LAWS AND REGULATIONS IMPACTING DATA PROTECTION IN NIGERIA INCLUDE:
a. The Constitution of the Federal Republic of Nigeria 1999.
The Constitution of the Federal Republic of Nigeria in Section 37 set the base towards Data Privacy and Rights protection. Section 37 guarantees “the protection of every citizen, their homes, correspondence, telephone conversations, and telegraphic communications”[1]. Making it an essential and fundamental right.
b. The NDPR implementation Framework 2022.
The National Data Protection Regulation which was implemented on the 25th of January 2019, under the provision of Section 32 of the National Information Technology Development Act 2007, states that “NITDA is responsible for making a regulation it deems necessary or expedient for giving full effect to the provisions of the NITDA Act and for the effective administration of its provisions” could not have come at a more crucial time[2]. NDPR is a major law looking to address the issues arising from data privacy and protection within Nigeria[3].
c. The Cybercrimes (Prohibition, Prevention, etc) Act 2015.
The Cybercrimes (Prohibition, Prevention, etc.) Act, Nigeria’s foremost law on cybercrimes criminalizes data privacy breaches. Generally, this Act prohibits, prevents and punishes cybercrimes in Nigeria. It prescribes that anyone or service provider in possession of any person’s personal data shall take appropriate measures to safeguard such data.[4]
d. The Freedom of Information Act, 2011.
The protection of personal data as provided for in Section 14 of the Freedom of Information Act 2011, is the aim of the Act. It enables public access to public information and restrains the disclosure of personal information by public institutions, except where the person whose data is involved gives their consent to its disclosure, or where the information is publicly available. Personal information is defined as “any official information held about an identifiable person but does not include information that bears on the public duties of public employees and officials”.[5] The Act also provides that a public institution may deny the application for disclosure of information that is deemed privileged by law such as doctor-client privilege, Attorney-client.[6] In Habib Nigeria Bank Limited v. Fathudeen Syed M. Koya, which had to do with an alleged disclosure by a bank of a customer’s transactional information, the Court of Appeal held that it is elementary knowledge that the bank owed its customer a duty of care and secrecy.[7]
e. The consumer Code of Practice Regulations 2007 (NCC Regulations 2007) published by the Nigerian Communications Commission (NCC).
The Nigerian Communications Commission (NCC) regulation part VI, deals with the protection of consumers’ data in the telecoms sector[8]. The Commission requires telecommunication operators to take appropriate steps towards the protection against “improper or accidental disclosure” and must take major steps in ensuring that such information is securely stored[9]. Reg. 35 requires all licensees to take reasonable steps to protect the information of their customers against improper or accidental disclosures. Licensees are not allowed to transfer or share this information with a third party except as permitted by the consumer or commission or by other applicable laws or regulations. Data collected by the licensee must be such that is reasonably required for business purposes and not to be kept for longer than necessary. This law extends not only to electronic or written data but also to verbal data recorded by the licensee. It also provides for notification of the consumer of the use and disclosure of data obtained from them.[10]
f. The Consumer Protection Regulations 2020, issued by the Central Bank of Nigeria.
Acknowledging that there has been a level of ignorance towards the right of their consumer, was perhaps the greatest reason behind consumer exploitation, the Central Bank of Nigeria further pursued Consumer Education and Financial Literacy to promote and disseminate financial education and awareness amongst existing and prospective consumers for the enhancement of their economic well-being.[11]
These regulations ensure the protection of data by creating principles that regulate the processing of personal data.