Months before Kenya finally banned iris scans by Sam Altman’s crypto startup Worldcoin, the Office of the Data Protection Commissioner (ODPC) had ordered its parent company, Tools for Humanity, to stop collecting personal data.

The ODPC had in May this year instructed the crypto startup to stop iris scans and the collection of facial recognition and other personal data in Kenya, a letter sent to Worldcoin and seen by TechCrunch shows.

Tools for Humanity, the company building Worldcoin, did not stop taking biometric data until early this month when Kenya’s ministry of interior and administration, a more powerful entity, suspended it following its official launch. Worldcoin’s official launch led to a spike in the number of people queuing to have their eyeballs scanned in exchange for “free money” drawing the attention of authorities.

The letter shows that ODPC had instructed Worldcoin to cease collecting data for intruding individuals’ privacy by gathering biometric data without a well-established, and compelling justification. Further, it said Worldcoin had failed to obtain valid consent from people before scanning their irises, saying its agents failed to inform its subjects about the data security and privacy measures it took, and how the data collected would be used or processed.

“Your client is hereby instructed to cease the collection of all facial recognition data and iris scans, from your subscribers. This cessation should be implemented without delay and should include all ongoing and future data processing activities,” said Rose Mosero, in a letter to Tools for Humanity that outlined the concerns. The letter, addressed to Ariana Issaias of Coulson Harney (Bowmans), the law firm representing the crypto startup, also restricted Worldcoin from processing the collected data further, and instructed the safe storage of collected information.

Details of ODPC’s attempt to stop the collection of biometric data have emerged in a new petition filed before the High court by the data protection authority.

The deputy data commissioner of compliance, Oscar Otieno, in an affidavit filed in court in August, said that it started the “assessment” of the respondents (Tools for Humanity and Sense Marketing Limited) in 2022. In May this year, it carried out further inquiry on their processing activities and directed that they cease processing sensitive personal data immediately.

“The applicant (ODPC) is aware that despite the suspension and directive to cease processing of personal data, the respondents continued to process the said personal data. It took the public directive by the cabinet ministry of interior and coordination to halt the operations of the respondents (Tools for Humanity and Sense Marketing,” said Otieno in the affidavit.

The ODPC sought court’s help to have Worldcoin compelled to preserve the data it collected from Kenyans, as it finalizes (the multi-agency) investigations around security, privacy, and the legality of use of “financial incentive” to obtain biometric data.

The high court has since the filing of the petition barred Worldcoin from collecting data from Kenyans, and directed it, its agents, representatives and employees to preserve all information collected locally from April 19 to August 8.

This has emerged after Worldcoin activities were suspended in Kenya on August 2, by Kithure Kindiki, the country’s cabinet secretary for interior and national administration. Kindiki said the ban will remain in place until the authorities determine “the absence of any risks to the general public whatsoever.”

“Relevant security, financial service and data protection agencies have commenced inquiries and investigations to establish the authenticity and legality of the aforesaid activities, and the safety and protection of the data being harvested, and how the harvesters intend to use the data,” said Kindiki.

Worldcoin claims to be creating a new “human identity (World ID) and financial network” through iris scans done by “Orb”, the company’s spherical scanners to “verify your World ID”, and its own cryptocurrency “WLD”.

Kenya was one of the first countries where Worldcoin launched sign-ups, and had been one of the biggest markets for take-up. After the global official launch at the end of July, locals who had received the tokens could sell them for USDT (the stablecoin pegged to the U.S. dollar) on crypto exchanges, or to “brokers” in exchange for cash. In Kenya, that promise of “free money” quickly spread across the country, leading to an influx of people at the recruitment (Orb) stations, which drew the attention of top government officials, leading to the suspension of Worldcoin iris scans. The crypto startups said it hopes to resume activities in Kenya soon.

Alongside the many issues that skeptical peers in the technology industry have been raising about the Worldcoin project and its bigger business ambitions, there are growing concerns about how those efforts to build a biometric database using the promise of free cryptocurrency have exploited economically disadvantaged people. Also, some of these issues have been there in plain sight. An MIT Technology Review investigation — published last year — found that it “used deceptive marketing practices, was collecting more personal data than it acknowledged, and failed to obtain meaningful informed consent.”