The Nigeria Data Protection Regulations: The European Union passed the General Data Protection Regulation, (GDPR) on the 25th of May 2016 to serve as the cardinal legislation governing matters of data privacy and protection amongst her member countries.
Similarly, as part of its efforts at having a comprehensive data protection regime, the Nigeria Information Technology Development Agency enacted the Nigeria Data Protection Regulations, NDPR on the 25th of January, 2019.
The NDPR is modelled in the light of the GDPR, and indeed the data legislations of several countries including Chile, Japan, Kenya, South Korea, Brazil and Argentina are also patterned after the GDPR for its extensiveness, comprehensiveness and general efficacy.
However, in spite of the NDPR following in the steps of the provisions of the GDPR, there nonetheless exist a number of divergences between the legislations. Indeed, it is these divergences that this article seeks to consider with a view to provide a guide on possible areas of development of the Nigerian legislation.
The GDPR and the NDPR make provisions as to the protection of privacy rights of natural and living persons. Both legislations expressly refer to only data pertaining to living persons and make no mention of deceased individuals.This is suggestive of an indication that both legislations where not intended to, as matter of general speaking, cover matters relating to dead persons.
A further area of convergence is the definition both legislations assign to Data Controllers.
It is important to note that there is a consensus between the legislations that a Data Controller is essentially an entity which controls data. As such, whilst language in definition may differ, there nonetheless reflect the same meaning.
In its definition of a Data Controller, the GDPR defines the concept as: “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.”
The NDPR on its part defines the concept as: “a person who either alone, jointly with other persons or in common with other persons or a statutory body determines the purposes for and the manner in which Personal Data is processed or is to be processed.”
There are a number of definitions akin to both legislations as follows:
Your email address will not be published. Required fields are marked *
Save my name, email, and website in this browser for the next time I comment.
Δ
