Kenya's Cabinet Secretary for ICT and the digital economy, Eliud Owalo, faced questioning today regarding Worldcoin's activities in the country. According to Owalo, the company engaged in unauthorized collection of iris data. Steps are being taken to safeguard this data while an assessment of the situation is undertaken.

Parliamentary members interrogated two cabinet ministers concerning Worldcoin's establishment in the country, acquisition of necessary licenses, and the fate of facial and iris data belonging to almost 400,000 Kenyan individuals associated with Tools for Humanity, the German organization behind Worldcoin. Responses to these inquiries varied in their accuracy. While both Eliud Owalo, the Cabinet Secretary for ICT and the digital economy, and Kithure Kindiki from the interior ministry provided some insights, their explanations were not exhaustive. Further rounds of questioning are scheduled for the following week to clarify the situation.

Limitations of Worldcoin's Data Controller Certificate

Owalo clarified that Worldcoin had been registered as a data controller in Kenya by the Office of the Data Protection Commissioner (ODPC). However, this certification did not grant Worldcoin unrestricted rights to process user data within the country. The ODPC certificate served to acknowledge Worldcoin's presence in Kenya, without endorsing its compliance with the Data Protection Act or other relevant laws. Owalo underscored that this certificate does not certify an entity's adherence to the Data Protection Act or its subsidiary regulations, nor does it authorize an organization's operation in Kenya.

Authorization for Biometric Data Collection

When questioned about the authorization for biometric data collection, Owalo referred to existing data protection laws. He noted that Worldcoin had registered as a data controller in April 2023. According to the Data Protection Act 2019, entities processing personal data are required to identify themselves to the ODPC through registration. Owalo elaborated on the process by which data processors apply to the ODPC, particularly in cases where they manage data on behalf of data controllers as per contractual obligations. Some companies can register as both data controllers and data processors.

Owalo emphasized that Worldcoin's certificate solely indicated adherence to specific sections of the Data Protection Act 2019 related to registration. This certificate did not endorse compliance or grant operational authorization in Kenya.

READ ALSO - Worldcoin Aims to Resume Iris Scans in Kenya Following Government Directives

Status of Collected Biometric Data

Owalo revealed that in May of this year, the Kenyan government directed Worldcoin to cease collecting iris data. In August, multiple agencies, including the ODPC and the Communications Authority of Kenya (CA), initiated a crackdown to halt Worldcoin's operations in response to media coverage.

The Kenyan government has sought court-issued preservation orders to aid the ongoing investigation into Worldcoin's activities. Various agencies are participating in this assessment, ensuring that Worldcoin is obligated to retain all personal data collected from Kenyan individuals during its operations. The results of this investigation will be presented in parliament next week.