Despite the fact that Article 12 of the Universal Declaration of Human Rights (UDHR, 1948) and other legislations recognise data privacy protection as fundamental rightS, stakeholders agree that Nigeria’s data protection laws and regulations are still in the rudimentary stage and cannot offer the required protection. YEJIDE GBENGA-OGUNDARE reports.
In 2020, a suit was filed by the Incorporated Trustees of Laws and Rights Awareness Initiative against Zoom Video Communications Inc. before a Federal High Court sitting in Abuja to contest the non-compliance of Zoom’s privacy policy with the Nigeria Data Protection Regulation (NDPR). The suit delineated FHC/AB/CS/53/2020 is still ongoing and the court is yet to make any pronouncement.
Same year, another suit delineated FHC/IB/98/2020 was instituted before the Federal High Court, Ibadan division, was instituted by the Digital Rights Lawyers Initiative against the National Youth Service Corps (NYSC) on the grounds that the NYSC published and sold a year book containing corps members’ personal details without corps’ consent.
The lawyers are in the suit seeking a declaration that the processing of the photos and other personal data of the corps members violates Section 37 of the Constitution and Section 2.1(a) of the NDPR. This suit is also ongoing. According to reports, other cases bordering on privacy of data have been filed before some courts though they are largely unreported. In recent times, attention is shifting to breach of privacy as an issue of concern which many do not know how to address.
According to the Nigeria Data Protection Regulation 2019 (NDPR), personal data is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; it can be anything from a name, address, a photo, an email address, bank details, posts on social networking websites, medical information, and other unique identifier such as but not limited to MAC address, IP address, IMEI number, IMSI number, SIM, Personal Identifiable Information (PII) and others.
And while many have an idea of what data is, some still wonder why there seems to be concern about data protection and peoples’ need to seek redress because they do not think breach of data causes serious harm. However, as the world evolves, things that were of no consequence may evolve into major issue because of current realities. Life in the 21st century is different and this shift from the industrial to the information era puts great importance on the value and relevance of data on global economies and development as well as the harm that may arise from its abuse.
In spite of the fact that data protection and privacy is a fundamental rights, it is said that it is alien to the Nigerian society as many people are oblivious of their rights and how to exercise it when data collectors fail to carry out to their duties to protect the privacy of data in their care.
But stakeholders in data protection believe that there seems to be a complicit deafening silence and absence of regulators in issues of data privacy protection. According to an expert, Abiodun Odusote, from the University of Lagos, who had written many papers on the issue, “until few years ago, there were only negligible few civil societies which made data privacy and protection their core concerns, Nigerians have never really bothered about whatever happened to their data so long their other economic/physical rights remained undisturbed.”
Legal provision for data privacy protection in Nigeria
Indeed, before January 25, 2019, Nigeria did not have any dedicated legislation on data privacy and protection apart from the 1999 Constitution (as amended) which is said not to be really useful considering the courts’ seeming restrictive approach to the interpretation of the relevant section on privacy.
In his submission, Olumide Babalola Esq, a digital rights, consumer rights, privacy and data protection lawyer, in a lecture delivered at the Nigerian School of Internet Governance in Lagos, said the Nigeria Data Protection Regulation (NDPR) issued by NITDA, is the only available regulatory framework in Nigeria.
According to him, as the laws stand for the enforcement of data protection and privacy in Nigeria, Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended) and the Nigeria Data Protection Regulation 2019 may be used correlatively to achieve a common purpose.
Section 37 of the 1999 Constitution provides that the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected. And while the provision does not specifically mention data, it can be argued that information on homes, correspondences and telephone conversations are captured in the definition of personal data, hence, the above provision can be used to safeguard such breach.
Babalola said this contention was favoured by the Court of Appeal in the decision in Emerging Market Telecommunication Services v Barr Godfrey Nya Eneye (2018) LPELR-46193, where Mr. Eneye, a legal practitioner sued the operators of Etisalat mobile line for sending and exposing his telephone number to persons/companies which sent him unsolicited text messages in violation of section 37 of the Constitution. The Federal High Court awarded him damages of eight million naira and when the operators of Etisalat appealed, the Court of Appeal held that Section 37 of the constitution under which the respondent instituted the action at the lower court provides that the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected and that Eneye’s suit was properly initiated before the trial court under Sections 37 and 39 of the constitution.
“It is my view that giving those unknown persons and organisations access to the respondent’s Etisalat GSM phone number to send unsolicited text messages into it, amount, to violation of the respondent’s right to privacy guaranteed by Section 37 of the Constitution, which includes the right to the privacy of a personal’s telephone line,” Babalola emphasised.
Aside the Nigeria Data Protection Regulation 2019, which is described as Nigeria’s most comprehensive and useful data protection and privacy legislation till date and section 37 of the 1999 constitution (as amended), there are other frameworks that can be said to guarantee data protection in Nigeria. They include Cybercrimes (Prohibition, Prevention, etc.) Act 2015 which is a framework for the curbing of cybercrimes in Nigeria as well as the protection of critical national information infrastructure and promotion of cybersecurity, intellectual property and privacy rights, the National Identity Management Commission Act 2007 aimed at ensuring the protection of Nigeria’s national database and preventing the misuse of this information for fraudulent activities.
