HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept
{
"id": 1277152,
"url": "https://info.mzalendo.com/api/v0.1/hansard/entries/1277152/?format=api",
"text_counter": 97,
"type": "speech",
"speaker_name": "Mr. Eliud O. Owalo",
"speaker_title": "The Cabinet Secretary for Information, Communications and the Digital Economy",
"speaker": null,
"content": "5. Finally, on a continuous basis, the Government has undertaken public sensitisation on data privacy and cyber hygiene. In addition to the above, it is worth noting that the Cabinet Secretary, Ministry of Information, Communications and the Digital Economy has constituted a committee to look into regulatory reforms informed by emerging technologies including, but not limited to, digital currencies such as cryptocurrency. This is informed by the fact that the operational environment is dynamic and as factors play in that operational environment change, it is also incumbent upon us as Government to continuously look at ways and means of reviewing our policies, laws and regulations in line with the changes and emerging issues in the operational environment. On the second Question pertaining to who authorised the biometric data collection by Worldcoin and whether or not the correct procedures were followed, the Government registered Worldcoin on 18th April 2023 as a data controller pursuant to the Data Protection Act and other attendant regulations. An entity processing personal data is required to identify itself with the Office of the Data Protection Commissioner by registering with the Office. Pursuant to the Data Protection Act, 2019 an entity should, therefore, make an application for registration as a data controller where it determines the purpose and means of handling personal data. Conversely, an entity will make an application for registration as a data processor where it handles personal data on behalf of a data controller based on a contractual obligation with the data controller. Further, an entity may register as a data controller and data processor at the same time. Informed by the above, an application for a certificate of registration only signifies that the entity has complied with Sections 18 and 19 of the Act for purposes of registration. It does not in any manner endorse an entity's compliance with the Data Protection Act or its subsidiary regulations, nor is it a valid license for an organisation to operate in Kenya, or authorise the operations of an entity. There is a divergence between mere registration and operationalisation in conformity with the law. Registration does not imply that a company operating in Kenya has been given blanket authority to behave in the manner that it deems appropriate. In terms of operationalisation, there are attendant rules and regulations, and even guidelines which, upon registration, an entity is expected to conform to. The certificate simply signifies that an entity is known to the Office of the Data Protection Commissioner (ODPC) and that it processes personal data of persons located in Kenya. Further, it does not amount to certification of the processing activities of an entity, or serve as an endorsement from the ODPC of an entity's compliance with other provisions of the Act or any other laws, including but not limited to, the Constitution of Kenya, 2010, which is our supreme law. A registration certificate was, therefore, issued to Worldcoin following receipt of the requisite documentation pursuant to the registration regulations. The third question seeks clarification as to whether or not safety guarantees have been put in place to ensure that the data will be used exclusively for the intended purpose, and that citizens will not suffer any loss. On 30th May 2023, the Government issued a directive to Worldcoin to cease processing irises and facial recognition data in the country. A further directive was issued to Worldcoin on 2nd August 2023 to cease all operations in Kenya. In addition, the Government has sought preservation orders from the courts to enable completion of ongoing investigations by a multi-agency team. Informed by the preservation orders, Worldcoin is compelled to preserve all personal data of Kenyans for the duration of the investigations. It is also important to note that prior to the aforestated, the ODPC established that the company had set up booths across the country to scan the irises of interested Kenyans in April 2022. This was in anticipation of the launch of their cryptocurrency on the week of 24th July 2023. Based on that, the ODPC commenced its assessment of the organisation in May 2022. The electronic version of the Official Hansard Report is for information purposesonly. A certified version of this Report can be obtained from the Hansard Editor."
}