Kenya: Issued ruling in ODPC investigation into Worldcoin operations in Kenya over data protection regulation

On 6 September 2023, the Office of the Data Protection Commissioner (ODPC) published its report on the investigation into Worldcoin's operations in Kenya. In July 2023, Worldcoin took over controller responsibilities from Tools For Humanity Corporation and Tools For Humanity GmbH (TFH) and initiated the collection of biometric data by scanning the irises of the Kenyan public. The company obtained consent for this data collection by offering a cryptocurrency called Worldcoin. However, Worldcoin did not register as a data processor or controller in Kenya. As a result of its investigation, the ODPC found that Worldcoin failed to register as a data controller and to conduct the required Data Protection Impact Assessment, that the consent obtained was not valid, and that the transfer of personal data out of Kenya was unlawful. The ODPC holds Worldcoin and TFH liable for violation of the Data Protection Act and issued enforcement notices. The ODPC also suspended TFH's operations in Kenya for 12 months from the date of the determination or until TFH complies with the ODPC's requirements.