JUDICIAL REVIEW APPLICATION NO E119 OF 2023
IN THE MATTER OF: ARTICLES, 10, 21(1), 22, 23, 28, 31, 47 AND 258 OF THE
CONSTITUTION OF KENYA 2010
AND
SECTION 18, 31 AND 32 OF THE DATA PROTECTION ACT, 2019
AND
THE DECISION TO COLLECT BIOMETRIC DATA (IRIS SCAN) WITHOUT A
DATA PROTECTION IMPACT ASSESSMENT AND BY CONSENT INDUCED
BY THE PROMISE OF A CRYPTOCURRENCY
BETWEEN
REPUBLIC……………………………………………………………………………………….APPLICANT
VERSUS
TOOLS FOR HUMANITY CORPORATION (US)….……………………..…………1ST RESPONDENT
TOOLS FOR HUMANITY GmbH…………………………………………………………2ND RESPONDENT
WORLDCOIN FOUNDATION (CAYMAN ISLANDS)………………………….….3RD RESPONDENT
WORLD ASSETS LIMITED (BRITISH VIRGIN ISLANDS)………………..….4TH RESPONDENT
PLATINUM DE PLUS LTD………………………………………………………….……5TH RESPONDENT
DATA PROTECTION COMMISSIONER…………………………………………….6TH RESPONDENT
CABINET SECRETARY, MINISTRY OF INFORMATION, COMMUNICATION
AND THE DIGITAL ECONOMY….…………………………………………………….….7TH RESPONDENT
COMMUNICATIONS AUTHORITY………………………………………………..…….8TH RESPONDENT
CENTRAL BANK OF KENYA……………………………………………….……………..9TH RESPONDENT
KATIBA INSTITUTE ………………………………………………………………….1ST APPLICANT
LAW SOCIETY OF KENYA……………………………………………..….….…….2ND APPLICANT
KENYA HUMAN RIGHTS COMMISSION………………………………….…..3RD APPLICANT
INTERNATIONAL COMMISSION OF JURISTS (KENYA)………………….4TH APPLICANT
AFRICAN CENTER FOR OPEN GOVERNANCE………………………….…….5TH APPLICANT
DATA PRIVACY & GOVERNANCE SOCIETY OF KENYA……………………………INTERESTED PARTY
STATUTORY STATEMENT
INTRODUCTION
[1] This application concerns Worldcoin’s venture to unlawfully collect, process, or transfer biometric data (iris scans and facial recognition) in Kenya: (i) without undertaking (or using an inadequate) Data Protection Impact Assessment; (ii) without registering as a “data processor” or “controller”; (iii) using consent obtained by inducement of a cryptocurrency—Worldcoin (approximately worth Kshs 7,000/= or 50 USD); and (iv) without the Communication Authority’s type approval of the Orb.
[2] Applicants also question the omission by the Cabinet Secretary (in consultation with the Data Commissioner) to prescribe practice guidelines for commercial use of personal data, by entities like Worldcoin, under section 37(3) of the Act.
FOUNDATIONAL FACTS
[15] Registered as a data controllers in Kenya, Tools for Humanity is headquartered in San Francisco, California (U.S. corporation) and Erlangen, Germany (GmbH) serve as “advisors to the Worldcoin Foundation and World Assets Ltd who operate the World App”.
[16] On the other hand, Worldcoin Foundation (registered in the Cayman Islands) holds the patents to the Orb technology, owns all user data, and issues all Worldcoin token (through a subsidiary World Assets Ltd registered in the British Virgin Islands.
[17] Tools for Humanity shares personal data with Worldcoin Foundation and World Assets Ltd. But neither Worldcoin Foundation nor World Assets Ltd is registered as a data processor or controller in Kenya.
[18] Collectively, the Worldcoin entities own and operate: World ID described as “first technology to prove” one is a real and unique person using their iris pattern; a cryptocurrency token Worldcoin distributed by Worldcoin Foundation (through a
subsidiary World Assets Ltd) to everyone for verifying at an Orb; and World App an “app that enables payment, purchases, and transfers using Worldcoin, digital assets, and traditional currencies”. The Worldcoin entities collect biometric data using “The Orb” an open-source hardware device that captures and processes ones image and their unique iris pattern.
[19] They aim to build the “world’s largest identity and financial network” by scanning biometric data and using it to generate and store a unique code to identify one individual from the next. The iris and facial images scanned through the Orb is processed for machine learning on an Amazon web service cloud infrastructure.
[20] In July 2023, without undertaking (or using an inadequate) Data Protection Impact Assessment, the 1st and 2nd Respondents began collecting biometric data by scanning irises of the Kenyan public using the Orb.
[21] First, Wordcoin did not seek or the Communications Authority give type approval or type acceptance of the Orb used to collect biometric data by scanning faces and irises.
[22] Second, although data consent must be express, unequivocal, voluntary, free, specific, and informed under the Act and Regulations, Respondents unlawfully obtained consent by inducement of a cryptocurrency—Worldcoin (approximately worth Kshs 7,000/= or 50 USD). Contrary to Regulation (4)(b) of the Data Protection General Regulations 2021 the inducement of a cryptocurrency—Worldcoin was a non-negotiable part of the terms and conditions for processing.
[23] Third, although Worldcoin Foundation holds the patents to the Orb technology, owns all user data, and issues all Worldcoin token (through a subsidiary World Assets Ltd (British Virgin Island), none of these two entities registered as a data processor in Kenya. Besides, Tools for Humanity Corporation did not disclose to the Kenyan public the roles of these entities in processing the biometric data collected from Kenya. Still, Tools for Humanity shares personal data with Worldcoin Foundation and World Assets Ltd.
[24] Fourth, the Applicants query the omission by the Cabinet Secretary (in consultation with the Data Commissioner) to prescribe practice guidelines for commercial use of personal data, by entities like Worldcoin, under section 37(3) of the Act.