THE NITDA DATA PROTECTION REGULATION 2019; A PLAY SUIT IN THE PROTECTION OF DATA IN NIGERIA.

INTRODUCTION

When it came to the public’s notice that Facebook violated data privacy laws of some countries, including the US last year, the world was anxious to discover just about how protected their data are, especially in social media websites. Hence, this birthed the European Union’s General data protection regulations (GDPR) in 2018. The National Information Technology Development Agency (NITDA), empowered to develop, promote and regulate and advise the federal government on information technology matters, following the footprints of GDPR, on January 25th, 2019, released the data protection regulation 2019, to regulate the use of data in the country.

HIGHLIGHTS OF THE REGULATION

  • The regulation will apply to all forms of virtual data collection, which includes all internet and social media intermediaries such as Google, Facebook, Instagram, Whatsapp, Twitter, Wechat, Blogs, etc.
  • The regulation will also apply to all Nigerian companies which collect data of natural persons as part of its day to day operations and stipulates that the use of data shall be strictly for the purpose it was received, and such companies are to ensure that such data is protected by any means necessary.
  • No data collector as defined in the regulation shall collect data without the express consent of any natural person.
  • The liability for misuse of data by any data collector extends to any company’s directors, shareholders and any officer appointed and acting with the authority of the company.
  • The penalty for non-compliance or failure to comply with the requirement that such data owners are to be promptly notified of its collection and usage is 2% of the annual gross revenue of the previous year or 10 million naira, whichever is greater.
  • Any transfer of data collected from any Nigerian citizen or resident from Nigeria to any other country must be with the consent of the Honourable Attorney General of the Federation.
  • All companies are required to comply with the provisions of the regulation and ensure their data protection policies are publicized.

 

ISSUES

  1. Whether in the light of the new data regulation 2019, companies can be said to be fully compliant with the provision of the Data regulation.

 

It has been observed that most companies will somewhat replicate privacy policies from various websites without understanding the contents of the privacy policy and ensuring that the policy is in line with the new data regulation 2019, as it relates to their industry.

A review of a least ten technology companies and their websites will show that the privacy policy as displayed on their sites are merely a repetition of what was gleaned from some other website with minor, inconsequential changes.

  1. Whether by the provisions of the regulation, there is a visible penalty for failure to comply with the three months benchmark given to companies, as opposed to the penalty for breach of data privacy rights of individuals.

A review of the regulation will show that while provision is made for the remedy against breach of data privacy, there is no specific penalty for failure to comply with this provision of the regulation, in its entirety both for individuals and companies. This is a glaring lacuna in this regulation and may in the future be a cause for concern. Many questions which are unanswered in this area comes to mind. Where companies do not comply with the three months requirement, what becomes of such companies? How can the agency ensure compliance with the provision of regulations? Does the agency have equipped personnel and knowledgeable resource to ensure the enforcement of the regulation? Is there a database in the agency, of the list of companies which this regulation should apply?

While we applaud the release of the regulation by NITDA, its applicability and enforcement may be fraught with limitations.

 

*Disclaimer: Please note that the critical items highlighted above are solely for academic purposes and should not be taken as legal counsel. For further insight on information technology laws and regulations, kindly send an email to u.ukefi@zuriel.com.ng or contact our office, ZCL SOLICITORS, 3a Ahmad Tijani Ottun, Lekki Phase 1, Lagos.

 

References

  1. The NITDA Data Protection Regulation 2019.
  2. https://legitng.com/category/data-protection/?v=bf7410a9ee72 (The 2019 NITDA DATA PROTECTION REGULATION: THINGS EVERY NIGERIAN SHOULD KNOW.)
  3. http://www.mondaq.com/Nigeria/x/781658/Data+Protection+Privacy/The+NITDA+Data+Protection+Regulation+A+Watershed+In+The+Protection+Of+Personal+Data+In+Nigeria
  4. https://www.aluko-oyebode.com/insights/the-nigeria-data-protection-regulation-2019/
  5. Photo credit: iab.co.uk images

 

Published 27th March 2019