Worldcoin saga: MPs demand answers on fate of Kenyans' personal data
A man is helped scan his iris to create identification codes as part of the requirement while registering as a member of the new Worldcoin cryptocurrency at KICC Nairobi on August 1, 2023.
For the third time this month, Interior Cabinet Secretary Kithure Kindiki and his Information and Digital Economy colleague Eliud Owalo will face Members of Parliament over the Worldcoin saga, with the lawmakers calling on the government to come clean on seven questions that remain unanswered.
The two Cabinet Secretaries are expected to appear before the whole House on Wednesday as MPs push for answers to questions that the government is yet to clarify regarding the activities of the company.
Among the questions MPs want the two Cabinet Secretaries to provide clarification is the whereabouts of the personal information collected from Kenyans so far.
The lawmakers are concerned that the processing of vital information might be ongoing in a distant country as Kenyan authorities focus on investigations.
“I checked the website of this company and found that it has been pulled out. Could it be that the firm has already achieved what it wanted? And where is the data collected from Kenyans?” asked Manyatta MP Gitonga Mukunji.
Though Prof Kindiki informed the House that the government has preservation orders barring the company from processing the data, lawmakers insisted that they want to know where the information has been stored and whether it has already been sent to a foreign country.
The two Cabinet Secretaries are also expected to provide information on the number of Kenyans who turned out for their irises to be scanned in exchange for cryptocurrency tokens valued at approximately Sh7, 000.
Gilgil MP, Martha Wangari, urged the two ministers to provide information on the number of eyeballs that have been scanned to date, where the data is stored and provide assurances and proof that the data collected has not been processed.
Prof Kindiki and Mr Owalo are also to clarify to the House who authorised the company to use Kenyatta International Convention Centre (KICC), a government facility under round-the-clock security.
None other than National Assembly Speaker, Moses Wetang’ula, called for clarification from the two Cabinet Secretaries on how and why the company got permission to conduct its activities at the KICC, Nairobi.
“These members are asking for simple clarification. For instance, the KICC is a government facility so who authorised the company to use it?” Speaker Wetang’ula asked.
Many lawmakers expressed fear that there could be a foreign entity interested in critical data from Kenya and could be using Worldcoin for the mission.
They say the two ministers need to come clean on which foreign country could be interested in Kenya’s data.
“We have been informed that we cannot access some data because the servers are in the clouds somewhere in France. Because of this, Kenya must take this matter seriously. Are there foreigners interested in our data?” asked Ugenya MP David Ochieng in reference to the Independent Electoral and Boundaries Commission.
Coming in the wake of an attempt to hack the e-citizen platform that affected nearly 5,000 government services, MPs also raised questions on the safety of the country’s digital space and want assurance from the two ministers on Wednesday.
The launch
Prof Kindiki and Mr Owalo have also been directed by Parliament explain how Worldcoin was registered and whether the process was procedural as prescribed in the Foreign Company Registration Act.
“If this is a foreign company, was it registered properly? If not, there are consequences which should be applied as prescribed in law,” Homa Bay Town MP Peter Kaluma said.
According to Mr Owalo, the government registered Worldcoin as a data controller, pursuant to the Data Protection Act, 2019 and the Data Protection Registration of Data Controllers and Data Processors Regulation, 2021 (Registration Regulations).
As compliance obligation, entities processing data should be registered with the office.
The minister added that an application for a certificate of registration only signifies that the entity has complied with section 18 and 19 of the Act and does not endorse the entity’s compliance with the Data Protection Act or its subsidiary regulations, nor is it a valid licence for an organisation to operate in Kenya.
It does not also authorise the operations of an entity in Kenya.
He said the Office of the Data Protection Commissioner learnt that the company had set up booths across the country to scan the irises of interested Kenyans on April 19, 2022.
That was in anticipation of the launch of the company’s cryptocurrency, which happened last week.
The Office of the Data Protection Commissioner commenced assessment of the organisation in May last year.
In the course of its assessment, the office suspended the operations of Worldcoin in May 2022 for 60 days to ascertain the lawful basis and safeguards adopted by the company.
Mr Owalo said the Office of Data Protection later learnt that Worldcoin had started collecting vital information from Kenyans and ordered it to cease the activity.
