This study critically examines the operations of World Coin in Kenya, with particular attention to its collection of sensitive biometric data such as retinal scans, facial recognition, and fingerprints in exchange for monetary incentives. It explores the legal, ethical, and regulatory challenges that arise from this practice, focusing on Kenya’s Data Protection Act (2019), the Computer Misuse and Cybercrimes Act (2018), and constitutional safeguards on the right to privacy. The research adopts a qualitative doctrinal methodology, drawing on statutory analysis, judicial interpretations, and scholarly literature to assess the extent of compliance with existing legal frameworks while identifying emerging gaps. The findings reveal that although Kenya has established comprehensive data protection and cybersecurity laws, there are significant loopholes in their application, coupled with weak institutional enforcement mechanisms. These shortcomings raise concerns about the adequacy of protections against potential misuse of biometric data, especially in the context of foreign entities engaging in large-scale data harvesting. Ethical risks also emerge, including issues of informed consent, exploitation of economically vulnerable populations, and the long-term implications of storing and transferring highly sensitive personal identifiers. The study highlights that without stringent oversight, there is a heightened risk of data breaches, surveillance misuse, and erosion of public trust in digital technologies. It concludes by underscoring the urgent need for stronger regulatory oversight, harmonised policy reforms, and enhanced public awareness campaigns to ensure that the collection and use of biometric data in Kenya aligns with fundamental rights and international best practices. Ultimately, the study contributes to ongoing debates on digital sovereignty, data protection, and ethical governance in the rapidly evolving digital economy.
Wainaina et al. (Thu,) studied this question.