Others are National Cybersecurity Policy and Strategy 2021, Section 9 of the Nigerian Communications Commission (Registration of Telephone Subscribers) Regulation 2011 that provides that the subscriber’s information shall be held on a strict confidentiality basis and no person or entity shall be allowed access to any subscriber’s information that is on the Central Database except as prescribed by the regulation and the Draft Data Protection Bill, 2020 which is currently going through the legislative process.
Despite these various provisions, there is a belief among data security experts and legal practitioners that an all-encompassing data protection framework still needs to be put in place to remove the lacuna in Nigeria’s data protection regime.
This was confirmed by the former chairman of the Nigeria Bar Association (NBA) Ikeja, Dave Ajetomobi, when he told Nigerian Tribune that “All I can say for now is that our data protection laws and regulations are in the rudimentary stage and cannot offer the required data protection because it was parochially conceived by the lawmakers. So it has only been used to protect people who have the connection in the corridor of power; for example, the HEDA boss was arraigned for cyber trolling of former AGF Adoke (SAN). That should not be the purpose of data protection law.
“Banks in Nigeria are compromising our data without any repercussions. The option for citizens is to challenge their representatives in NASS to do the needful, promulgate modern data protection law that tackles our peculiar data issues. Secondly the courts need to do more especially when it comes to issue bordering on locus of citizens to approach courts to preempt possible data breach. Any law on data protection should not be left to politicians alone; experts must be involved in producing world class data protection law.”
Challenges of data privacy protection
There is the belief that the lack of development of data privacy and protection in Nigeria is as a result of legalities which include poor awareness of data privacy right laws, dearth of judicial decisions on data privacy infractions, lack of reports on data privacy infractions, lack of will power to enforce and inadequate data privacy and protection legislation among many others.
According to Theodore Ogba, a lawyer and digital rights advocate, the most effective law in Nigeria which is the NDPR is not enough to curb issues of data privacy breach. He stated that “there are many loopholes despite the wholesome approach of the NDPR, there are issues of absence of provision on remedies to victims and limitations to electronic form of data. It is however also challenging that many people are not aware of their rights and many government agencies that deal with data are not even aware of their statutory responsibility of protection. You also have to think of the poor collaborative efforts among stakeholders and lack of uniformity in judicial opinion in cases of data misuse makes enforcement difficult.
“Also, poor constitutional amendment and insufficient plans for implementation are burdens that militate against the effective protection of data in Nigeria.
Provisions for protection
But for those that know their rights, there are still provisions available for protection and to get redress. The NDPR in Section 2.10 provides that any person who is found to be in breach of the data privacy rights of any data subject shall be liable, in addition to any other criminal liability, to some penalties; for the person in charge of data of more than 10,000 data subjects, payment of a fine of two per cent of annual gross revenue of the preceding year or payment of the sum of NGN 10 million (approx. €21,600) and for those in control of less than 10,000 data subjects, payment of a fine of one per cent of the annual gross revenue of the preceding year or payment of the sum of NGN 2 million (approx. €4,220). Further, this bill provides for various offences and sanctions to include fines of about N10m or imprisonment for up to two years under Part XI.
Today, personal data is increasingly getting more valuable and is gold in the hands of those who know the value, more often than not, unscrupulous persons who intend to misuse it for nefarious activities to the detriment of the owners. This may be the reason stakeholders are calling for a more holistic regulatory framework for data protection in Nigeria as well as an amendment of Section 37 of the Constitution to provide more explanations and widen the scope for protection of citizens. And according to Monilola Ajagbe, a tech expert, “data privacy and protection today has become a fundamental legal issue that must be given adequate legislative and judicial coverage if the country is serious about not turning its citizens to sitting ducks for criminal minded people.”
IN CASE YOU MISSED THESE FROM NIGERIAN TRIBUNE
- Revealed! Details Of South-West APC Leaders Meeting With Presidential Aspirants
- Supreme Court Has Cleared Civil Servants To Participate In Politics, Falana Tells FG
- Battle For New Alaafin Begins As Ruling Houses Insist On Producing Next Oba
- Court Admits More Evidence Against Alleged Fake Army General, Bolarinwa
- I’m Every Man’s Choice Now, My DM Is Crazy —Eniola Badmus
- It Is Now Bye To Decency: Crazy Fashion Trends At Owambe Parties
YOU SHOULD NOT MISS THESE FROM NIGERIAN TRIBUNE
Revealed! Details Of South-West APC Leaders Meeting With Presidential Aspirants
MORE revelations have emerged about Friday’s meeting held by South-West leaders of the All Progressives Congress (APC) with aspirants from the zone, whose main objective, was on how to avert a crisis that will create a fractured party as it prepares for primary on May 30 and 31, Sunday Tribune has reliably gathered…
Supreme Court Has Cleared Civil Servants To Participate In Politics, Falana Tells FG
NIGERIAN workers are constitutionally-free to participate in politics, lawyer, Mr Femi Falana has said. He was responding to the warning from the central government to civil servants to stay off politics…
and then