Uncertainty surrounds how Tools For Humanity, the company behind WorldCoin's entry into Kenya began operations despite a warning from Office of the Data Protection Commissioner.
New revelations show that the company defied orders even after receiving a cessation letter in April and went ahead to undertake the registration exercise.
MPs raised concern that the processing of vital information obtained from Kenyans might be on-going outside the country.
The ODPC told the departmental Committee on Communication, Information, and Innovation that an estimated 350,000 Kenyans scanned their eyeballs with the WorldCoin Orb to verify their online identity, known as World ID.
The committee chairperson John Kiarie who is also Dagoretti South Constituency MP, sought to know why ODPC failed to file a case with the authorities despite the firm commencing data collection notwithstanding the cessation letter.
“It took the intervention of committee to access the trail of correspondences and the committee will go through this. Of concern to us, is are Kenyans safe, is their data safe or is it being exploited to be used in a technology that no one seems to be taking responsibility over?” paused Kiarie.
Data Commissioner Immaculate Kassait said her office has started a multi-agency investigation to determine the actual status of WorldCoin's operations and where Kenyans' data is being processed.
On 19th April 2022, ODPC wrote to the Chief Executive Officer of World Coin requesting for information into the collection of sensitive personal data particularly the legal basis for the collection.
According to Kassait, WorldCoin responded with a letter dated May 6, 2022, and later began collecting data around May 31, 2021.
As a compliance obligation, entities processing data should be registered with the ODPC office.
Kassait maintained that the application for a certificate of registration only signifies that the entity complied with Sections 18 and 19 of the Act and but her office did not endorse the entity's compliance with the Data Protection Act or its subsidiary regulations, and this therefore was not a valid license to operate in Kenya.
This, therefore she said does not also authorise the operations of an entity in Kenya.
“Under the circumstances it was induced compliance with the data protection regulations since Kenyans had to accept the terms for their data to be taken in exchange of WorldCoin tokens,” added Kassait
She said the Office of the Data Protection Commissioner learnt that the company had set up booths across the country to scan the irises of interested Kenyans on April 19, 2022.
The committee chair however, maintained that the information presented by ODPC were not sufficient.
He suspended the session to Friday for the ODPC to present written submission on how the firm managed to navigate regulatory authorities and commence operations in Kenya
On Monday the Data Protection Commissioner moved to court seeking to bar Worldcoin operators from either transferring or processing data collected from Kenyans.
