The Ad hoc Committee of Inquiry into the activities of Worldcoin met with the Data Commissioner Ms. Immaculate Kassait. Ms. Kassait was required to explain how the company at the center of data harvesting controversy acquired a certificate of registration.

The joint Committee chaired by Narok West MP Hon. Gabriel Tongoyo (Narok West), sought to know how despite the company Worldcoin not being registered in Kenya, it acquired a Registration Certificate from the office of the Data Protection Commissioner.

“I wish to point out that between April 2022 and August 2022, Worldcoin had not applied to be registered as a data controller or processor. It is also important to note that the Regulations made under the Act to facilitate registration of data controllers and processors came into effect on 14th July, 2022 a few months after the operations of Worldcoin in Kenya had been brought to the attention of ODPC,” said Ms. Kassait.

In response to questions by the Members on whether her office had done due diligence before and after the registration of Worldcoin, the data Commissioner indicated that after conducting due diligence, she had resorted to revoke the registration of Worldcoin for misleading the office of the data protection commissioner and breaching the law.

She told the legislators that her office conducted a spot check of the activities of Worldcoin at various stations and established that the processing activities as relates to; provision of Iris and facial Data for the performance of a contract, legitimate interest, legal basis and consent did not meet the requirements of the Data Protection Act.

According to Ms. Kassait, Section 4 of the Data Protection Act, 2019 applies not only to data controllers and data processors established or ordinarily resident in Kenya but also to those not resident in Kenya but processing personal data of data subjects located in Kenya. Therefore, the Act's provisions explicitly state that data controllers and data processors do not have to be resident or established in Kenya for them to make an application for registration under the Act and the Regulations.

Citing the rapid technological advancements such as AI, block chain and others, she said that the internet of things has created borderless boundaries, advancements that have opened up opportunities for innovation and investments and thus, calls for legislative reform to develop suitable policies and regulations that created a conducive environment for innovation and investments in line with the Government's digital agenda.

The Commissioner told the committee that the Office faces challenges in regulating the processing of personal information which include; gaps in the legal framework on personal data protection; Inadequate human capacity, and Voluntary provision of personal information.

To address the above, the Office recommends for a review of the Data Protection Act, 2019 and Regulations and enhancement of the staff capacity and regional presence.