The Office of the Data Protection Commissioner (ODPC) issued a determination on Tuesday regarding the operations of WorldCoin within the country. In the 34-page decision, the ODPC held Tools for Humanity Corporation (TFH) and Tools of Humanity GmBH, the companies behind WorldCoin in Kenya, accountable for violating Kenya’s Data Protection Act and its associated regulations.
According to the ODPC, whereas Tools for Humanity Corporation had fulfilled the requirements and was duly registered as a data controller in April 2023, WorldCoin Foundation—which assumed the operations of TFH in late July—had not. Consequently, WorldCoin Foundation in breach of Section 18(1) of the Data Protection Act for collecting personal data from individuals without proper registration.
The ODPC also raised concerns over WorldCoin’s failure to submit a Data Protection Impact Assessment (DPIA). The ODPC emphasized that WorldCoin should have either independently submitted a DPIA upon taking over TFH’s operations or demonstrated to the Data Commissioner that TFH’s DPIA adequately covered similar operations, risks and organizational measures as those of WorldCoin.
Furthermore, the ODPC identified issues related to consent, asserting that TFH and WorldCoin had not acquired express, unequivocal, free, specific and informed consent from the public before collecting their personal data. According to the ODPC, this was in violation of Section 32 of the Data Protection Act.
The ODPC also assessed the transfer of personal data by WorldCoin and TFH outside Kenya in relation to Data Protection Act regulations, and stated:
This Office finds that the transfer of Kenyan data subject’s sensitive personal data out of Kenya was unlawful as the consent was invalid. Additionally, TFH and Worldcoin did not obtain confirmation of appropriate safeguards from this Office, contrary to Section 49(1) of the Act, for purposes of the sensitive personal data being transferred out of Kenya.
The ODPC’s decision follows a parliamentary committee report aiming to halt WorldCoin’s operations within the country. The report highlighted that WorldCoin continued its operations even after the High Court had issued preservation orders in September. The ODPC also previously warned citizens from getting involved with WorldCoin, citing the identity cryptosystem’s failure to comply with data protection requirements.
The ODPC has issued an enforcement notice against TFH, Tools of Humanity GmBH and WorldCoin Foundation for their violations of data protection provisions within the Data Protection Act.
