Kassait made these remarks shortly after Interior CS Kithure Kindiki suspended Worldcoin’s operations in Kenya, citing security concerns.
During an interview with KTN News Wednesday night, Kassait revealed that the Data Protection Commission discovered that Wordlcoin was collecting personal data, which contradicted the information provided during the registration process.
“We did a spot-check on Worldcoin and realized the information they were collecting was not in line with what we allowed. In May [2023], we wrote a letter asking them to stop taking personal data,” said Kassait.
The commissioner clarified the registration process, emphasizing that merely filling out an online form does not guarantee compliance with the Data Act.
She highlighted that a license is granted to a data operator or controller only after their adherence to the law is thoroughly verified to ensure full compliance.
Kassait disclosed that the Data Commission issued a letter of cessation to Worldcoin specifically concerning the processing of personal data, including the iris.
“That letter has never been revoked; we are in the process of investigating. You cannot claim it is on a consent basis and then keep changing your stance. Today, you say it is lawful; we say no. Tomorrow, you say it is a legitimate interest; we say no. You are not clear about what you are doing? Why are you inducing people to give you their consent?” she posed.
The Data Commissioner stressed the importance of providing individuals the freedom to make informed and voluntary decisions when sharing their data with companies.
Furthermore, she stated that the Data Protection Commission is actively working on providing guidance to security firms on the proper and responsible collection of personal data.
