Data protection in Nigeria, an underdeveloped country, has not scaled up to the global bar, especially where such protection becomes imperative considering the advanced cyber-tools being deployed by elite cyber net users worldwide.[1]
The Nigeria Data Protection Regulation is the major provision addressing data privacy and protection in Nigeria.[2] The regulation was issued by the National Information Technology Development Agency (Nigeria’s foremost agency responsible for regulating data privacy protection) in 2019 to comprehensively regulate the use of data in the state. It is a copycat of the EU General Data Protection Regulation 2016.[3]
Before NDPR, most laws on data privacy and protection in Nigeria were industry-specific. Despite this, today Nigeria remains on the list of African countries without a definitive data protection law (the Nigeria Data Protection Regulation 2019 is not considered law in this context being a mere regulation). This is in spite of Nigeria being a signatory to the Economic Community of West African States Supplementary Act on Personal Data Protection 2010 and African Union Convention on Cybersecurity and Personal Data. Some also believe the National Information Technology Development Agency is not empowered by law within the ambit of Section 6 of the NITDA Act to make such a regulation.
Today, data protection is becoming a high priority risk issue discussed at negotiation stages between companies in different jurisdictions and has become a tool to encourage confidence in businesses.[4]
Here are some laws that regulate data protection in Nigeria:
1. The Nigeria Data Protection Regulation 2019
The NDPR applies to all transactions meant for processing, and right of access of data subjects who are natural persons and Nigerian citizens, to personal data in or outside the country (subject to consent[5] of data subjects as the case may be), right to be forgotten etc. Paragraph 12 of the NDPRIF requires data controllers and administrators to report to NITDA any breach within 72 hours of being aware.[6]
2. NITDA
This is the agency responsible for administering the NDPR. The Nigeria Data Protection Regulation empowers the NITDA to register and license DPCOs to monitor, audit, conduct training and render data protection compliance consulting services on its behalf. Until the NITDA introduced the NDPR, no Nigerian entity complied with data protection laws. But one year after the introduction of NDPR, the level of compliance seems to have shown a significant leap from near zero compliance. This leap according to the Director-General, NITDA, Kashifu Inuwa Abdullahi was made possible despite low level of awareness and various challenges.[7]
3. The Constitution
Section 37 of Nigeria’s 1999 constitution forms the foundation of data privacy rights and protection in line with international laws on human rights to privacy. It deems privacy in this respect a fundamental right. Prior to the NDPR, most cases of data privacy breaches were enforced under this section.
4. Nigerian Communications Commission Regulation
Part VI of NCC Regulation generally deals with the protection of consumers’ data in the telecoms sector. Reg. 35 requires all licensees to take reasonable steps to protect the information of their customers against unauthorized disclosures.
5. Freedom of Information Act 2011
Section 14 of the FOI Act protects personal data. It restricts the disclosure of information by public institutions except where the involved data subject consents to it or where it is public information. It is of note that item 28 of the exclusive list provides for collection of sensitive data[8] of persons but does not restrict the right of states to clamour for fundamental human rights by enacting laws on data protection. Such laws are the FOI of various states on citizens data.
Nigeria has many gaps in its data protection and some of them are:
1. Lack of adequate laws: The NDPR is a regulation and cannot command the same authority a law would.
2. Poor awareness of data and technology law even amongst certain elites: This shows that these agencies engaged in data protection and regulation have either not been doing their jobs effectively or at all.
3. Poor training of data collection personnel: Nigeria runs a far beneath mediocre system almost generally, particularly in its public education. This is mainly the reason why most products of public institutions trained in this area either graduate to be incompetent or half-baked. Those who do well sometimes attend private institutions or those in public ones go extra miles brushing up their skills.
4. Insufficient personnel: Till today, Nigeria is experiencing probably the most massive brain-drain or under-employment of experts in its history. Experts in this field tend to be underpaid, under-utilized or overused while altogether barely getting the deserved recognition and compensation.
5. Corruption: With Nigeria ranking 146 least corrupt nation out of 180 countries, according to the 2019 Corruption Perceptions Index by Transparency International,[9] the accuracy of data collected can be doubtful as a country historically known to be skewed along the path of ethnicity and obvious general selfish interests.
Below are some opportunities in data protection in Nigeria:
1. Job creation: As Information Analysts, Data Scientists, Data Analysts etc. For Nigerian digital entities.
2. Technical skills and interpersonal relations: COVID-19 has shown that amongst those who will thrive in emergencies like this are those who are tech-savvy or have jobs in data handling. Also, while others are unable to relate in a work-from-home environment, data handlers thrive while still maintaining meaningful interpersonal relationships.
