Parliament opens investigations into Worldcoin

The National Assembly’s Departmental Committee on Communication, Information and Innovation has said that the collection of personal data from Kenyans by foreign company Worldcoin dates back to May 31st, 2021.

The Committee chaired by Dagoretti South MP John Kiarie was informed of the matter during a meeting it had convened with Data Protection Commissioner Immaculate Kassait, to discuss the activities of the company.

“Is the office of the Data Protection Commissioner aware of when Worldcoin started collecting data from the citizens and the purpose of the information so gathered? On what legal framework is the company operating under, who authorized the collection of data from Kenyans, how many Kenyans have so far been signed up by Worldcoin?” asked Kiarie.

Kassait told the Committee that her office became aware of Worldcoin’s activities of collecting personal data from residents of Kenya and transferring the same out of Kenya in April 2022.

It is due to this, that the office wrote to the Chief Executive Officer of Worldcoin seeking answers on the legality of the collection and transfer of personal data, as well as proof of consent for the same.

“From information submitted by Worldcoin under confidential letter dated May 6th 2022, Worldcoin began data collection and processing activities in Kenya on or about May 31st 2021. The purpose of this as indicated in registration application forms is Know Your Customer and Registration,” said Kassait.

However, she told the Committee that the office of the data Commissioner has commenced a multi-agency investigation to ascertain the true position of the processing activities of Worldcoin.

She added that her office is yet to establish the number of Kenyans who have signed up with Worldcoin.

In response to the legal framework within which the foreign company has been operating, the Data Commissioner insisted that the role of her office ends at issuance of a certificate of registration to companies, after proof of compliance with Articles 18 and 19 of the Data Protection Act, 2019.

She said the certificate is not a valid license for an organization to operate in Kenya, or authorize the operations of an entity.

She also distanced her office from blame for allowing Worldcoin to mine data from Kenyans.

“It is worth noting that the activities of Worldcoin in Kenya are subject to other legal and regulatory frameworks in Kenya such as; Consumer Protection laws, the Company’s Act, and the Kenya Information Communication Act,” said Kassait.