If you are an occasional user of social media platforms, you must have recently come across viral AI caricatures that portray people as cartoon characters and animated versions of their professions. With only a selfie and
a short prompt, AI tools can generate creative portraits depicting a person’s lifestyle, profession, and personality within seconds.
In Kenya, the issue has already drawn the attention of the Office of the Data
ProtectionCommissioner (ODPC). The Data Protection Commissioner, Immaculate Kassait, has cautioned Kenyans against casually sharing personal images with AI platforms without understanding how such data
may be stored, processed, or reused. These warnings are part of a broader data protection concerns in emerging technologies, which concerns were recently discussed by the High Court in the famous Worldcoin case; Republic v Tools for Humanity Corporation (US) & 8 others; Katiba Institute & 4 others (Exparte Applicants); Data Privacy & Governance Society of Kenya (Interested Party) (Judicial Review Application E119 of 2023) [2025] KEHC 5629 (KLR) (Judicial Review)
The Data Privacy Risks Behind the Trend The viral “AI caricature” trend poses several privacy concerns.
First, personal photographs and selfies constitute biometric identifiers. Your facial features can uniquely identify you, making them sensitive data under the Data Protection Act, 2019. As such, the AI companies, as data controllers, must obtain informed consent for such sensitive data.
Additionally, most of these AI companies operate across different jurisdictions that operate under different data protection laws, raising issues with-cross-border transfers.
The World Coin Case
Kenyan courts have already had the opportunity to develop sound jurisprudence on Data Protection in the face of emerging technologies in Republic v Tools for Humanity Corporation (US) & 8 others;
Katiba Institute & 4 others (Exparte Applicants); Data Privacy & Governance Society of Kenya (Interested Party) (Judicial Review Application E119 of 2023) [2025] KEHC 5629 (KLR) (Judicial Review).
While the facts of this case concerned different technologies and systems, the principles articulated by the High Court have broader implications for emerging technologies that rely on personal and biometric data including the now-popular AI caricature trends circulating on social media.
The Worldcoin case arose following the launch of the Worldcoin initiative, which sought to create a
global digital identity system through the collection of biometric data using a device known as the “Orb.” The device scanned individuals’ irises and facial features in exchange for cryptocurrency tokens.
Civil society organisations challenged the project before the High Court, arguing that the mass collection of biometric data violated Kenya’s constitutional and statutory data protection framework. In its decision, the High Court found that the entities involved had failed to comply with key requirements under the Data
Protection Act 2019. The High Court’s reasoning in the Worldcoin decision provides an important framework for evaluating such practices. The judgment set out several principles that are equally relevant in the context of the said AI caricature trend.
1. The processing of biometric data must occur within a clearly defined legal framework. Under the Data Protection Act 2019, entities that collect and process personal data must be properly registered as data controllers or processors and must demonstrate compliance with the obligations imposed by
the law.
2. Organisations that process sensitive personal data are expected to conduct Data Protection Impact Assessments where technologies pose potential risks to individuals’ privacy. AI platforms that analyse facial images could, in certain instances, fall within this category.
3. The issue of valid consent remains central. The Court in the Worldcoin case emphasised that consent must be free, informed, and specific. Where users upload personal data without a clear understanding of how it may be stored, analysed, or used to train AI systems, questions may arise as to whether such consent is actually informed consent.
4. Finally, the judgment also raised concerns regarding cross-border data transfers, especially where personal
data collected in Kenya may be stored or processed in foreign jurisdictions. Likewise, most of these AI companies are based outside of Kenya’s jurisdiction.
An interesting sidenote to this controversy is that the Worldcoin project was co-founded by Sam Altman, who also serves as the Chief Executive Officer of OpenAI, the organisation behind ChatGPT, the AI tool which most people use to generate such caricatures.
Conclusion
AI is here to stay, and as technology continues to evolve, both regulators and users must remain keen to ensure that technological advancements do not come at the expense of fundamental privacy rights. So far, the Office of the Data Protection Commissioner is doing a commendable job through its regular sensitization of the public regarding broad issues concerning data protection.
Add a Comment