Data Protection in Nigeria: Legal Framework
There are several laws and regulations which contain provisions on data protection such as the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, The National Identity Management Commission Act 2007, the National Cybersecurity Policy and Strategy, 2021, Freedom of Information Act 2021 (FOIA), Central Bank of Nigeria Consumer Protection Framework 2016, and The Nigeria Data Protection Regulation (NDPR).
The first step Nigeria took in recognizing the widespread influence of information and data technology was the establishment of the National Information Technology Development Agency (NITDA) in 2001, and then in 2007 a bill was passed known as the National Information Technology Development (NITDA Act). This agency and act were put in place to handle ICT-related activities and training of various categories of persons in ICT. It initially fell short of providing functions that foresaw the increasing digital/technological issues that now exist. Due to this, the NIDTA in January 2019 suggested the need to enact the Nigeria Data Protection Regulation (NDPR) which is established to provide the individual rights of Nigerians as regards handling their data. It empowers the NITDA to issue guidelines to cater for electronic governance and monitor the use of electronic data exchange.
The NDPR is one of the most comprehensive attempts to tackle data protection and privacy in Nigeria and shall be used as a focus in this paper.
The NDPR applies to natural persons who are residing within and outside of Nigeria, as long as they are citizens of Nigeria. With rampant cybercrimes such as piracy, identity theft, Cyberbullying, cyberstalking, hacking, phishing etc., the act is essential to ensure the security of personal and sensitive information which are entered on different platforms and filed with different organisations are protected and the individual owners are kept safe. The act identifies personal information including one’s name, address, photo, email address, bank details, posts on social media or networking sites etc. Sensitive data includes information such as personal data that reveals racial or ethnic origins, genetic data, health data, personal data concerning the data of a child under the age of 16, and data concerning a person’s sex life.
Processing of such data is only lawful where:
- Consent of the data subject i. e. the owner has been given[4] and the data controller is able to demonstrate legal capability of data subject to consent.[5]
- The data is necessary for the performance of a contract to which the data subject party to.[6]
- It is necessary for legal compliance with a legal obligation to which the data subject is subject to.[7]
- Processing is necessary to protect the vital interests of data subject of another natural person.
- Performance of a task carried out in public interest or exercise of official public mandate vested in the controller requires the data.[8]
The NDPR places certain obligations on the data controller such as data breach notification, disclosure of data protection impact assessment and maintenance of data processing records, submission of data protection audit to the NITDA if they process the data of more than 1000 data subjects in 6 months or more than 2000 subjects in 12 months etc.
It also empowers the owner of the data with rights such as the
- Right to object to the processing and use of their data in situations such as for marketing purposes.
- Right to be informed.
- Right to access their information.
- Right to erasure of their personal data.
- Right to withdraw their consent to the processing of their data.
These are enforced with the threat of penalties such as Sect 2.10 of the NDPR which provides that any person subject to the NDPR who is found to be in breach of the rights of any data subject shall in addition to criminal liabilities be liable:
- In the case of a data controller dealing with more than 10,0000 data subjects, payment of a fine of 2% of the annual gross revenue of the preceding year or of the sum of 10 million NGN, whichever is greater.
- In the case of a data controller dealing with less than 10,000 data subjects, the payment of a fine of 1% of the annual gross revenue of the preceding year or of the sum of 2 million NGN, whichever is greater.