All the Kenyan biometric data previously collected by Tools for Humanity (TFH) and linked to Worldcoin has been fully deleted.
Kenya’s Office of the Data Protection Commissioner (ODPC) issued a notice dated January 20 confirming the deletion as part of its ongoing mandate to “enforce Kenya’s Data Protection Act, 2019, and safeguard citizens’ personal information.”
“The Office of the Data Protection Commissioner (ODPC), established under the Data Protection Act, 2019, is mandated to oversee how personal data is processed in Kenya,” the ODPC statement read in part.
“Regarding the processing of Kenyans’ personal data by Tools For Humanity, we confirm that the Data Controller has deleted all biometric data previously collected from Kenyan citizens,” it added.
Tools For Humanity (TFH), linked to Worldcoin, collected iris scans and other biometric data from Kenyan citizens using Orb devices. The biometric data collected included Iris scans, which were captured using Orb devices to create a unique digital identifier for each participant, and facial images used in combination with iris scans to verify identity.
In exchange for giving their biometric data, participants received cryptocurrency.
Investigations later revealed that, despite being promoted as voluntary, the gathering and processing of this data did not adhere to Kenya’s Data Protection Act, 2019.
Since rewards for participation were thought to undermine the agreement’s voluntary nature, the ODPC found numerous legal violations, including the failure to get valid permission. Additionally, TFH failed to properly do a Data Protection Impact Assessment (DPIA), which is required by the Act.
The business also neglected to register affiliates, such the Worldcoin Foundation, as required by law and transmitted biometric data outside of Kenya without permission.
The Office of the Data Protection Commissioner (ODPC), which was created under the Data Protection Act, 2019, is in charge of collecting, storing, and processing personal data in Kenya, according to the data controller’s statement.
Its duties include protecting people’s privacy and making sure that the data protection standards specified in Section 25 of the Act are followed.