The Data Protection Commissioner’s office failed to conduct proper due diligence before granting registration to Worldcoin’s activities within the country, as stated by ICT Cabinet Secretary Eliud Owalo during his presentation to Parliament on Monday.
The ICT Minister expressed his concerns about the Data Commissioner’s decision to overlook serious warning signs regarding Worldcoin, a company that began its operations in the country in 2021.
When addressing the National Assembly Ad-hoc Committee on Worldcoin, Owalo questioned the reasoning behind the Data Protection Commissioner’s decision to register the foreign company despite prior recommendations for its suspension.
While testifying before the committee chaired by Gabriel Tongoyo, MP for Narok West, the Cabinet Secretary emphasized that his ministry operates independently from the Data Protection Commissioner’s office.
Referring to a directive issued by the Data Protection Commissioner on June 23, which instructed Worldcoin to cease the collection of sensitive personal data from Kenyans, Owalo found it perplexing that the same company was later registered, even though it hadn’t addressed the concerns raised by the Data Protection Commissioner. These concerns encompassed the collection of sensitive personal data, consent for transferring personal data, and the submission of an impact assessment report by Worldcoin. Additionally, the Data Protection Commissioner had raised questions regarding the legal basis for Worldcoin’s activities in the country.
Despite these concerns, the Data Protection Commissioner proceeded to register Tools for Humanity (Germany) on September 15 of the previous year. The commissioner also issued a registration certificate to Tools for Humanity USA on April 18, both valid for two years. Owalo pointed out that the Data Protection Commissioner disregarded significant concerns that could have prevented the controversial activities that are now the subject of inquiry by a parliamentary committee.
Owalo stated, “Despite the Data Protection Commissioner directing Worldcoin to cease operations in Kenya in June 2022 due to noncompliance with the Data Protection Act (2019) and dissatisfaction with the Data Protection Impact Assessment submitted by Worldcoin, the Data Protection Commissioner still proceeded to register Worldcoin as a Data Controller in 2023, even when the cessation order against them had not been lifted.”
Furthermore, he mentioned that despite the Data Protection Commissioner instructing Worldcoin to suspend their operations within 60 days on June 23, 2022, the Data Protection Commissioner issued a registration certificate to Worldcoin.
Owalo was challenged to clarify his previous statements that Worldcoin’s activities were voluntary and that the company was operating legally within the country. In response, he defended his position, explaining that while Worldcoin was indeed registered by the Office of the Data Protection Commissioner, the registration certificate did not grant the company a license to disregard industry regulations.
He also noted that he had established a working group on sectoral reforms to evaluate the entire policy, legal, and regulatory framework and recommend necessary reforms to address gaps and align with emerging realities.
