The High Court held that the collection and processing of Kenyans' iris and facial biometric data by the Worldcoin entities through the "Orb" device contravened the Data Protection Act 2019: consent procured by inducement of cryptocurrency tokens was not valid consent, and the operators had failed to conduct an adequate Data Protection Impact Assessment as required by section 31. The court granted certiorari quashing the processing, mandamus compelling permanent deletion of all biometric data within seven days under the Data Commissioner's supervision, and prohibition restraining further biometric processing absent a lawful DPIA.

The first Kenyan superior-court judgment to apply the Data Protection Act 2019 to mass biometric processing by a global technology operator, and among the first on the continent to order blanket deletion of unlawfully collected biometric data. It establishes two propositions of continental importance: that consent induced by financial reward is vitiated, and that a Data Protection Impact Assessment is a mandatory legal precondition, not a procedural afterthought, for high-risk biometric processing. The ruling has become a touchstone for data-sovereignty arguments and for regulators confronting biometric-identity ventures.