CS Owalo throws data boss under the bus on Worldcoin operations

ICT and Digital Economy Cabinet Secretary (CS) Eliud Owalo has thrown the Office of the Data Protection Commissioner under the bus over the operation of WorldCoin in the country.

Mr Owalo said the data boss’s office went ahead to register Worldcoin as a data controller despite directing it to cease operations, citing non-compliance with the Data Protection Act.

Owalo, who appeared before the Parliamentary Ad Hoc Committee probing the operations of WorldCoin in the country, shocked the committee when he said the Office of the Data Protection Commissioner went ahead to register WorldCoin as a data controller in April 2023.

This was even when the cessation order against them by the office had not been lifted.

The CS told the Committee that despite the Office of the Data Protection Commissioner directing WorldCoin to suspend its operations in the country for 60 days on June 23, 2022, the office proceeded to issue a certificate of registration to Tools for Humanity Germany in September 2022 and Tools for Humanity Corporation USA in April 2023.

• .

  Keep Reading

• 
  Magistrate says MP Peter Salasya threatened to kill her over ruling
• 
  Regulators mull loosening up crypto laws in a major U-turn
• 
  Report: Kenya anticipates rising corporate security threats in 2024
• 
  Ruling class must stop fighting, mend the nation

“The Office of the Data Protection Commissioner went ahead to issue a registration to WorldCoin without the company first demonstrating that it had fully addressed the concerns raised by the office, or indicating whether or not it was satisfied that WorldCoin had complied and was then free to continue with data collection,” said Owalo.

Due diligence

The CS said there is no indication that due diligence was undertaken on WorldCoin or any of its agents prior to the decision to register it as a data controller in Kenya.

He said that due diligence can be understood as an investigation or exercise of care that a reasonable business or person is normally expected to undertake before entering into an  agreement or contract with another party.

Owalo absolved himself from any blame on the operations of Worldcoin in the country saying that his ministry and government agencies became aware of the matter at the end of July 2023. This was after it became of grave public concern - saying this speaks to surveillance needs of broader concern going far beyond what any one institution could do in isolation

Owalo said he has inaugurated a Working Group on sectoral reforms to review the entire policy, legal and regulatory framework in the Ministry of ICT and Digital Economy and recommend requisite reforms to address gaps and align to the new realities in their operating environment.

“I would like to tell this committee that I have never supported the operations of the WorldCoin in the country. This is due to data safety concerns raised by the Office of the Data Protection Commissioner and the Ministry of Interior. If you watch the clip in the public domain about my statement on WorldCoin, I raised pertinent questions of data collected, storage and safety of Kenyans,” said Owalo.

He told the committee that the Office of the Data Protection Commissioner cancelled the registration of Worldcoin as a data controller with the office writing to the ministry and submitting a report on WorldCoin activities in Kenya and requesting the ministry to write to the Head of Public Service requesting assistance in stopping all worldcoin activities in the country.

Owalo told the committee that the privacy notice provided by Tools for Humanity Corporation shows the data collected was to be used for the purposes of provision of services to WorldCoin customers, conducting research to develop and improve Worldcoin products, training algorithms to better recognise unique users and analysing customer use of Worldcoin services to provide better support.

Cryptocurrencies

The ICT and Digital Economy CS said the Tools for Humanity Corporation had said it would be using customer wallet addresses to send them WorldCoin tokens or other cryptocurrencies that WorldCoin supports, complying with applicable laws such as customer IP (Internet Protocol) address to block individuals whose country does not allow them to access the services.

“Tools for Humanity Corporation had in the privacy notice said the data collected was to be used for resolving disputes, troubleshooting issues, enforcing agreements including privacy statements and the WorldCoin user agreements and contacting customers regarding updates to the services and handling requests, complaints and inquiries,” said Owalo.

He called for a policy and regulatory review to address emerging and potentially disruptive technologies such as Artificial Intelligence (AI) and Blockchain technologies including cryptocurrencies.

While enacting policies and regulations, he noted, there is a need to strike a balance to ensure responsible development and application of technology while not stifling its development. 

Owalo said Kenya is committed to ensuring it remains attractive to technology firms in Africa and beyond.

He said as far as personal data under the Data Protection Act 2019 is concerned, requirements for due diligence in the registration of data controllers or processors are weak.

He called for the strengthening of provisions on due diligence before, during and after registration of data processors and controllers.

“It is noteworthy that under the Act, once data controllers and data processors are registered, they are not required to report on their activities to assure the Office of Data Protection Commissioner that they are compliant with their obligations under the Act, their commitments as indicated in the Data Protection Impact Assessment Reports or disclosures made during registration,” said Owalo.