Authorities should protect Kenyans from WorldCoin and such data firms

The WorldCoin controversy places Kenya in the eye of another digital storm (pun intended).

The news that over 350,000 Kenyans have sold their irises to Tools for Humanity alerts us to the dangers of emerging digital technology and the importance of eternal legal vigilance.

Over the last few months, hundreds of thousands have been flocking to our national icon Kenyatta International Conference Centre and several malls to have their eyes captured in return for Sh7,000 (US$50) worth of crypto currency.

Very conveniently for those who have yet to figure out how to buy unga and sukuma wiki with crypto currency, agents have been on hand to immediately cash the crypto tokens out. From National Assembly hearings, senior government officials' statements and information available publicly, we know WorldCoin have been using their phone application, cryptocurrency, and "orb" scanner to scan Kenyans' bio-metric data for over a year now.

The Office of the Data Protection Commission (ODPC) began investigations into WorldCoin activities in April 2022. Finding WorldCoin's Data Protection Impact Assessment - a legal requirement for all agencies collecting and storing data - unacceptable, ODPC instructed the company to restrict their activities.

According to the ODPC presentation to the National Assembly, a flurry of legal letters between their lawyers and Coulson Harney LLP (Bowmans) then followed as Kenyans continued to flock to offer their eyes for scanning. The scandal finally became a matter of public and policy interest this month as the mass media reported on the endless queues.

Reassuringly, the privacy rights of Kenyans have now caught the attention of the Interior and ICT ministries, investigative agencies and the National Assembly.

Their collective concern must now focus on the purpose, storage, and distribution of Kenyans' private information by WorldCoin. Several questions must now guide the focus of state agencies and the public.

How should WorldCoin and other companies in future be held accountable for failing to cease data collection when instructed by ODPC? How can the National Assembly strengthen the regulatory teeth of the Communications Authority and ODPC?

Lastly, how do all the actors advise Kenyans who came before WorldCoin scanners without understanding how the information was to be used for and the risks they face?

The incident potentially exposes WorldCoin to one of the largest of class action suits if any or a few of those 350,000 citizens that gave up their personal information can demonstrate they did this without informed and prior consent.

More than two million people across Kenya and another 19 countries may have participated in the global collection of personal data since the company was established in 2019. While the use of fingerprints, facial scans and voices are increasingly being explored to leap past the vulnerabilities with passwords, big digital data grabs are sadly not new.

Multiple concerns with the Huduma Namba, the National Census, fraudulent political party membership and the non-consensual release of personal tax information informed the Data Protection Act and establishment of an independent Office of the Data Protection Commissioner in 2019.

Policy and administrative reaction must not be distracted by opportunists seeking to divert focus from the primary offender to the bodies responsible for regulating such breaches. It is important that the newly established National Assembly Joint Ad hoc Committee keep the focus where it needs to be. Why and how, despite a world standard Data Protection Act, did this company manage to ignore ODPC instructions and what consequences must they face? Did the Central Bank of Kenya approve the use of WorldCoin crypto currency to buy our eyes and did the Communications Authority approve the use of the orb scanning equipment?

How do we administratively strengthen our regulatory bodies to reduce the impact of this in future?

Under our right to information (Article 35), we must seek the truth until this data breach is explained and Kenyans better protected.

We must demand mass public education to reduce or better still, eliminate the length of queues of Kenyans willing to ignorantly sell their bodies.