Worldcoin probe: Data Commissioner wants data protection law reviewed

Data Commissioner Immaculate Kassait. [Elvis Ogina,Standard]

Data Commissioner Immaculate Kassait has called on lawmakers to review the Data Protection Act, 2019, and its regulations, following the controversial Worldcoin project.

Kassait, in her submissions to the National Assembly Ad Hoc Committee of Inquiry into Worldcoin activities also asked for an enhancement of the capacity of her office.

Worldcoin is a cryptocurrency initiative that claims to offer universal basic income to its users by scanning their eyes. However, concerns have been raised about the privacy and security of personal data collected from Kenyans.

Kassait, appearing before the Committee at Parliament in Nairobi on Thursday, September 7, said that her office had learned some lessons from the Worldcoin activities and had taken some measures to protect personal data.

She said she had submitted details of all registered foreign data controllers and data processors to the National Intelligence Services for vetting and subsequent involvement in the registration exercise.

She also called for a review of the Data Protection Act and its regulations to address the gaps in the legal framework.

"The Data Protection Act, 2019 needs to be amended or clarified. For example, we need to define what constitutes sensitive personal data and what the conditions for processing it are," said Kassait.

The commissioner added that her office recommended a review of the Data Protection Act, 2019, and its regulations and enhancement of the staff capacity and regional presence.

Kassait recommended a public notice from data controllers and data processors to be published in print and electronic media prior to the collection of sensitive personal data, urging the establishment of a structured collaboration framework with the Ministry of Interior on the enforcement of the Act and its regulations.

She also submitted before the committee that foreign data controllers and data processors should seek business permits or requisite licenses prior to submitting a registration application.

Kassait highlighted the challenges that her office faced in regulating the processing of personal information, such as inadequate human capacity, voluntary provision of personal information, and lack of awareness among the public.

Her remarks come after Worldcoin officials confirmed that the cryptocurrency company is not registered in Kenya.

Appearing before the Parliamentary Committee investigating the crypto firm's activities on Wednesday, September 6, Worldcoin CEO Alex Blania, alongside other officials, said that they were under no obligation to register the firm. They argued that the current Kenyan regulatory framework's distinctions between goods and services were insufficient to categorize Worldcoin activities.

"Worldcoin understands the Business Registration Service Act. We have looked at the description as to what constitutes actual activities - the buying and selling of goods - and concluded we were under no obligation to register. We work with local partners who would have that obligation, and for all partners we work with, we do due diligence to confirm if their businesses are registered," said Blania.

He added that there was a lack of clarity in the definition of actual services and what the Act did or should incorporate activities like theirs. He called for greater "regulatory clarity" for crypto assets.

He also revealed that the Worldcoin Foundation, which is supposed to oversee the project, was not registered either.

"We sought to register, but we have not heard back after sending the application," he added.