High Court of Kenya (judicial review) v. Tools for Humanity / Worldcoin Foundation

Decided by

High Court at Nairobi (Milimani Law Courts)

Parties

Republic ex parte Katiba Institute & 4 others v. Tools for Humanity Corporation (US) & 9 others

Decision date

May 5, 2025

Remedy

The court issued orders of prohibition and certiorari quashing Worldcoin's decision to collect, process, or transfer biometric data in Kenya, and an order of mandamus compelling the respondents to permanently erase and destroy all unlawfully collected biometric data within 7 days under ODPC supervision.

Appeal

Appeal status not stated

Key holdings

1. Data controllers and processors must obtain valid registration before processing personal data.

   “Section 18 of the Data Protection Act requires that a data controller or processor must register with the Data Protection Commissioner (DPC) before processing personal data.” — paragraph 174

2. Consent obtained by offering monetary inducements in cryptocurrency fails to satisfy the legal standards for free, specific, and informed consent.

   “The consents purportedly obtained from data subjects was neither free, specific, nor informed as defined under section 2 of the Data Protection Act.” — paragraph 179

3. Constitutional rights and the Bill of Rights apply to and bind private actors as well as public authorities.

   “Article 20(1) & (2) on application of the Bill of Rights is clear that the Bill of Rights applies to all law and binds all persons, including private actors.” — paragraph 197

4. The court issued a mandatory order compelling the respondents to permanently destroy all collected biometric data under regulator supervision within seven days.

   “Judicial review order of Mandamus is hereby issued compelling the 1st to 5th respondents to, within 7 days of this order, permanently erase and destroy” — paragraph 207(c)

In plain English

In August 2023, Katiba Institute and four other civil society organizations filed a judicial review application against Tools for Humanity Corporation, Worldcoin Foundation, World Assets Limited, Tools for Humanity GmbH, and Platinum De Plus Limited in the High Court of Kenya at Nairobi. The applicants challenged Worldcoin's collection of biometric data from Kenyan residents using an Orb device, arguing that the operations violated the constitutional right to privacy and the Data Protection Act of 2019. Worldcoin offered monetary incentives in cryptocurrency worth approximately 7,000 Kenyan shillings or 50 United States dollars to induce residents to provide iris scans. In a judgment delivered on May 5, 2025, the High Court ruled in favor of the applicants. The court found that the respondents unlawfully collected and processed biometric data without proper registration as data controllers or processors, without conducting an adequate Data Protection Impact Assessment under section 31 of the Data Protection Act, and without obtaining valid informed consent. The court emphasized that financial inducements compromise the voluntary nature of consent and that private entities are bound by constitutional human rights obligations. Consequently, the court issued an order of certiorari quashing Worldcoin's decision to collect and process biometric data, an order of prohibition stopping further data collection or transfers, and an order of mandamus compelling the 1st to 5th respondents to permanently erase and destroy all collected biometric data within 7 days under the supervision of the Data Protection Commissioner.