Listen to This Article Enhance your reading experience by listening to this article.

ICT Cabinet Secretary Eliud Owalo yesterday threw Data Commissioner Immaculate Kassait under the bus over the registration and operations of the controversial cryptocurrency project Worldcoin in the country.

Appearing before the joint Ad hoc parliamentary committee chaired by Narok West MP Gabriel Tongoyo, Owalo shocked MPs when he admitted to the fact that no due diligence was undertaken on Worldcoin or its agents prior to having it registered in the country.

He claimed the Office of the Data Protection Commissioner (ODPC) did not carry out due diligence before registering Worldcoin activities in the country.

The CS noted that as far as personal data under the Data Protection Act 2019 is concerned, requirements for due diligence in the registration of data controllers or processors are weak.

“There should have been due diligence and there is always a need for due diligence in such situations,” the CS noted.

He added: “There is a need to strengthen provisions on due diligence before, during and after registration of data processors and controllers.”

Owalo further took on the ODPC, saying as a ministry they are concerned that the Worldcoin started collecting data in public places in May 2021 and only became known to the ODPC in April 2022, almost a year later while the ministry and other government agencies came to know about it towards the end of July 2023.

He expressed concern that despite directing Worldcoin to cease operations in the country in June 2022 and citing non-compliance with the Data Protection Impact assessment (DPIA) that was submitted by Worldcoin, ODPC still proceeded to register Worldcoin as a Data Controller in April 2023 even when the cessation order against them had not been lifted.

He said: “Despite ODPC directing Worldcoin to suspend their operations for 60 days on June 23, 2022 the ODPC proceeded to issue a certificate of registration to Worldcoin (tools for Humanity Germany) in September 2022 and tools for humanity corporation in April 2023 without Worldcoin first demonstrating that it had fully addressed the concerns raised by ODPC, nor ODPC indicating whether or not it was satisfied  that world coin had complied and was then free to continue with data collection.”

In his submissions before the committee, Owalo said it is the obligation of the data controllers or processor to fulfill all the legal requirements of whatever nature before allowing such entities to operate in the country.

Data processors

 He said  once data processors are registered, they are not required to report on their activities to assure the office of the ODPC that they are compliant with their commitments as indicated in the data protection Impact Assessment reports.

 Although he told MPs that Section 4 and Section 19 of the Data Protection Act, data protection does not require foreign applicants to first be registered as a company in Kenya, he was quick to clarify that it is the obligation of the data commissioner to ensure all the requirements are adhered to.

 “Regulation Seven of the data protection sets out that the data commissioner shall undertake a verification process of the details provided for application for registration, following which the data commissioner has 14 days from the date of submission or the application to approve the same,” the Cabinet Secretary explained.

Despite the explanation, committee members took him to task to explain his earlier claims that Worldcoin activities were voluntary and that the company was operating in the country legally.

 “There was a time you said Worldcoin were taking data voluntarily from Kenyans and crypto currency were operating here legally, are you sure about it?”  Lamu Woman Rep Ruweida Mohamed posed.

But in his response, the CS defended his position, saying that although the firm was duly registered, having a certificate was not a license to breach the regulations in the sector.

“What I did say was that being informed by Data Protection Act, Worldcoin was duly registered by the Office of Data Protection Commissioner but based on the merging issues they didn’t conform to operations regulations,” Owalo said.