3. Globally competitive workforce: The highly advanced digital world of today requires excellent knowledge and skills in handling certain kinds of data. Obviously, this means whoever or whichever country is best equipped to handle data of any kind becomes the leader in that field.
4. Cyber-war/cyber attacks expertise: Where big data or any form of data is mined for use, such may be susceptible to attacks and this is where persons specially trained in cybersecurity or highly skilled data handlers come in to prevent or at least manage the activities of cybercriminals or aggressors. In Nigeria, cyberattacks are rarely disclosed, giving an ambience of safety. But in reality, Nigeria suffers some of the worst cyberattacks on the African continent.[10]
The Nigerian Army is currently creating a Cyber Warfare Command comprised of 150 personnel drawn from across the service in order to combat cyber insecurity from terrorists, criminal organizations, and other threats. The creation of the Cyber Warfare Command was ordered by the Chief of Staff of the Nigerian Army, Lieutenant General Tukur Yusuf Buratai as part of the Nigerian military’s response to Nigerian President Muhammadu Buhari’s demand that Nigeria’s volatile security situation be quelled as soon as possible.[11]
The cyberspace has three layers. First is the physical layer, including hardware, cables, satellites, and other equipment. Second is the syntactic layer, which includes the software providing the operating instructions for the physical equipment. The third is the semantic layer and involves human interaction with the information generated by computers and the way that information is perceived and interpreted by its user. All three layers are vulnerable to attack. Attacks can be made against the syntactic layer by using cyber weapons that destroy, interfere with, corrupt, monitor, or otherwise damage the software operating the computer systems. Such weapons include malware, malicious software such as viruses, Trojans, spyware, and worms that can introduce corrupted code into existing software, causing a computer/electronic data device to perform actions or processes unintended by its operator.[12]
In all, data protection in Nigeria has not risen to its apogee due mostly to man-made factors, but then the teeming population of the country and their resilience are pointers to the fact that existing opportunities in data protection are ripe for the taking.
[1] Five of the six largest companies in the world (Apple, Microsoft, Amazon, Google and Facebook) deal in data and profit off processing the data of their consumers. It has become mandatory to regulate how that vast amount of personally identifiable data is managed. Available at https://www.statista.com/statistics/263264/top-companies-in-the-world-by-market-value/. Accessed on 09/09/2020.
[2] Oluluo F. Data Privacy and Protection Under the Nigerian Law. Available at https://www.mondaq.com/nigeria/privacy-protection/895320/data-privacy-and-protection-under-the-nigerian-law. Accessed on 19/08/2020.
[3] Cambridge Analytica Data Privacy Scandal that shook the world in 2018 prompted the immediate implementation of the EU GDPR. For instance, in 2014 the personal information of over 3 billion Yahoo users was unlawfully accessed by hackers.
[4] MTN Nigeria Communications Ltd v Barr. Godfrey Eneye (2013) CA/A/689/2013 (Unreported) where the Court held that the unauthorized disclosure of the claimant’s mobile phone number by his telecommunications service provider (the defendant) and subsequent unsolicited text messages he received from unknown third parties were violations of his constitutional right to privacy.
[5] Data Privacy Regulations Under the Nigerian Data Protection Regulations 2019. Available at https://andersentax.ng/data-privacy-regulations-under-the-nigerian-data-protection-regulation-2019/. Accessed on 24/08/2020
[6] www.templars-law.com. Accessed on 24/08/2020.
[7] https://www.google.com/amp/s/www.vanguardngr.com/2020/08/nigeria-leads-africa-in-data-protection-despite-low-awareness-nitda-dg/amp/. Accessed on 17/09/20.
[8] https://thenigerialawyer.com/who-can-legislate-on-data-protection-in-nigeria-an-opinion/. Accessed on 24/08/2020.
[9] https://tradingeconomics.com/nigeria/corruption-rank. Accessed on 13/09/2020.
[10] I. Abubakar. Why some of Nigeria’s worst cyberattacks are not reported. Available at https://techcabal.com/2020/07/21/why-some-of-nigerias-worst-cyberattacks-are-not-reported/. Accessed on 14/09/2020.
[11] Available at https://spacewatch.global/2018/09/nigerian-army-to-create-cyber-warfare-command-to-combat-online-terrorism-and-crime/. Accessed on 14/09/2020.
[12] Supra.
Leave a Reply