Facts
The ex parte Applicants — Katiba Institute, Law Society of Kenya, Kenya Human Rights Commission, International Commission of Jurists – Kenya Chapter, and African Centre for Open Governance — challenged the data processing activities of Worldcoin and its affiliates in Kenya. The case was triggered by Worldcoin’s collection of biometric data (especially iris scans) from Kenyan residents using an "Orb" device in exchange for cryptocurrency (WLD tokens). The Applicants argued that this was done:
Without a valid and adequate Data Protection Impact Assessment (DPIA);
Without proper registration as data controllers or processors;
Without free, specific, and informed consent from users;
And in violation of the Data Protection Act, 2019, and the Constitution of Kenya.
The Respondents included Worldcoin-affiliated entities and several state regulators such as the Data Protection Commissioner, the Cabinet Secretary for ICT, the Communications Authority, and the Central Bank of Kenya.
Issue
Whether the Applicants had locus standi to bring the claim as non-data subjects.
Whether judicial review remedies could be issued against private entities.
Whether Worldcoin’s data collection and processing activities violated Kenyan data protection laws.
Whether the doctrine of exhaustion of administrative remedies applied in the case.
Whether reliefs sought (including erasure of data and regulatory reforms) could be granted.
Rule
The case was primarily determined under:
Data Protection Act, 2019;
Fair Administrative Action Act, 2015;
Constitution of Kenya, Articles 22, 31, 47, and 258;
Data Protection (General) Regulations, 2021;
Data Protection (Registration of Data Controllers and Processors) Regulations, 2021.
Analysis
The court found that:
Locus standi: Even though the Applicants were not individual data subjects, they were acting in the public interest under Articles 22 and 258 of the Constitution. The internal redress mechanism at the Office of the Data Protection Commissioner (ODPC) was not available to them since it was limited to data subjects (i.e. identifiable natural persons).
Exhaustion doctrine: The court held that the doctrine did not apply, as the Applicants could not access the ODPC process.
On the merits: The court found that Worldcoin entities, including Tools for Humanity US and GmbH, violated the law by:
Collecting sensitive biometric data without an adequate DPIA as required under Section 31 of the Data Protection Act.
Using induced consent via cryptocurrency rewards, which is not considered freely given consent under the Act and Regulations.
Transferring data cross-border without safeguards or proper registration as data processors or controllers.
Engaging agents like Platinum De Plus, who acted as unregistered processors.
The Office of the Data Protection Commissioner (ODPC) had already initiated enforcement action, including cancellation of registration certificates for some Worldcoin entities, but the court found additional judicial intervention necessary to protect public interest and uphold the Constitution.
Holding / Outcome
The court granted the following orders:
Prohibition: Restrained the 1st to 5th Respondents from further collection, processing, or transfer of biometric data unless compliant with the Data Protection Act.
Certiorari: Quashed Worldcoin’s prior data collection decisions made in violation of the law.
Mandamus: Ordered the Data Protection Commissioner to consider revoking registration certificates obtained through misrepresentation or failure to disclose.
Guidance Order: Directed the Cabinet Secretary and Data Commissioner to issue clear guidelines on the commercial use of personal data within 12 months.
However, the court declined to order permanent deletion or destruction of the collected data, citing lack of statutory framework and potential prejudice to ongoing investigations.