On August 2, 2023, the Office of the Data Protection Commissioner (ODPC) and the Communications Authority of Kenya (CA) issued a joint statement on LinkedIn announcing the suspension of Worldcoin Foundation's data collection activities due to several regulatory concerns. 

Background to the decision

On July 28, 2023, the ODPC announced that Worldcoin was collecting sensitive personal data including iris data and, as such, the ODPC had begun an assessment of the data processing activities of Worldcoin to ensure compliance with the Data Protection Act, 2019 (the Act). 

Findings of the ODPC 

The OPDC noted that the preliminary assessment had revealed the following regulatory issues: 

• lack of clarity on the security and storage of collected sensitive personal data, such as facial images and retina scans; 
• obtaining data subjects' consent in exchange for money reward, which borders on inducement; 
• lack of clarity on consumer protection with regard to cryptocurrency; 
• inadequate information on cybersecurity safeguards and standards; and 
• large amount of citizen data in the hands of a private entity without an appropriate framework. 

Outcomes 

The ODPC stated that, following the preliminary findings, a comprehensive investigation into Worldcoin is ongoing. Consequently, the ODPC directed Worldcoin to stop its data collection activities in Kenya until further notice. 

In addition, the ODPC invited members of the public to submit information or complaints about Worldcoin to the CA or the ODPC, here and here respectively. 

You can read the statement here.