UNDERSTANDING DATA PRIVACY AND ITS CORRELATION TO HUMAN RIGHTS
Author: O. M. Atoyebi S.A.N FCIArb. (U.K.)., Contributor: JOANNAH TITUS [1]
The recent surge of various forms of Information sharing and Communication Technology has no doubt given rise to the sharing of private information across platforms. The protection of personal and other important information through Data Privacy Regulations and other mechanisms has therefore become important in recent times, to ensure the protection of the right of privacy of persons who engage daily in the sharing of personal data and information through these platforms.
The Federal Republic of Nigeria has actively joined many other nations across the globe to create bodies and make regulations, to protect the privacy of Data sharing among persons engaging in Data transmission through various platforms in the country, thereby ensuring the protection of the fundamental human right to Private and family life enshrined in section 37 of the Constitution of the Federal Republic of Nigeria as amended 1999.
The Nigeria Data Protection Regulation 2019 (NDPR) is one of such Regulations, and is considered the principal Data Protection Regulation. It is a subsidiary legislation issued pursuant to the National Information Technology Development Agency Act 2007 (NITDA).
Most recently, On 4th February 2022, the President of the Federal Republic of Nigeria, President Muhammadu Buhari announced the establishment of a dedicated data protection agency for Nigeria, the Nigeria Data Protection Bureau (NDPB).
The National Information Technology Development Agency (NITDA) and the Nigeria Data Protection Bureau are the principal regulatory authorities responsible for enforcing the Nigeria Data Protection Regulations and the administration of all related data protection matters in Nigeria.
LAWS AND REGULATIONS IMPACTING DATA PROTECTION IN NIGERIA INCLUDE:
a. The Constitution of the Federal Republic of Nigeria 1999.
The Constitution of the Federal Republic of Nigeria in Section 37 set the base towards Data Privacy and Rights protection. Section 37 guarantees “the protection of every citizen, their homes, correspondence, telephone conversations, and telegraphic communications”[1] [2]. Making it an essential and fundamental right.
b. The NDPR implementation Framework 2022.
The National Data Protection Regulation which was implemented on the 25th of January 2019, under the provision of Section 32 of the National Information Technology Development Act 2007, states that “NITDA is responsible for making a regulation it deems necessary or expedient for giving full effect to the provisions of the NITDA Act and for the effective administration of its provisions” could not have come at a more crucial time[2] [3]. NDPR is a major law looking to address the issues arising from data privacy and protection within Nigeria[3] [4].
c. The Cybercrimes (Prohibition, Prevention, etc) Act 2015.
The Cybercrimes (Prohibition, Prevention, etc.) Act, Nigeria’s foremost law on cybercrimes criminalizes data privacy breaches. Generally, this Act prohibits, prevents and punishes cybercrimes in Nigeria. It prescribes that anyone or service provider in possession of any person’s personal data shall take appropriate measures to safeguard such data.[4] [5]
d. The Freedom of Information Act, 2011.
The protection of personal data as provided for in Section 14 of the Freedom of Information Act 2011, is the aim of the Act. It enables public access to public information and restrains the disclosure of personal information by public institutions, except where the person whose data is involved gives their consent to its disclosure, or where the information is publicly available. Personal information is defined as “any official information held about an identifiable person but does not include information that bears on the public duties of public employees and officials”.[5] [6] The Act also provides that a public institution may deny the application for disclosure of information that is deemed privileged by law such as doctor-client privilege, Attorney-client.[6] [7] In Habib Nigeria Bank Limited v. Fathudeen Syed M. Koya, which had to do with an alleged disclosure by a bank of a customer’s transactional information, the Court of Appeal held that it is elementary knowledge that the bank owed its customer a duty of care and secrecy.[7] [8]
e. The consumer Code of Practice Regulations 2007 (NCC Regulations 2007) published by the Nigerian Communications Commission (NCC).
The Nigerian Communications Commission (NCC) regulation part VI, deals with the protection of consumers’ data in the telecoms sector[8] [9]. The Commission requires telecommunication operators to take appropriate steps towards the protection against “improper or accidental disclosure” and must take major steps in ensuring that such information is securely stored[9] [10]. Reg. 35 requires all licensees to take reasonable steps to protect the information of their customers against improper or accidental disclosures. Licensees are not allowed to transfer or share this information with a third party except as permitted by the consumer or commission or by other applicable laws or regulations. Data collected by the licensee must be such that is reasonably required for business purposes and not to be kept for longer than necessary. This law extends not only to electronic or written data but also to verbal data recorded by the licensee. It also provides for notification of the consumer of the use and disclosure of data obtained from them.[10] [11]
f. The Consumer Protection Regulations 2020, issued by the Central Bank of Nigeria.
Acknowledging that there has been a level of ignorance towards the right of their consumer, was perhaps the greatest reason behind consumer exploitation, the Central Bank of Nigeria further pursued Consumer Education and Financial Literacy to promote and disseminate financial education and awareness amongst existing and prospective consumers for the enhancement of their economic well-being.[11] [12]
These regulations ensure the protection of data by creating principles that regulate the processing of personal data.
