RETHINKING DATA PROTECTION IN NIGERIA: GAPS AND OPPORTUNITIES

There is growing technological advancement and a continuous shift from manual to digital processes across various sectors globally.[1] Thus, data privacy and protection has become a global concern to individuals and businesses alike[2] as it is regarded as one of the defining socio-cultural and economic issue of our time.[3] The aforesaid, being seen in previous data breaches,[4] led to the immediate implementation of the EU General Data Protection Regulation (GDPR)[5] in 2018.

Nigeria has not been left behind in this exercise. It has had its fair share of data privacy breaches.[6]Notably, the recent case between NITDA and TrueCaller (2019), as well as the case involving MTN Nigeria Communications Ltd v Barr Godfrey Eneye (2013)[7] are a few instances. It was in response to these that the National Information Technology Development Agency (NITDA), in the absence of a specific statute regulating Data Privacy and protection, issued the Nigeria Data Protection Regulation (NDPR) on 25 January 2019 under section 32[8] of the NITDA Act 2007.

The objectives of the Regulation are:

a) To safeguard the rights of natural persons to data privacy;

b) To foster safe conduct for transactions involving the exchange of Personal Data;

c) To prevent manipulation of Personal Data;

Overall, the NDPR is a welcome development for Nigeria as regards ensuring data privacy and protection.  Also, the actions of NITDA have been visible and commendable since its establishment. In its press release on its investigation of Truecaller over alleged breach of privacy rights of Nigerian users, it assured Nigerians that it will continue to monitor the activities of digital service providers to ensure that the rights of Nigerians are not unduly breached while also improving the operational environment to support ethical players in their bid to get the maximum benefit from Nigeria.[9]

However, there are still gaps in our data protection laws and practice that need further improvements. They are;

Lack of awareness

Data Protection being at the heart of a digital economy, it is quite unfortunate that many Nigerians are unaware of the far-reaching implications of data privacy and protection. Many are also unaware of the NDPR which seeks to protect their rights.

It is my opinion, therefore, that with the advent of the information age where almost every aspect of human life is migrating to the internet and virtually everybody has their personal data online, it has become necessary for data to be included in our educational modules as a mandatory course for every discipline. Also, an awareness campaign on data privacy should be organized from time to time by NITDA.

By doing the aforementioned, the resultant increase in awareness among citizens will lead to a more comprehensive investigation by NITDA of allegations of breaches, as these breaches would be brought to the notice of the agency by the now informed data subjects.[10] Ultimately, these will send a cautionary message to data controllers[11]or whoever is involved in the processing of data, against exploitation of such data.

Independence of supervisory authority

The National Information Technology Development Agency (NITDA) is a Federal Government Agency under the supervision of the Federal Ministry of Communications and Digital Economy.[12] Also, the NDPR is supposed to regulate government agencies that own and use the Nigerian information system.

Knowing very well, most especially in our clime, that the NDPR will hardly be enforced against the government when it’s found wanting, it is advised that an enforcement agency independent and distinct from the government be established to regulate the affairs instead.[13]

The comprehensiveness of the NDPR

The regulation solely ‘applies to all transactions intended for the processing of personal data and to actual processing of personal data… and to natural persons residing in Nigeria or residing outside Nigeria but of Nigerian descent’,[14]thus excluding corporate organizations or legal entities. However, breach of privacy of data relating to these entities may have implications on its members as entities do not exist in isolation since they are made up of shareholders, partners, members, or employees.[15]

Though it may be argued that the definition of personal data in the NDPR is wide enough in scope to include a corporation’s data relating to a natural person or that can be used to identify natural persons, it is still very much debatable. Thus, it is my opinion that amendments be carried out with express provisions relating to legal entities, as the absence of such express provision may be interpreted as a disregard of their data and the processing of the same in Nigeria.

Provision of the Data protection officers (DPO) in the NDPR is not comprehensive

The only mention of DPO in the NDPR is section 4.1(2) and section 4.1(3). The former specifies the purpose for which the DPO shall be designated by the Data controller while the latter enjoins the Data controller or processor to ensure continuous capacity building for DPO’s and the generality of her personnel involved in any form of data processing.

The NDPR does not define a DPO nor outline the DPO’s responsibilities, unlike the GDPR.[16]Also, the appointment of a DPO under the NDPR is not based on professional qualities and expert knowledge of data protection law and practice.[17]

Outlining the functions of the DPO and basing the appointment on professional qualities or expert knowledge on data protection would lead to greater efficiency in the dispatch of its duties. Thus, an amendment as regards the aforesaid lacunae in our NDPR is recommended.

Furthermore, the DPO under the NDPR is silent on the independence of the DPO from the influence of the data controller or processor as is required under the GDPR.[18] In my opinion, considering the key role that the DPO plays in ensuring the controller complies with the regulation, it is advised that amendments be made to ensure the independence of the DPO.

CONCLUSION

It is laudable that Nigerian authorities through their laws and various regulations are taking bold steps to protect the personal data of their citizens. The quick implementation and enforcement of the NDPR by NITDA, coupled with the pending Data Protection Bill, has shown our seriousness in ensuring compliance with data privacy and protection laws by data controllers and processors in Nigeria. However, there’s much room for improvement, and thus the need to rethink our data protection practices in light of the aforementioned gaps.


