, including operating without proper registration and using another entity’s license.