KEY RIGHTS THAT INDIVIDUALS HAVE IN RELATION TO THE PROCESSING OF THEIR PERSONAL DATA.
In the protection of personal data, specific rights ensue for every individual in respect of data fed to various data subjects. The Rights include;
i. Right of access to data/copies of data
By virtue of Regulation 3.1 of the NDPR, a data controller is required to provide easily accessible information relating to the processing of Data in clear and plain language.
ii. Right to rectification of errors
Under Regulation 3.1 (8), a Data Subject has the right and is entitled to request Data Controller with ease and to rectify any form of inaccurate personal data that is of consigning to the Data subject/individual.
If there is a need for any rectification from the Data controller, the Data controller has to notify the Data Subject of it. The Data Subject can request details with regard to Data from the Data Controller and the Data Controller is obliged to do so.
iii. Right to object to processing
The NDPR provided in Regulation 2.8, a Data Controller who intends to market the data of any individual gives the Data Subject right and access to such data.
iv. Right to withdraw consent
A Data Subject has the right to with his/her consent if need be from the Data controller who might intend on sharing at any time. Subject to Regulation 2.3(2)(c) a Data Subject is to be informed of their right of withdrawal at any time without affecting the lawfulness of the process.
Other individual rights include;
- Right to deletion/right to be forgotten.
- Right to restrict processing.
- Right to data processing.
- Right to complain to the relevant data protection authority.
- Right to object to marketing.
- Right against automated decision-making and profiling.
As captured earlier in this paper, these rights can be enforced through the National Information Technology Development Agency (NITDA) and the Nigeria Data Protection Bureau.
KEY PRINCIPLES THAT APPLY TO THE PROCESSING OF PERSONAL DATA
When dealing with data, certain key principles which advocate human rights, form the basis for the processing of personal data. Some of these principles include;
- Transparency: Regulation 2.1(1) of the NDPR provides that personal data shall be collected and processed in accordance with specific, legitimate and lawful purposes consented to by the Data subject.
- Lawful Basis for Processing: The NDPR provides a certain lawful basis for processing personal data. One of such bases is where the subject has given consent to the processing of his or her personal data for one or more specific purposes.
- Purpose Limitation: This principle ensures that the personal data obtained from the data subject shall only be processed in accordance with the specific, legitimate, and lawful purpose consented to by the data subject.
- Data Minimization: The NDPR requires the personal data being processed to be adequate, accurate and without prejudice to the dignity of the human person.
- Retention: This principle ensures the storage of personal data only for the period within which it is reasonably required.
- Data Security: All personal data are to be secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulations of any kind, damage by rain, fire or exposure to other natural elements.
- Accountability: Where a person is entrusted with or is in possession of the personal data of a data subject, the NDPR imposes a duty of care on such person to be accountable for his acts and omissions in respect of data processing, and in accordance with the principles contained in the NDPR.[12] [2]
CONCLUSION
The Nigerian authorities through different regulations and laws have taken steps towards data privacy and the protection of personal data of its citizens in relation to their fundamental rights. However, it is possible to say that the only law that comprehensively deals with the protection and privacy of personal data of her citizens in Nigeria is the NDPR by NITDA.
Nonetheless, Nigeria can boast of being one of the few countries that have data privacy and protection laws in the world amongst other countries. With this, the country is heading in the right direction with room for improvement.
[1] S.37 CFRN 1999.
[2] S.32 NITDA 2007.
[3]For a review of the NDPR, see “Data Protection Regulation 2019 – The New Law” by Yimika Ketiku and Dolapo Bolu, available online at: https://www.spaajibade.com/resources/data-protection-regulation-2019-the-new-law-yimika-ketiku-and-dolapo-bolu/ [13]
[4] S.21 Cybercrime (Prohibition, Prevention, etc.) Act.
[5] Emeka Ekwezor (2020), An Analysis of the Data Privacy and Protection Laws in Nigeria
[6] Federal Republic of Nigeria Official Gazette (28th May) Vol.98. Available on https://www.cbn.gov.ng/FOI/Freedom%20Of%20Information%20Act.pdf [14]
[7] (1992) 7 NWLR Pt.251 P43 at 57 and 58)
[8] Regulation 35(3), CPC 2007.
[9] Emeka Ekwezor (2020), An Analysis of the Data Privacy and Protection Laws in Nigeria
[10]Nigerian Communications Act 2003, Federal Republic of Nigeria Official Gazette No. 87 (10th July, 2007) Vol. 94.
[11] Central Bank of Nigeria, Consumer Protection, ISSN No: 2695-2394|Vol. 1|No. 3|November 2019.
[12] Data Protections Laws and Regulations 2022, https://iclg.com/practice-areas/data-protection-laws-and-regulations/nigeria [15] accessed 12 December 2022