Kenya’s Ad hoc committee investigating the Worldcoin matter alleges that the company’s actions have “constituted acts of espionage and a threat to statehood,” local media reported.

Worldcoin, under scrutiny for purportedly mining data from Kenyans by scanning their irises in exchange for cryptocurrency tokens, operated in 30 locations across Nairobi, including malls and learning institutions, starting May 2021.

The committee, led by Narok West MP Gabriel Tongoyo, has called for the Directorate of Criminal Investigations to probe two associated foreign companies, Tools for Humanity (TFH) Corp and Tools for Humanity (TFH) GmbH, for allegedly operating illegally in Kenya.

The companies are believed to be guilty of violating several Kenyan laws, including the Data Protection Act, Consumer Protection Act, and Computer Misuse and Cybercrimes Act. The findings disclosed that neither company appears in the Business Registration Services database of registered businesses or companies in Kenya, thus lacking the legal mandate to conduct any business there.

Worldcoin applied for registration as a data controller on August 22, 2022, a year after commencing its activities in the country, which violates the Data Protection Act of 2019, according to Kenyan authorities.

Public Concern

The committee’s investigations were initiated by public concern over Worldcoin’s questionable activities, particularly the transmission of real-time iris images converted into digital code to Worldcoin’s third-party servers located overseas.

While Worldcoin claims that the collected data was securely stored in Amazon Web Services based in South Africa, uncertainties linger over whether the data can be retracted and deleted when necessary, and whether the transfer of personal data outside Kenya complies with Section 48 of the Data Protection Act.

The investigation revealed that around 350,000 Kenyans had registered by the time Worldcoin’s activities were suspended by the government on August 2, 2023.

This ongoing saga has revealed the need for comprehensive legislation and oversight in the rapidly evolving digital economy, to protect the rights and data of the Kenyan public, and to ensure that companies operate within the bounds of the law.

Misleading Statements

Meanwhile, Kenya’s National Assembly members have criticized Information, Communication and the Digital Economy Cabinet Secretary, Eliud Owalo, accusing him of providing misleading information regarding Worldcoin’s operations in Kenya.

Owalo, in an interview with NTV on Aug. 2, affirmed that Worldcoin was operating within the parameters of the Data Act 2019. However, he denied making such statements during the committee’s proceedings, causing the members to censure him for misleading the public.

Parliament is urged to harmonize laws to regulate the burgeoning cryptocurrency regime in the country, following the findings which noted the inconsistency in Owalo’s statements from his September 11, 2023 submission. The committee has recommended legislative intervention to govern the collection of biodata, citing implications on privacy, security, health concerns, and human rights.

Regulatory reform

Members of the National Assembly are also pushing for the amendment of the law to allow the Office of the Data Protection Commission (ODPC) more discretion in imposing administrative fines and to align the Data Protection Act with global standards. Proposals are in place for the creation of a board to oversee the Commissioner’s daily operations and to ensure stricter compliance with data protection matters.

The committee’s recommendations include stringent requirements for foreign companies seeking registration as data processors or controllers in Kenya. They would have to provide proof of registration with local regulatory bodies and full disclosure on the utilization and storage of collected personal and sensitive data.

If the committee’s report is accepted as it stands, companies involved in virtual assets transactions will face mandatory tax remittance procedures under the Income Tax Act, implying stricter regulations on entities dealing in cryptocurrencies and related virtual assets.