INTRODUCTION
Insurance companies stand out as key targets for cyberattacks due to the nature of the personal data that the work with. In order to make sure that customers’ data are well protected, insurance companies are to ensure that they comply with jurisdictional data protection laws, rules and regulations.
In Nigeria, Article 1.2 of the Nigeria Data Protection Regulation, 2019 (NDPR) which defines the scope of the Regulation, covers players in the insurance industry to the extent where their transactions involve personal data, in relation to Nigerian citizens residing in Nigeria or in the diaspora.
Some other applicable data protection laws in Nigeria are the National Information and Technology Development Agency Regulation, Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended), Section 14 of the Freedom of Information Act, 2011, Section 8 of the Child’s Right Act, 2003, the Nigerian Communications Commission (NCC) Act, 2003, Section 26 of the National Identity Management Commission (NIMC) Act, the National Health Act 2014 (NHA) and Section 9 of the Credit Reporting Act 2017 which guarantees the rights of data subjects under the act to privacy and confidentiality with respect to their credit information held by credit bureau.
This article looks at how insurance companies in Nigeria can comply with these laws in order to safeguard customers’ personal data.
OVERVIEW
In the insurance industry, agreements are made to protect people from financial loss if certain agreed-upon risks materialize in exchange for remuneration, such as motor car, household, or personal insurance. Central to the operations of companies within the insurance industry is the idea of trust.
According to The Geneva Association, “Customers trust that insurers will act in ways that ensure their solvency and that they will promptly pay claims when they are due; Insurers in turn trust that policyholders will make sure to minimise their risk after signing a policy and that any claims they make will be genuine.” This underscores the importance of trust between the Insurer and the policy holder.
A major component of this trust is the safety and protection of the customer’s data. Due to the sensitive nature of the data that customers have to give up in the process of buying insurance policies, there is a need for Insurers to safeguard their customers’ data.
This is especially relevant in this day and age of digitalisation. Although digitalization improves productivity and lowers the cost of doing business, there are still a number of barriers to overcome, including disruption to the existing traditional insurance companies, customer adoption uncertainty, return on investment, and data privacy and security. Data collected through digital platforms can be used to provide real-time insights into existing health issues and customer behaviour patterns.
However, increased regulation over customers’ personal data means that insurance providers all around the world, and Nigeria in particular have to make sure that they are complying with the law.
REGULATORY FRAMEWORK FOR DATA PROTECTION IN NIGERIA’S INSURANCE INDUSTRY
The following are relevant pieces of legislation that relate to the protection of customer data in the insurance industry in Nigeria:
- The Constitution of the Federal Republic of Nigeria (CFRN) 1999.
- The Nigerian Data Protection Regulation (NDPR), 2019.
- The Freedom of Information Act, 2011.
- The Cybercrimes Act, 2015.
- The Child’s Right Act, 2003.
- The Nigerian Communications Commission (NCC) Act, 2003.
- The National Identity Management Commission (NIMC) Act, 2007.
- The National Health Act, 2014.
- The Credit Reporting Act 2017.
- The Consumer Protection Framework, 2016.
- The NCC’s Framework and Guidelines for Public Internet Access, 2019.
- Nigerian Deposit Insurance Corporation Act, 2006.
A few of these will be briefly discussed below.
Constitution of The Federal Republic of Nigeria, 1999.
Section 37 of the Constitution of the Federal Republic of Nigeria (CFRN) 1999, as amended, provides for the protection of citizens’ rights to privacy, the privacy of their homes, correspondence, telephone conversations, and telegraphic communications. As a result, data privacy and protection are extensions of a citizen’s constitutional privacy rights.
Nigeria Data Protection Regulation (NDPR), 2019.
In furtherance of its mandate to issue guidelines for electronic governance and monitor the use of electronic data exchange, the National Information and Technology Agency (NITDA) issued the Nigeria Data Protection Regulation (NDPR), 2019 which contains specific provisions on data protection.[1] The provisions of the NDPR are without prejudice to the existing rights under any other law, regulation, policy or contract[2].
Under the NDPR, any person subject to it that is found to be in breach of the data privacy rights of any data subject will be liable in addition to any other criminal liability, to the following:
- In the case of a data controller dealing with more than 10,000 data subjects, payment of 2% of the annual gross revenue of the preceding year or payment of the sum of NGN 10 million whichever is greater; and
- In the case of a data controller dealing with less than 10,000 data subjects, payment of 1% of the annual gross revenue of the preceding year or payment of the sum of NGN 2 million whichever is greater.[3]
Freedom of Information Act (FOIA), 2011.
The Freedom of Information Act was enacted to make public records and information held by government agencies accessible to the public. However, it excludes information relating to the private or personal data of individuals from being made available by public institutions upon application for its provision.[4]
Cybercrimes (Prohibition, Prevention etc.) Act, 2015.
The Cybercrimes Act was designed to create a framework for the prohibition, prevention, detection, prosecution and punishment of cybercrime in Nigeria. Under this Act, mobile networks, computers and communications service providers must retain subscriber data for two years. In particular, it specifies that such service providers must protect an individual’s right to privacy and ensure the confidentiality of their data.
In the event of a violation of the Cybercrimes Act, the Court will be able to impose a large list of fines and penalties. These include:
- Access to a computer, punishable with imprisonment of ten to 15 years, without an option of fine; and
- Computer related forgery which involves intentional manipulation of data by accessing a computer or other network and altering, deleting or supressing data, in order to render the said data inauthentic. Upon conviction, this offence is punishable with imprisonment for a term of three years, fine of NGN 7 million or both.[5]
Central Bank of Nigeria Consumer Protection Framework 2016.
Among the objectives of the Consumer Protection Framework is to increase public confidence, promote a stable financial system, and protect consumer information from unauthorized access and disclosure as stipulated by the Central Bank of Nigeria Act of 2007 (as amended), and the Banks and Other Financial Institutions Act (BOFIA). In order to enable disclosure under the Consumer Protection Framework, financial institutions must obtain written consent from customers before sharing their data with third parties or using it for promotional purposes.[6]
The Nigeria Communications Commission (Registration of Telephone Subscribers) Regulations 2011.
According to Regulation 9 of the NCC Regulations, subscribers whose personal information is contained in the central database have the right to request updates, to have that information kept confidential, to have data duplicated only in accordance with Regulation 9 or an Act of the National Assembly and to preserve data. Additionally, licensees must use subscribers’ personal data in a lawful manner.[7]
Nigeria Deposit Insurance Corporation Act, 2006.
The Nigeria Deposit Insurance Corporation Act, 2006, regulates insurance practices in Nigeria so that all deposit liabilities of banks and other financial institutions licensed for operation in Nigeria are insured.
Depositors are also provided with assistance in case of financial difficulties, ensuring payments in the event that insured banks and other financial institutions plan to suspend their payment schedules, as well as assisting the authorities in formulating and implementing banking policies.
CONCLUSION
These regulations must be strictly obeyed by companies in the insurance sector; otherwise, they could face penalties as detailed above. Insurance companies by virtue of handling the data rights of their customers are responsible for their acts and omissions. The privacy policies of insurance companies must also be displayed on documents containing personal data. Companies should also ensure they appoint Data Protection Officers.
Regulations are intended to encourage responsible data practices for insurance companies and to retain customer trust. Companies should treat the newly enacted laws and regulations, as a significant opportunity to win customer trust and gain competitive advantages, rather than just as a compliance exercise. Despite being acutely affected by the regulation, insurers follow the same path for compliance as any other sector; reviewing systems and processes to see where gaps are to be filled and investing in filling them.
REFERENCE
