Five Things to Learn from Kenya's Inquiry into Worldcoin's Activities in the Country

Carlos Mureithi is a fellow at Tech Policy Press.

Late last summer, Kenya’s National Assembly established a committee to investigate the activities and operations of the cryptocurrency project Worldcoin in the country.

This followed criticism and concern from lawmakers, campaigners, government agencies and others about data privacy as the project launched in the country in July 2023 and signed up people by scanning their irises using an orb in exchange for a digital ID and cryptocurrency worth about 7,000 Kenyan shillings ($54).

Worldcoin, which started collecting data in Kenya in 2021 during its testing phase, is a project of the San Francisco-based Tools for Humanity Corp and the Berlin-based Tools for Humanity GmbH.

The company was founded by OpenAI CEO Sam Altman, Alex Blania, and Max Novenstern, and backed by the venture capital firm Andreessen Horowitz. By scanning eyeballs, Worldcoin says it aims to develop a “reliable solution for distinguishing humans from AI online while preserving privacy, thereby enabling global democratic processes and eventually creating infrastructure for universal basic income programs.”

Following the launch last summer, the Communications Authority of Kenya and the country’s Office of the Data Protection Commissioner (ODPC) said obtaining consumer consent in exchange for monetary reward bordered on inducement.

Kenya's interior ministry suspended Worldcoin’s activities. And the National Assembly Speaker, Moses Wetang'ula, directed that an ad hoc committee of legislators be formed to investigate the activities and operations of Worldcoin, after lawmaker Gitonga Mukunji raised concern about the project in the National Assembly.

Cryptocurrencies are popular in Kenya, which is a global leader in peer-to-peer trading of the assets. However, like in most African countries, it is largely unregulated.

The probe by Kenyan legislators added to the growing scrutiny of Worldcoin by governments around the world, including Spain, Portugal, Argentina, France and the United Kingdom.

The committee, led by lawmaker Gabriel Tong’oyo, assigned itself nine tasks:

• To inquire into the operations and ultimate objectives of the activities of Worldcoin in Kenya
• To inquire into the legal and regulatory compliance of Worldcoin and its agents in Kenya
• To inquire whether due diligence was undertaken by the relevant government agencies before Worldcoin started its operations in Kenya
• To inquire into the nature, use and safety of data collected by Worldcoin in Kenya
• To inquire into the organisational structure and the activities of Worldcoin
• To inquire into the source of money or consideration, if any, paid to the public who presented themselves for registration and the potential beneficiaries
• To inquire whether Kenyans were exposed to any health hazards as a result of the activities of Worldcoin in the country
• To inquire into the legal and regulatory gaps that permitted operations of Worldcoin in Kenya
• To recommend necessary legislative intervention.

As part of the inquiry, the committee received submissions from experts and officials from different Kenyan agencies, as well as Kenyans who had registered for Worldcoin. They also questioned three executives of Worldcoin’s parent company: Tools for Humanity CEO Alex Blania, global head of government relations and public policy Sam Sadle, and chief legal officer and corporate secretary Thomas Scott.

Following the investigations, the committee tabled a report in the National Assembly in September 2023.

Here are five things to learn from the report and its allegations.

1. Worldcoin violated Kenyan laws

The committee found that Tools for Humanity broke Kenyan laws, including sections of the Data Protection Act, 2019, the Consumer Protection Act, 2012, and the Computer Misuse and Cybercrimes Act, 2018.

It also found that Tools for Humanity lacked the legal mandate to transact business in Kenya because it wasn’t registered in the country. And, the partners that collected data on its behalf were not registered as data processors or data controllers as required by the data protection law.

“The Committee observed that TFH Corp and TFH GmbH started operating in Kenya, way before making application for registration as data controllers and continued to operate in total disregard to the cessation orders and directives issued by Kenyan Authorities. Their activities therefore, violated Kenyan laws,” committee chairperson Gabriel Tongonyo wrote in the report.

2. Worldcoin ignored previous orders to stop data collection

Although Worldcoin started collecting data in Kenya in 2021, the report says ODPC found out about the operations in 2022 when Buzzfeed approached it for a story on the project. Once that year and twice in 2023, ODPC ordered Worldcoin to stop its activities. Eventually, in August 2023, the office obtained orders from the High Court directing Worldcoin to stop collecting data.

3. Worldcoin exposed shortcomings of Kenya’s data protection laws

In 2019, Kenya enacted legislation to safeguard the collection, handling, and sharing of data, a major step on a continent where many countries don't have such laws. The Data Protection Act, 2019, created the Office of The Data Protection Commissioner to regulate the work of data controllers and processors and to protect the rights and freedoms of individuals in the processing of personal data.

The Worldcoin case was a litmus test for the legislation, and it uncovered gaps, particularly in enforcement.

Among other issues, the committee found that the legislation lacks proper mechanisms for the enforcement of the rights of data subjects and procedures for thorough vetting of local and foreign data controllers and processes.

During questioning, Kenya's data commissioner, Immaculate Kassait, told the committee that ODPC faces challenges around the legal framework on personal data protection.

She also said that the office had proposed to be given data police for enforcement since its enforcement unit at the moment only deals with investigations but not arrests. As it is, some of the steps that the office can take are issuing enforcement notices, issuing penalty notices, and compensating victims.

Kassait recommended a review of the legislation to fill gaps.

In the report, the committee recommended amendment of the legislation to create provision for full disclosure on how data controllers and processors will utilize and store data collected in Kenya, and to provide discretion to ODPC in imposing administrative fines.

Continentally, there’s been growing recognition of the importance of data protection laws. In 2014, the African Union adopted the African Union Convention on Cyber Security and Personal Data Protection, also known as the Malabo Convention, which requires countries to implement domestic laws for cybersecurity and personal data protection complying with the rights-based standards and principles of the convention.

Last year, the convention was ratified by 15 member countries – the minimum number of ratifications required for it to enter into force.

4. Beyond data laws, Worldcoin's activities call for legislation on new tech

The committee found a need for standalone legislation to regulate new and emerging technologies such as virtual assets, digital platform services and social media services.

It said rapidly evolving technological advancements present a global challenge in managing risks associated with AI, blockchain and virtual assets, and demand a more progressive and responsive regulatory framework.

5. Worldcoin case casts spotlight on operations of Western tech companies in Africa

The findings about Worldcoin's activities in Kenya underscore the trend of tech companies from Silicon Valley and other parts of the West that ignore regulations in Africa or exploit their absence.

While foreign-owned companies help push Africa’s tech revolution through innovation in different sectors, some take advantage in places where regulation is nonexistent or is weakly enforced to use the countries as testing grounds, undermining authorities and sometimes abusing exposed users.

In the report, the committee said Worldcoin operating in Kenya left an impression that the company exploited the weak legal framework in the country.

In response to written questions from Tech Policy Press, Worldcoin parent company Tools for Humanity said:

"TFH remains committed to addressing questions raised by the Government of Kenya regulators and investigators to demonstrate compliance with regulations and to address questions about the technology.”

Based on its findings, the committee made a number of recommendations. They include creation of an oversight framework and policies on virtual assets and service providers of virtual assets, and creation of regulations and enforcement infrastructure for regulating and monitoring virtual assets and service providers of virtual assets.

Following its tabling in the National Assembly in September 2023, the report was expected to be adopted in the same house, paving the way for the implementation of its recommendations.

Tech Policy Press reached out to Worldcoin committee chairperson Gabriel Tong’oyo and Raphael Wanjala, the chairperson of the National Assembly’s implementation committee, for comment on the status of the report and next steps. We’ll update this article with any response we receive.