In a significant development in the realm of digital privacy, a high court in Nairobi suspended data processing for cryptocurrency project Worldcoin and its partners over the past week. The court’s directive is based on a grievance filed by the Kenya Data Protection Commissioner (DPC) which accused Worldcoin of unlawfully collecting large volumes of biometric data, infringing upon Kenyan data protection laws.
This initiated a halt of new biometric data processing until the case against Worldcoin is formally resolved. The order is also instructing the respondents to eliminate all existing data under DPC supervision. As a result, the DPC was directed to revoke the data control registration credentials of the primary and secondary respondents.
This action comes amidst allegations of misrepresentation and non-disclosure, which conflict with Section 19(2) of the Data Protection Act, as well as Regulations 5 and 16 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
Worldcoin operations were suspended by the government earlier in August due to concerns related to data protection and the overall legality of the project. The Data Protection Commissioner’s Office has advised citizens against engaging with the identity cryptosystem, given Worldcoin’s ostensible failure to comply with the data protection measures needed under the Data Protection Law.
The DPC has also expressed concerns about Worldcoin’s storage of biometric data like iris scans. Worldcoin has argued stating that the demand for Worldcoin’s verification services in Kenya has been immense, with thousands of individuals queued to secure a World ID.
Simultaneously, the National Assembly of Kenya has created a committee of 15 lawmakers to investigate Worldcoin’s activities. Results from this investigation are expected to be presented to the Parliament by September 28, 2023.
The stakes are high for both Worldcoin and Kenya, as the case represents a key intersection of digital privacy concerns and burgeoning cryptocurrency technology. The outcome could have far-reaching implications on how data privacy laws are enforced upon emerging digital platforms.