An Appraisal of the Powers and Functions of the Nigeria Data Protection Commission in Data Protection in Nigeria

Contributed By Linda Amaefule Esq.

INTRODUCTION

The impact of technology on all aspects of human interactions and interrelationships can rightly be compared to a double-faced sword eating deep into its target with precision. While it has brought with it, several positive effects and improved the quality of society, it has also had negative impacts, giving rise to concerns about the development of a framework to curtail its negative effects. One of the issues which continued to beg for attention among the comity of nations is the subject of data privacy and protection and Nigeria is not left behind in this discourse.

Nigeria has thus, in recent times, taken the subject of data privacy and protection with earnest decisiveness. Although it has participated in international deliberations and efforts on data privacy in some decades past, local efforts at providing a framework on the subject did not crystalise until 2019 when the National Information Technology Development Agency issued the first all-encompassing and comprehensive^[1] subsidiary legislation, the Nigeria Data Protection Regulation (NDPR) which has been described as a reflection of the European Union’s General Data Protection Regulation.^[2] Subsequent to this, the Nigeria Data Protection Act was passed in 2023 to provide a legal framework on the subject of data protection in the nation.

The Act further establishes the Nigeria Data Protection Commission as the institution charged with the responsibility for the implementation of the Act and the realisation of its objectives. This article will thus examine the structure of the Commission, its powers and functions as enunciated by the Act.

THE STRUCTURE OF THE NIGERIA DATA PROTECTION COMMISSION

Established by Section 4 of the NDPA, the Commission is a body corporate with perpetual succession and a common seal, capable of suing and being sued in its corporate name and acquiring and disposing of property.^[3] The Commission has its head office at the Federal Capital Territory and may maintain offices in any part of the country for the purpose of the fulfilment of its obligations.^[4] The Act further establishes for the Commission, a Governing Council comprising a part-time Chairman, a representative of the Federal Ministry of Justice, the Federal Ministry of Communications and Digital Economy, the Central Bank of Nigeria, the private sector as well as any law enforcement agency^[5] and the Chairman. Non-ex officio members are to be appointed by the President on the recommendation of the Minister of Communications and Digital Economy.^[6] The functions of the Governing Council include the formulation of overall policy direction of the affairs of the Commission, the approval of strategic plans, action plans, budget support programmes, annual reports and financial reports submitted by the National Commissioner, approval of such terms and conditions of service of employees of the Commission, as are in the Pension Reform Act, provision of general counsel and advice to the National Commissioner, etc.^[7] In the exercise of its functions, the Governing Council may delegate any of its functions under the Act to a committee set up by it.^[8] For the administration of the functions of the Commission, the Act provides for the appointment of a National Commissioner by the President on the recommendation of the Minister, such National Commissioner being the chief executive and accounting officer of the Commission, responsible for the execution of the policies and administration of the affairs of the Commission.^[9] The National Commissioner is to be certified in data protection by a duly accredited body with international standards and must possess at least 10 years of relevant experience at a senior management level in data protection, cybersecurity management, information and communication technology, law, consumer protection, management science or other relevant disciplines.^[10] The National Commissioner is to be the Secretary of the Governing Council and discharge duties as determined by the Act and the Council.^[11]

THE POWERS AND FUNCTIONS OF THE COMMISSION

The NDPC is the primary body empowered to oversee and implement the provisions of the NDPA. The specific functions of the Commission include:

1. The registration of major data controllers and data processors in the nation.^[12] Thus an institution cannot carry on as a major data controller or processor without registering with the Commission.
2. Overseeing and regulating the use and deployment of technologies and structural processes in the enhancement of personal or sensitive data protection.^[13]
3. Encourage and enhance the formulation and expansion of technologies for the protection of personal data in line with the relevant international legal framework and global practices.^[14]
4. The promotion of public awareness and information on the understanding of data protection, the risks associated with the use of personal data, as well as the rights and obligations conferred by the Act.^[15]
5. Receipt of complaints and grievances on the violations of the NDPA and the subsidiary legislations.^[16]
6. The licensing, accreditation, and registration of persons under the appropriate framework, for the provision of data protection and NDPA compliance services.^[17]
7. Ensuring compliance with the national and international framework for data protection as well as alignment with global best practices.^[18]
8. Working in partnership with the necessary bodies, organisations, parastatals, agencies of government, ministries, or departments to foster and achieve the goals and objectives of the NDPA.^[19]
9. Proffer advice and policy recommendations on all matters relating to data privacy and protection to the government.^[20]
10. Participate in national conferences and represent the nation in international conferences and partnership programmes as well as liaise with relevant authorities on the development of an efficient system of regulating cross-border transfers of personal data.^[21]
11. Assess and determine the existence and the extent of the adequacy of personal data protection standards for cross-border transfers, in the various regions and countries, corporate and business settings, contractual documents and codes of conduct of various bodies and organisations, etc.^[22]
12. Submission of legislative proposals for the strengthening of personal data protection in Nigeria, to the Minister of Communications and Digital Economy.
13. Implement such other necessary actions for the performance of its function under the Act.

