World Court mandates Worldcoin to erase all biometric records
**Worldcoin's Biometric Data Collection in Kenya Found Illegal and Unsafe**
Worldcoin's operations in Kenya have been deemed illegal and unsafe by the Kenya High Court, following allegations of non-compliance with data protection regulations.
The court ordered Worldcoin to cease the processing of any biometric data it had collected, after finding that the company had failed to conduct a mandatory Data Protection Impact Assessment (DPIA), as required by Kenyan law. This assessment is crucial for processing high-risk data, such as biometric data.
Deputy data commissioner, Oscar Otieno, presented a sworn statement in court, affirming that Worldcoin's operations were found to be illegal and potentially unsafe for Kenyans. He argued that Worldcoin lacked proper accountability and transparency in handling the data it collects.
The court's ruling also questioned the validity of the consent obtained by Worldcoin through monetary inducements and cryptocurrency offers, stating that such practices are not compliant with Kenyan law.
In addition, concerns were raised about potential unauthorized third-party access to user data, further highlighting the need for stricter data protection measures.
The presiding judge, Justice Rosen Abili, commanded Worldcoin to delete all the data it had collected, with the Office of the Data Protection Commissioner (ODPC) overseeing the deletion process.
Worldcoin's license to collect personal data was later revoked by lawmakers, who argued that the company exploited loopholes in Kenya's data protection laws to operate without proper oversight.
This case serves as a reminder of the importance of adhering to data protection regulations, particularly when dealing with sensitive personal data like biometric information. The ruling emphasizes the need for transparency, accountability, and compliance with legal requirements when handling such data.
[1] Data Protection Impact Assessment: A guide for organisations - Office of the Data Protection Commissioner, Kenya. Available at: https://www.odpc.go.ke/wp-content/uploads/2021/06/DPIA-Guide-for-Organisations.pdf [5] Kenya Data Protection Act 2019: Consent - Office of the Data Protection Commissioner, Kenya. Available at: https://www.odpc.go.ke/wp-content/uploads/2021/06/Consent-Regulations-under-the-Data-Protection-Act-2019.pdf
The court's ruling questions the legitimacy of Worldcoin's practice of offering cryptocurrency in exchange for consent, which is not compliant with Kenya's law. Moreover, the failure of Worldcoin to conduct a Data Protection Impact Assessment (DPIA) on their blockchain technology, as required by the Kenyan law, raises concerns about the security and privacy of data collected.
