Nairobi — The Office of Data Protection Commissioner (ODPC) has defended its move to issue Tools for Humanity (TFH) the contested certificate of registration in July 2022 despite the State Law Office terming the move unlawful.
Data Commissioner Immaculate Kassait explained that under Section 4 of the Data Protection Act (2019), data controllers and data processors are not required to be established or ordinarily residents in the country.
Kassait defended her office days after Attorney General Justin Muturi asserted that the Worldcoin Project, operated by TFH, ought to have been registered as a business entity before being issued registration certificate by ODPC.
"One may beg to ask the question does this then mean that organizations not registered as business entities in Kenya can process personal data belonging to Kenyan citizens and be registered as a data Controller and Processor? Considering the provisions of Section 4 of the Act, the answer would be a clear yes," said Kassait.
During her appearance on Thursday before National Assembly Adhoc committee investigating Worldcoin activities, Kassait said the anomalies were not envisage in the law calling for legislative reforms.
She said Worldcoin induces the users it registered using a monetary incentive.
Kassait however held that the transactions could not be deemed as a business operation since cyrptocurrencies are not considered legal tender in the country.
"The rapid technological advancements such as AI, block chain, internet of things have created what one would refer to as borderless boundaries, these advancements have opened up opportunities for innovation and investments and thus calls for legislative reform," she said.
Kassait dismissed claims that the issuance of certificate of registration exposed gullible Kenyans to Worldcoin activities saying the firm had complied with the requirement on registration.
No endorsement
She argued that the registration certificate did not authorize Worldcoin's data processing activities in the country.
Kassait said that upon assessment of Worldcoin activities post-registration, ODPC established their activities had violated the requirement of Data Protection Act prompting a ceasure notice.
"ODPC did a spot check in various malls and at the ID4 Africa Conference held at the College of Insurance in May 2023 and established that the processing activities as relates to; provision of Iris and facial Data for the performance of a contract, legitimate interest, legal basis and consent did not meet the requirements of the Data Protection Act," she said.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
"In view of the above, ODPC on 30th May 2023 issued a ceasure notice restricting further collection and processing of sensitive personal data by Worldcoin," she said.
ODPC accused Worldcoin of ignoring its ceasure notices prompting the agency to issue a cessation order on August 2.
"Further on 2nd August 2023 communication was sent to WorldCoin where the ODPC reaffirmed that the cessation of processing was not lifted and a further directive was made to stop processing of all personal data immediately," Kassait stated.
The Data Commissioner told MPs that she became aware of the Worldcoin Project in April 2022 following 'news' that they had been collecting sensitive personal data from Kenyans.
She said the ODPC wrote to Worldcoin on 19th April 2022 seeking information on the legal basis for collection of sensitive personal data and whether personal data was being transferred out of the country.
Worldcoin responded to the request in July 2022 providing a background of their operations prompting the issuance of the contsted registration certificate ODPC revoked on Tuesday, September 5.