It is expedient to state that the exercise of the functions of the Commission is to be independent.^[23] In order to facilitate and foster the execution of its functions stated above, the NDPA is empowered as follows:

1. To supervise the implementation of the NDPA.^[24]
2. To prescribe payable fees for data controllers and processors in line with their data processing activities.^[25]
3. To issue relevant rules, directives, policies and regulations in line with and for the purpose of the implementation of the provisions of the NDPA.^[26]
4. To make provisions for compliance filings by major data controllers and processors to the Commission as well as the procedure and frequency of filing.^[27]
5. To request for information from any person or authority, or call for the inspection of documents in respect of any act done under the NDPA.^[28]
6. To carry out necessary investigations into an alleged breach of the provisions of the NDPA or its subsidiary legislations^[29] and impose penalties for any found violation.^[30]
7. To acquire, sell, lease or dispose of properties^[31] and to exercise such other powers as are essential to give effect to its functions under the Act or any known law.^[32]

CONCLUSION

The Nigeria Data Protection Act 2023, establishes the Nigeria Data Protection Commission to carry out the fundamental objectives of the Act. The Commission has a rather strategic role to play in the data protection regime of the country as the principal institution saddled with the responsibility of ensuring compliance with the fundamental principles of data protection detailed by the existing legal framework. Thus, the Nigerian Data Protection Administration can only be effective to the extent to which the commission is empowered legally and in terms of the necessary facilities.

1. Olumide Babalola, “Nigeria’s Data Protection Legal and Institutional Model: An Overview” International Data Privacy Law, 2022, Vol. 12, No 1; 44-52; 44 available at https://academic.oup.com/idpl/article/12/1/44/6403926 accessed on the 25th of October, 2023. ↑

2. Greenleaf, Graham, Nigeria Regulates Data Privacy: African and Global Significance (April 10, 2019). (2019) 158 Privacy Laws & Business International Report, 23-25, UNSW Law Research Paper No. 19-66, Available at SSRN: https://ssrn.com/abstract=3401783 accessed on the 25^th of October, 2023. ↑

3. See Section 4 (2) of the NDPA. ↑

4. Section 4 (3) of the Act. ↑

5. Section 8 of the Act. ↑

6. See section 9 of the Act. ↑

7. Section 12 of the Act. ↑

8. Section 12 (2) of the Act. ↑

9. Section 14 (1) of the Act. ↑

10. Section 14 (2) of the Act. ↑

11. Section 15 of the Act ↑

12. Section 5 (d) of the Act. ↑

13. Section 5 (a) of the Act. ↑

14. Section 5 (b) of the Act. ↑

15. Section 5 (f) of the Act. ↑

16. Section 5 (g) of the Act. ↑

17. Section 5 (c) of the Act. ↑

18. Section 5 (i) of the Act. ↑

19. Section 5 (h) of the Act. ↑

20. Section 5 (m) of the Act. ↑

21. Section 5 (j) of the Act. ↑

22. Section 5 (k) of the Act. ↑

23. Section 7 of the Act. ↑

24. Section 6 (a) of the Act. ↑

25. Section 6 (b) of the Act. ↑

26. Section 6 (c) of the Act. ↑

27. Section 6 (d) of the Act. ↑

28. Section 6 (e) of the Act. ↑

29. Section 6 (f) of the Act. ↑

30. Section 6 (g) of the Act. ↑

31. Section 6 (h) of the Act. ↑

32. Section 6 (i) of the Act. ↑