Owalo absolves himself over Worldoin, blames Data Commissioner, legal gaps

Information, Communication and Digital Economy cabinet secretary Eliud Owalo has denied any responsibility regarding the controversial and illegal collection of data belonging to Kenyans by digital company Worldcoin.

The CS who appeared before an Ad Hoc committee of the National Assembly set up to investigate the operations of Worldcoin in the country, said that his ministry was not responsible for the management and protection of data belonging to Kenyans.

Owalo instead said that such a responsibility was the mandate of the Office of the Data Protection Commissioner, effectively denying claims that his ministry was responsible for allowing Worldcoin to illegally collect and mine data from unsuspecting Kenyans.

The committee chaired by Narok West MP Gabriel Tongoyo had summoned Owalo to, among other things, shed light on the ministry’s level of awareness of the data harvesting activities, as well as any other legal and regulatory frameworks that should be put in place to avoid a repeat of similar situations.

Owalo in response, said that gaps in some of the existing laws were to blame for the conduct of the foreign company.

“It is a matter of profound concern to us, even as a ministry, that while Worldcoin started collecting data in public places in May 2021, this fact only became known to the ODPC in April 2022, almost a year later, and other government agencies thereafter towards the end of July 2023, after this became a matter of grave public concern.

“This calls for policy and institutional reforms to ensure that our surveillance and response, when necessary, is satisfactory,” said CS Owalo.

The CS, while referencing the Data Protection Act 2019, said agents acting in place of foreign companies to collect data from Kenyans are required to comply with all regulations. 

He added that information available to his office indicates that none of these companies that act on behalf of Worldcoin are registered by the ODPC.

“From what you are telling us, the regulations came into effect in July 2022, while in May 2021 these companies were already operational and mining data from Kenyans in malls, schools among other places, while there were no guidelines on how to do this? 

“How do you explain such a gap in our legal framework and was there any due diligence done in the issuance of their registration certificate?” asked Tongoyo.  

Of concern to the MPs, was the fact that registration with the ODPC requires one to register and conform with the regulations with the other institutions within whose purview a company intends to operate. 

And in this case, Worldcoin should have sought registration with the Registrar of Companies, as well as the Business Registration services, but failed to do this.

“I do not have any information that due diligence was undertaken in the registration and approval of the activities of Worldcoin and its subsidiaries in this operation. 

“This gap, largely informed our decision to set up a working group on sectoral reforms to review the entire policy, legal regulatory framework in the ministry and requisite reforms to address gaps and align to the new realities in our operating environment,” said Owalo.

The CS further told the Committee that there is need for a policy and regulations review to address emerging and potentially disruptive technologies like artificial intelligence and blockchain technologies including cryptocurrencies.