Data Protection Agencies in Kenya and Argentina Investigate Worldcoin

In recent developments, data protection authorities in Kenya and Argentina have launched investigations into Worldcoin's biometric enrollment process. The authorities are scrutinizing whether Worldcoin's operations comply with their respective national data protection laws, particularly in regard to the collection and use of biometric data.

Kenya's Data Protection Investigation

Kenya's Office of the Data Protection Commissioner (ODPC) has taken action against Worldcoin. The ODPC began assessing Worldcoin's practices in May of 2022. It is concerned that Worldcoin might alter, erase, or further process the collected data, including iris and face biometrics, in ways that could violate Kenya's Data Protection Act. To address these concerns, the ODPC issued a directive to Worldcoin to suspend its operations. When the company did not comply, the Ministry of Home Affairs intervened to halt Worldcoin's enrollments.

Deputy Data Commissioner Oscar Otieno emphasized the importance of preserving personal data to ensure thorough investigations and protect individuals from potential data loss or unauthorized use.

Argentina's Data Protection Inquiry

Similarly, Argentina's Agency for Access to Public Information (AAIP) has initiated an investigation into Worldcoin's handling of protected personal data. The AAIP aims to determine whether Worldcoin adheres to the security measures outlined in Argentina's Protection of Personal Data law, which governs the collection, storage, and usage of personal data. The AAIP has noted the collection of biometric data by Worldcoin in multiple provinces of Argentina.

The law in Argentina mandates that organizations collecting sensitive data, including biometrics, must provide transparent and accessible information about the purpose of data collection and use.

The AAIP has posed a series of questions to Worldcoin, seeking information about its compliance with data protection laws, the execution of a data protection impact assessment, the purpose of biometric data collection, and the company's expansion plans.

Implications and Next Steps

Both Kenya and Argentina are taking these actions to ensure the safeguarding of personal data and to assess whether Worldcoin's biometric enrollment practices are in line with their respective data protection regulations. The investigations underscore the growing importance of data privacy and the responsible use of biometric information.

As these investigations progress, it remains to be seen how Worldcoin will address the concerns raised by the data protection authorities in Kenya and Argentina. The outcomes of these investigations could have broader implications for how biometric data is collected, stored, and used by organizations in various countries.

Overall, these developments highlight the need for organizations to be diligent and transparent in their data collection practices, particularly when sensitive biometric information is involved, and to ensure that they comply with applicable data protection laws to protect individuals' privacy and rights.