'They're getting data voluntarily from Kenyans': CS Owalo says Worldcoin operations within law

The Cabinet Secretary for ICT and Digital Economy, Eliud Owlao says Worldcoin, the new cryptocurrency project by American Artificial Intelligence (AI) company OpenAI, is operating legally in Kenya.

The crypto project launched last week has seen thousands of Kenyans flock to shopping malls and other outlets where registration is taking place in Nairobi.

By Tuesday, the company said over 350,000 Kenyans had registered for Worldcoin, a process involving scanning one's eyeballs through an orb in exchange for a digital identity called World ID.

And while the process has raised data security concerns, the ICT minister Wednesday said the government is aware of OpenAI’s operations in the country and that the company sought clearance months before the Worldcoin registration process began last week.

“This is something that started way back in April. We have a fully-fledged Data Commissioner’s office charged with the regulation of data security and privacy In April, the office of the Data Commissioner got wind of Worldcoin and wrote them a letter to clarify what they wanted to do,” Owalo told NTV.

He said by scanning people’s irises for free cryptocurrency tokens known as WLD, Worldcoin is not breaching the Data Protection Act.

“Information available to the Data Commissioner is that within the existing legal frameworks is that there is no provision in the law that the organisation has breached. There has been correspondence with them,” Owalo said.

“There could be security and regulatory issues around it which we need to improve, but as far as the Data Act is concerned, they were acting within the law.”

Owalo said the government through the Office of the Data Protection Commissioner (ODPC) has had several meetings with Wordcoin before they began local operations to discuss data safety implications of their operations.

“Their argument is that they are getting the data voluntarily from Kenyans,” the minister said.

He added: “Today the Office of the Data Commissioner is going to give a comprehensive position. Our laws and policies and regulations are not static and with time you realise they need to be strengthened.”

According to the Data Protection Act, a data subject has a right to be informed of the use to which their personal data is to be put; to access their personal data in the custody of a data controller or data processor, and to object to the processing of all or part of their personal data.

Additionally, a data controller or data processor shall collect personal data directly from the data subject, or indirectly where the data is contained in a public record and the data subject has deliberately made the data public.

After getting their eyeballs scanned, new members are receiving 25 free WLD. The tokens are currently valued at Ksh.7,786.

On Tuesday, long queues led to the Kenyatta International Conference Center (KICC) where thousands flocked for a second day to sign up for the project, despite some admittedly not knowing what cryptocurrency is all about. 

The uptake craze saw police stop the registration exercise over security concerns.

Officers asked the Worldcoin team to stop the exercise and kicked out the crowds due to what they said were security risks. They told the team to look for a bigger venue such as the Nyayo or Kasarani stadiums.

The excitement is despite caution from the ODPC, which Friday urged vigilance when signing up for Worldcoin and warned against rushing to sign up for the project amid data privacy concerns.

"The ODPC is aware that Worldcoin has now been launched and is processing sensitive personal data in a manner that requires a demonstration of proper safeguards under the Data Protection Act, 2019," reads a statement from the commission. 

Data Commissioner Immaculate Kassait said the commission is conducting its assessment of Worldcoin's practices to ensure compliance with the law. 

The project by OpenAI CEO Sam Altman has been heavily criticised over privacy concerns. Still, the company's website says the project is "completely private" and that data is deleted or a user can opt to have it stored in encrypted form.