Nairobi, Kenya 11th August 2023
Amnesty International Kenya and the Open Institute have continuously monitored the recent developments surrounding data collection and processing activities by Worldcoin and the resultant regulatory actions by the Government of Kenya.
These recent developments have exposed the underbelly of Kenya’s state of data protection awareness and enforcement mechanisms. We are deeply concerned that preliminary statements from State agencies point towards a massive data breach in Kenya and make this urgent call for thorough and independent investigations by the Data Commissioner.
Having examined the issues around WorldCoin, we have established the following key issues that we call to the attention of Kenyans:
- Cryptocurrency called Worldcoin is a diversion. The main issue is data collection. Whereas Worldcoin has been working under the brand Worldcoin, it is apparent that Kenyans have been hoodwinked into signing up with Tools for Humanity, a private US-based company founded by Sam Altman and Alex Blania. The 350,000 Kenyans who have signed the four-thousand-word Terms & Conditions found that they were signing with Tools for Humanity GmbH, a German subsidiary of a Delaware, USA company with the same name. The Worldcoin Foundation, registered in the Cayman Islands, is only charged with managing the trading and issuance of Cryptocurrency.
The main objective of this private company is to collect biometric data to train new Artificial Intelligence-driven products to enrich the company. The cryptocurrency incentive for Kenyans could be deceptive. The company has used Airpods and hard cash in other countries to induce needy citizens to scan their irises.
- Consent is a major concern. While Worldcoin has stated that consent is the lawful basis for processing personal data, there are reasonable grounds to believe that Worldcoin may not have obtained consent in the meaning of the Data Protection Act. Kenya’s Data Protection Act requires that consent is express, unequivocal, free, specific and informed. We have found that most Kenyans who queued to have their irises scanned were not given adequate opportunity to be informed of the Terms and Conditions they were signing up to. The focus of the engagement was to receive the Cryptocurrency. In many places, the communications printed said, “Come get your share.”
We express grave concern with the practice where Kenyan citizens were enticed to hand over their biometric data to Worldcoin in exchange for digital currency tokens worth about KES 7,000. We call on the regulator to clarify whether Worldcoin obtained consent as per Kenya’s Data Protection Act.
The preliminary review statement issued on 2nd August 2023 by the Office of the Data Protection Commissioner and the Communications Authority raised concerns about the need for clarity on the security and storage of the collected sensitive data. The two agencies also raised concerns about inadequate information on security safeguards and data collected by Worldcoin. The Data Protection Act requires that Worldcoin, processing sensitive personal data, should have conducted a data protection impact assessment at least 60 days prior to the commencement of processing. The data protection impact assessment report should have answered these questions raised by the two agencies. Therefore, we ask the regulator to clarify whether Worldcoin submitted a Data Protection Impact Assessment report as required by law and that their operations met the compliance threshold.
While the Ministry of Interior, ODPC, and Communications Authority have since suspended the processing of personal data by Worldcoin, we strongly urge the Office of the Data Protection Commissioner to ensure thorough and exhaustive investigations on data processing activities by Worldcoin and share findings with the people of Kenya.
The Office of the Data Protection Commissioner is mandated by law to independently exercise its powers and functions over the regulation of personal data processing under the Data Protection Act 2019. We call on all government agencies to cooperate with the Data Protection Commissioner as it carries out this investigation.
Lastly, we urge the ODPC and other stakeholders to double efforts on mass public education on data protection and the right to privacy in Kenya.
For more information and interviews, contact Mathias T. Kinyoda on Mobile: +254723424802, Email: [email protected], or Esther Njagi on [email protected], +254712034488