Nairobi, Kenya – The High Court of Kenya Wednesday heard submissions from ICJ Kenya,Katiba Institute, and the Office of the Data Protection Commissioner (ODPC) in the ongoing case against Worldcoin and its affiliated entities.
The case revolves around allegations that Worldcoin has violated the rights of Kenyans by improperly collecting, processing, and transferring sensitive biometric data without conducting a mandatory Data Protection Impact Assessment (DPIA) or securing informed consent from users.
Worldcoin, a cryptocurrency and digital identity initiative, entered the Kenyan market by offering cryptocurrency valued at approximately USD 55 in exchange for users’ immutable biometric data, including iris scans and facial recognition.
However, the project has been accused of failing to comply with Kenya’s data protection laws and international best practices, exposing citizens to potential risks associated with data privacy and security.Among the critical concerns raised in court was Worldcoin’s failure to conduct a DPIA before launching its biometric data collection program.
A DPIA is essential in identifying and mitigating privacy risks, yet its absence in this case has left Kenyans susceptible to potential data breaches, identity theft, and the misuse of their biometric information.
Additionally, the cross-border nature of Worldcoin’s operations, spanning multiple jurisdictions such as the Cayman Islands (Worldcoin Foundation), the Virgin Islands (World Assets Ltd), and Kenya (Platinum De Plus), has led to significant challenges in enforcing Kenya’s data protection laws.
Another key issue presented to the court was the immutable nature of biometric data.
Unlike passwords or credit card numbers, which can be changed if compromised, biometric identifiers such as iris scans and facial recognition data remain permanent. This raises concerns over the long-term security of individuals’ personal data and the risks associated with unauthorized access or cybercriminal activity.
Worldcoin’s practices have also come under scrutiny from international regulatory bodies. Spain temporarily banned the company’s iris data collection in March 2024, while Brazil imposed a similar ban in January 2025.
Other jurisdictions, including Portugal, Germany, and Hong Kong, have raised regulatory concerns, and South Korea fined Worldcoin in September 2024 for transferring sensitive data without proper consent. In December 2024, Germany ordered the deletion of non-compliant data, further highlighting the global regulatory pressure on the cryptocurrency entity.
The petitioners in the case have requested several actions from the High Court, including an immediate prohibition on Worldcoin and its associates from collecting, processing, or using biometric data in Kenya unless a proper DPIA is conducted in accordance with legal requirements.
They have also urged the court to nullify previous decisions regarding biometric data collection that failed to meet DPIA standards, as well as to order the deletion of all biometric data collected without informed consent or proper legal compliance.
In addition, the petitioners are calling for the development of clear guidelines on the commercial use of personal data in Kenya. They have requested the court to direct the Cabinet Secretary and the Data Protection Commissioner to publish comprehensive guidelines within the next 12 months to ensure stronger regulatory oversight and enforcement of data protection laws.
The Worldcoin case underscores the urgent need for robust data protection frameworks in Kenya. As digital technology continues to evolve, safeguarding the privacy and rights of citizens remains a pressing concern. ICJ Kenya has reiterated its commitment to advocating for accountability, transparency, and the rule of law in an increasingly digital world.
The High Court is expected to deliver its judgment on this matter in open court on May 5, 2025.
