Kenya’s Data Commissioner Immaculate Kassait has said that WorldCoin company breached the law, prompting the commissioner to revoke its license.
Kassait spoke when she appeared before the Ad-hoc Committee of Inquiry into the activities of Worldcoin to explain how the company at the centre of data generating controversy acquired a Certificate of Registration.
After conducting investigations into the company’s operations, the data Commissioner indicated that she had revoked their registration for misleading the Office of Data Protection Commissioner, subsequently breaching the law.
“Section 8 (e) of the Act mandates the Office to Conduct an assessment, on its own initiative of a public or private body, or at the request of a private or public body for the purpose of ascertaining whether information is processed according to the provisions of the Act or any other relevant law,” said Kassait.
She told the committee that her office, having conducted a spot check on the activities of Worldcoin at various stations, had established that the processing activities as relates to the provision of Iris and facial Data for the performance of a contract, legitimate interest, legal basis and consent did not meet the requirements of the Data Protection Act.
“In view of the above, Office of Date Protection Commissioner on 30th May 2023 issued a ceasure notice restricting further collection and processing of sensitive personal data by Worldcoin. Further on 2nd August 2023 communication was sent to WorldCoin where the ODPC reaffirmed that the cessation of processing was not lifted and a further directive was made to stop processing of all personal data immediately,” she added.
The commissioner further revealed that the office faces a myriad of challenges with regard to regulating the processing of personal information.
They include gaps in the legal framework on personal data protection, Inadequate human capacity, and regulation to guide the voluntary provision of personal information.
To address the above, the office recommended a review of the Data Protection Act 2019 and its attendant Regulations and enhancing the Commission’s staff capacity.
She also pointed out the need for the office to have a presence across the counties.
