Sam Altman’s crypto startup Worldcoin yesterday faced its first major hurdle in Africa when authorities in Kenya suspended its iris-scanning activities (“proof of personhood verification”) over security, privacy and data protection concerns.
Worldcoin now says it is working with relevant authorities to resume iris scans in Kenya soon. Meanwhile, Worldcoin said in a statement provided to TechCrunch that it is using the “pause” to come-up with better on-boarding processes and crowd control measures. This is in addition to “work[ing] with local officials to increase understanding of the privacy measures and commitments Worldcoin implements.”
Kenya’s Ministry of the Interior and National Administration yesterday suspended Worldcoin’s activities, including those of its local affiliates, citing concerns with the “authenticity and legality” in the areas of security, financial services and data protection. It is said to be working with relevant agencies to establish the safety and protection of the data being collected, and how Worldcoin intends to use it.
Kenya is East Africa’s largest economy. It is also one of the first countries where Worldcoin launched sign-ups, and as of right now, it’s one of the biggest markets for take-up. Worldcoin has been using its proprietary “Orb” devices to scan irises, providing its own cryptocurrency as an incentive, to develop what it describes as a new “global human identity and financial network.” Co-founded by OpenAI CEO Sam Altman, it raised over $500 million in funding, including $115 million from Blockchain Capital earlier this year.
“Demand for Worldcoin’s proof of personhood verification services in Kenya has been overwhelming, resulting in tens of thousands of individuals waiting in lines over a two-day period to secure a World ID,” the organization said in a statement.
“Out of an abundance of caution and in an effort to mitigate crowd volume, verification services have been temporarily paused.”
As of last week, Kenya was among the countries with the most venues for eyeball scans, with some 18 in total. Now, there is only one listed — a move that came after Orb operators, overwhelmed by the huge turnout, shifted their stations to Nairobi’s Kenyatta International Convention Centre to accommodate the thousands of people streaming in. (It’s not clear how that move impacts the business model behind being an “Orb operator.” Worldcoin says that as an operator, “you’ll earn money for everyone you sign up with an Orb. You’ll build your own team, run your operations and help get people excited about starting their Worldcoin journey.”)
After the global official launch last week, locals who had received tokens in exchange for scans could sell them for USDT (the stablecoin pegged to the U.S. dollar) on crypto exchanges, or to “brokers” in exchange for cash. In Kenya, that promise of “free money” quickly spread across the country, leading to an influx of people at the recruitment (Orb) stations, drawing the attention of government agencies.
What Kenya data law says
Several agencies, including the office of the Data Commissioner, yesterday also raised a number of concerns about Worldcoin, including lack of clarity around how data is secured, and using financial bait to obtain biometric data. This is despite the country’s ICT minister Eliud Owalo, saying Worldcoin’s operations in Kenya were within the law.
Another criticism from the agencies was that “massive citizen data [was] in the hands of private actors without appropriate framework.” Worldcoin told TechCrunch that it is registered as a data processor at the office of the Data Commissioner, with whom it has been exchanging information for over a year now.
Data protection law in Kenya is fairly specific and is said to be modeled on the EU’s GDPR. Companies handling personal data are required to register as data controllers or processors in Kenya. A controller is defined as a person or entity that determines the purpose and means of processing personal data. A processor may not necessarily collect or determine how data is used but handles it on behalf of another firm. Worldcoin has confirmed to TechCrunch that it’s registered as a processor.
The requirement is part of Kenya’s Data Protection Act that guarantees customer data is used lawfully, minimizes the information collected, restricts the sharing and further processing of data and ensures the safety of the data. The law also requires companies to seek users’ consent before collecting data, and to specify their intention for the collection.
It also states that entities should process the collected personal data through a data server located in Kenya or keep a serving copy within the borders. Also, companies transferring data outside the country can only do so on a number of accounts that also include the consent of the data subject.