Katiba Institute welcomes the High Court’s supervision of the deletion of all data unlawfully collected from Kenyans by Worldcoin, and commends the Office of the Data Protection Commissioner (ODPC) for ensuring full compliance with the Court’s orders.

This outcome affirms that the constitutional rights to privacy, dignity, and data protection are non-negotiable, and that no technology, however novel, operates above the law. The decision reinforces the authority of the Data Protection Act and the critical role of independent oversight in holding powerful actors accountable. It sends a clear message that consent, legality, and human rights must remain at the centre of digital innovation in Kenya.

In a judgment delivered on 5 May 2025, Lady Justice Aburili Roselyne allowed Katiba Institute’s Judicial Review Application challenging the collection, processing, and transfer of iris and facial images through the Worldcoin App and the Orb device. The Court issued an order of prohibition restraining the Worldcoin Foundation and its agents from further collecting, processing, or dealing in biometric data in Kenya without first conducting a lawful and adequate Data Protection Impact Assessment as required under section 31 of the Data Protection Act, 2019, or where consent is obtained through inducement by cryptocurrency. The Court also issued an order of certiorari quashing the decision by the Worldcoin Foundation and its agents to collect and process biometric data in Kenya without a proper Data Protection Impact Assessment and on the basis of consent obtained through inducement by cryptocurrency. In addition, the Court issued an order of mandamus compelling the Worldcoin Foundation and its agents to permanently delete, within seven days and under the supervision of the Data Protection Commissioner, all biometric data unlawfully collected in Kenya in violation of section 31 of the Data Protection Act, 2019 and through inducement by cryptocurrency.

This outcome affirms that the constitutional rights to privacy, human dignity, and data protection are non-negotiable, and that no technology—however novel or disruptive—operates above the law. The decision reinforces the authority of the Data Protection Act and the critical role of independent oversight in holding powerful corporate actors accountable, and sends a clear message that legality, meaningful consent, and respect for human rights must remain at the centre of digital innovation in Kenya.

Commenting on the deletion order, Katiba Institute’s Executive Director, Nora Mbagathi, said: “Globally, but especially in Africa, we are considered an extractable data source, abused for commercialisation and to further develop emerging, often discriminatory, technologies. The implementation of this judgment is a big step, also in the message it sends.”