NAIROBI, Kenya, Sep 6 — The Office of the Data Protection Commissioner (ODPC) has dispelled claims the move to revoke the certificate of registration it issued Tools for Humanity (TFH) was a knee-jerk reaction following public uproar on omissions by the agency.
Data Commissioner Immaculate Kassait pointed out the move to cancel the certificate of registration for TFH, Worldcoin’s parent firm, followed recommendations by a multi-agency team investigating its operation.
During her appearance before the National Assembly Adhoc Committee, she explained that the Worldcoin project defied integral provisions in the Data Protection Act prompting the revocation.
“We relied on the investigation report to cancel the certificate of registration. The revocation is based on the multiagency report which was finalized on Friday last week,” Kassait said.
She explained that the American firm’s certificate of registration was revoked after it defied cessation orders to halt the process of mining sensitive personal data.
The Data Commissioner also cited inconsistencies on the exact location where Kenyans’ data are stored and Data Protection Impact Assessment (DPIA) for the second phase of their activities which is a requirement the Data Protection Act.
“They moved from Tools for Humanity and transferred the data to Worldcoin. Its the inconsistencies in terms of their information in their sworn statement visa vi what they put in terms of their application,” she said.
Kassait dismissed claims that the issuance of certificate of registration exposed gullible Kenyans to Worldcoin activities saying the firm had complied with the requirement on registration.
No endorsement
She argued that the registration certificate did not authorize Worldcoin’s data processing activities in the country.
Kassait said that upon assessment of Worldcoin activities post-registration, ODPC established their activities had violated the requirement of Data Protection Act prompting a ceasure notice.
“ODPC did a spot check in various malls and at the ID4 Africa Conference held at the College of Insurance in May 2023 and established that the processing activities as relates to; provision of Iris and facial Data for the performance of a contract, legitimate interest, legal basis and consent did not meet the requirements of the Data Protection Act,” she said.
“In view of the above, ODPC on 30th May 2023 issued a ceasure notice restricting further collection and processing of sensitive personal data by Worldcoin,” she added.
ODPC accused Worldcoin of ignoring its ceasure notices prompting the agency to issue a cessation order on August 2.
“Further on 2nd August 2023 communication was sent to WorldCoin where the ODPC reaffirmed that the cessation of processing was not lifted and a further directive was made to stop processing of all personal data immediately,” Kassait stated.
Worldcoin Plea
Worldcoin denied mining data for malicious and monetary purposes even as the Data Commissioner moved to revoke a registration certificate the State Law Office said was issued irregularly.
The firm told the National Assembly Adhoc Committee investigating their operations that iris biometrics were the most scalable and fraud-resistant approach that also preserved privacy.
“For the avoidance of doubt, Worldcoin does not and never will involve the collection or selling of data,” Tools for Humanity Chief Executive Officer Alex Blania said on Wednesday.
“No one – not even Tools for Humanity – can link biometric data to World ID. Further, the majority of the internal schematics and technical details of the technology are publicly available on the internet for everyone to review,” he said.
ODPC issued the notice of cancellation Tuesday evening according to Worldcoin’s chief legal officer Scott Thomas.
“ODPC revoked our certificate yesterday evening and no doubt this is of interest. They provided four reasons for the cancellation and we respectfully think that cancellation was outside the normal process and the correct underlying facts,” Thomas said.
The American firm pleaded with the committee to investigate the matter and lift the suspension of their activities which it said had impeded its operations in the country.
“We want to request that the committee investigates this matter with a view of creating regulations, the company prays that the committee finds that Worldcoin did not engage in any wrong doing, we pray that the suspension be lifted with the necessary legal and regulatory oversight,” Blania noted.
Data breaches
Tools for Humanity sought to dispel the fears over the status of the security of the data which is stored in Amazon servers based in the United States.
“Unfortunately, nothing on the market provided sufficiently detailed iris images and the required level of security,” Blania noted.
The Orb operators, devices deployed to capture iris data, currently under forensic investigation by the Director of Criminal Investigation, collect data by scanning one’s iris and the picture is converted into a unique iris code.
Tools for Humanity said it erased all images and the iris code sent to a secure server outside of the country.
Worldcoin transferred all data collected from persons in Kenya before the halting of Worldcoin operations to South Africa, the European Union (Germany, Italy and Poland) with iris code stored in the United States.