[1] Templars, ‘Nigeria Data Protection Regulation 2019: A Safety Net for Personal Information or Just Band-Aid?’ https://www.templars-law.com/nigeria-data-protection-regulation-2019-a-safety-net-for-personal-information-or-just-band-aid/ accessed 10 September 2020.

[2] Alison Achinivu and Adaobi Okafor, ‘A Comparative Analysis of The Nigeria Data Protection Regulation 2019 And the European Union’s General Data Protection Regulation’ [August 2020] https://www.linkedin.com/feed/update/activity:6701272440997216256 accessed 10 September 2020.

[3] Mary Meehan ‘Data Privacy Will Be The Most Important Issue in the Next Decade’ [November 26, 2019] https://www.forbes.com/sites/marymeehan/2019/11/26/data-privacy-will-be-the-most-important-issue-in-the-next-decade/#3b0adf411882> accessed 16 September 2020.

[4] For example, the Facebook-Cambridge Analytica Data Privacy Scandal where the personal data and information of about 87 million Facebook users were unlawfully collected without their consent: Dan Patterson, ‘Facebook data privacy scandal: A cheat sheet’ [July 30, 2020] https://www.techrepublic.com/article/facebook-data-privacy-scandal-a-cheat-sheet/  accessed 16 September 2020.

[5] The GDPR, the EU’s major law on Data Protection and Privacy is aimed at protecting natural persons within the EU concerning the processing of personal data and on the transfer of such data outside the EU.

[6] Francis Ololuo, ‘Data privacy and protection under Nigerian law’ S.P.A. Ajibade & Co. Resources http://www.spaajibade.com/resources/data-privacy-and-protection-under-the-nigerian-law-francis-ololuo/?utm_source=Mondaq&utm_medium=syndication&utm_campaign=LinkedIn-integration accessed 10 September 2020.

[7] CA/A/689/2013 (Unreported) cited in Oluluo (n6) 2.

[8] It states, “the board may make such regulations as in its opinion are necessary or expedient for giving full effect to the provisions of the Act and  for the due administration of its provision”.

[9] Emmanuel Elebeke, ‘We’re investigating truecaller over breach of privacy rights’ Vanguard News (23 September 2019) https://www.vanguardngr.com/2019/09/were-investigating-truecaller-over-breach-of-privacy-rights-nitda/amp/ accessed 16 September 2020.

[10] Data subject is the identifiable person, who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

[11] Data controller is a person who either alone, jointly with other persons or in common with other persons or a statutory body, determines the purposes for and the manner in which personal data is processed or is to be processed.

[12] ‘NITDA Alerts Nigerians on Fake Websites Pledging Federal Government Grants’ [19 July 2020] https://techcabal.com/2020/07/19/nitda-alerts-nigerians-on-fake-websites-pledging-federal-government-grants/#:~:text=The National Information Technology Development Agency (NITDA) is a Federal of Communications and Digital Economy accessed 16 September 2020.

[13] This has been addressed in the Data Protection Bill, which creates the Data Protection Commission with responsibilities to ensure and enforce compliance. This will particularly relieve NITDA of its role.

[14] Section 1.2 (a) of NDPR 2019

[15] Bisola Scott and Sandra Eke, ‘NDPR and protection of personal data of legal entities’ [June 30, 2020] S.P.A. Ajibade & Co. Resources http://www.spaajibade.com/resources/ndpr-and-the-protection-of-personal-data-of-legal-entities-in-nigeria-bisola-scott-and-sandra-eke/  accessed 14 September 2020.

[16] Article 39 of the GDPR outlines the DPO’s responsibilities.

[17] This is unlike the GDPR which provides for such in Article 37.

[18] Article 38 (3) (6) of the GDPR

PERSONAL BIO OF THE AUTHOR

Owen Umeh is a 500 level law student of the University of Nigeria, Enugu campus. He is enthusiastic about international arbitration, with a particular interest in investment arbitration. He also has a budding interest in data protection, trade law, finance, and generally, corporate practice. He has engaged in several trainings, leadership positions, and volunteering experiences that have given him exposure in his chosen career.

Owen is a third-place winner of the first-ever international law trivia by the American Branch of the International law association. He also emerged as one of the winners of Norrison Quakers, SAN National Legal writing Tourney tagged, “The African Continental Free trade Agreement (AfCFTA): A boost to Nigerian commerce?”. He was also amongst the 70 students admitted from across 22 jurisdictions into the Ukraine Arbitration School, 2021. He is an Associate at the Nigerian Institute of Chartered Arbitrators (NICARB), a member of the Experts in Litigation and Arbitration (ELA), member of the ADR society, UNN, member of Diverse Law, Volunteer at the NICARB Young Arbitrators Network (YAN) where he currently heads the promotions department and served as a rapporteur.

Outside law, he has an appetence for reading, public speaking, organizing focused group discussions (FDGs), and is a lover of superhero fictions.

owenumeh.c@gmail.com