LEGAL FRAMEWORK FOR DATA PROTECTION REGULATIONS IN NIGERIA
The Governing Board of the National Information Technology Development Agency (NITDA) functions as the highest authority for overseeing various aspects of information technology development in Nigeria. This includes data privacy and protection regulations. It is worth noting that NITDA holds a significant role in this domain; however, its authority is not absolute.
As the Agency of the Federal Government, saddled with the responsibility of developing and regulating Information Technology in Nigeria, the National Information Technology Development Agency is empowered by its enabling Act[2] to create a framework for the planning, research, development, standardization, application, coordination, monitoring, evaluation and regulation of Information Technology practices in Nigeria by developing standards, guidelines and regulations for that purpose. This piece of legislation provides for the establishment of the National Information Technology Development Agency (NITDA) to address the breadth of its mandates.
It’s worth emphasizing that the regulations outlined by NITDA do not negate or infringe upon the existing rights of individuals, particularly Nigerian citizens. These rights remain intact under any other applicable laws, regulations, policies, or contractual agreements. Some of them are:
1. NIGERIA DATA PROTECTION ACT, 2023
President Bola Ahmed Tinubu on June 12, 2023, signed the Nigeria Data Protection Act (NDPA) 2023 into law, making it the first Data Protection Act in Nigeria. Prior to the enactment of the Act, the Nigeria Data Protection Regulations (NDPR) 2019, was the only piece of legislation dedicated to data privacy and protection in Nigeria. At a time when there have been calls by stakeholders for proper legislation as opposed to the NDPR which is most viewed as a mere regulation, the enactment of the NDPA appears to be a step in the right direction.
The objective of the Act is to safeguard the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999[3], an objective wider than what obtains under the NDPR.
Application of The Act:
The provisions of the Act apply to the processing of personal data, whether by automated means or not[4]. Also, the Act governs the processing of data where the data controller or data processor is domiciled in, resident in, or operating in Nigeria; the processing of personal data occurs within Nigeria; or the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria.[5]
The scope of application of the Act is more comprehensive than what obtains under the NDPR which limits its application to natural persons residing in Nigeria or residing outside Nigeria who are citizens of Nigeria.
However, where the processing of data is solely for personal or household purposes, the provisions of the Act shall not apply[6]. Other exemptions/limitations of the scope of application of the Act bothering on public interest grounds are also contained in the Act.[7]
2. 1999 CONSTITUTION OF NIGERIA
In many jurisdictions, including Nigeria, the framework for data privacy and protection derives from the core legal document of the country, which is the Constitution of the Federal Republic of Nigeria 1999, with subsequent amendments (“the Constitution”). Within this framework, the Constitution[8] plays a pivotal role in safeguarding the privacy rights of citizens, encompassing not only their privacy but also the confidentiality of their residences, communications, telephone discussions, and telegraphic exchanges. Consequently, the concepts of data privacy and data protection are natural extensions of the broader constitutional right to privacy granted to every Nigerian citizen.
3. CHILD RIGHTS ACT, 2003
In 2003, Nigeria enacted the Child Rights Act (CRA) with the aim of adapting the principles outlined in the United Nations Convention on the Rights of the Child into domestic law. The CRA is designed to ensure that children’s civil, economic, political, social, health, and cultural rights are protected. This act is intended to safeguard the rights of Nigerian children, legally defined as individuals below 18 years of age.
One noteworthy provision of the CRA is found in Part II, where the contents of Chapter IV of the Constitution are incorporated by reference. Chapter IV of the Constitution outlines the fundamental rights granted to citizens.
Furthermore, the CRA[9] delves into the rights of a child concerning their private and family life. It explicitly asserts that a child possesses the entitlement to privacy, family life, home, the confidentiality of correspondence, telephone conversations, and telegraphic communication.
4. CYBERCRIMES (PROHIBITION, PREVENTION ETC) ACT 2015 (CPPA)
The primary objective of the Cybercrimes Prevention and Prohibition Act (CPPA) is to create a structured system for preventing, detecting, prosecuting, and penalizing cybercrimes within Nigeria. It establishes guidelines that mandate mobile networks, computer companies, and communication service providers to maintain and store subscriber data for a duration of two years. Notably, this act emphasizes the importance of respecting an individual’s constitutional right to privacy and mandates service providers to actively ensure the security and confidentiality of processed data.
