The High Court has directed the Worldcoin Foundation to permanently delete biometric data collected from Kenyans, ruling that the data was obtained in violation of national data protection laws.
Justice Roselyne Aburili delivered the judgment following a petition by the Katiba Institute, which challenged the legality of Worldcoin’s collection and use of sensitive biometric information—including iris and facial scans—without conducting a mandatory Data Protection Impact Assessment (DPIA), as required by Kenya’s Data Protection Act of 2019.
The court further ruled that consent obtained from Kenyans through cryptocurrency incentives was unlawful, rendering the data collection invalid. It also nullified prior approvals that had allowed the company to process personal data, citing non-compliance with the law.
In a strong rebuke, the judge banned Worldcoin from conducting any future biometric data collection in Kenya without a valid DPIA and ordered the company to erase all previously collected data within seven days. The deletion is to be carried out under the supervision of the Data Protection Commissioner.
