ABSRTACT
Data protection and reliability are top priority issues in our current world. With the development of technology, there is need to protect ones privacy. The expansion of ICT has created an environment where personal data can easily be assessed by anyone if they are not protected. Data protection is gaining importance and moving to the center of political and organizational system. Most countries have taken serious stand on data protection in other to protect crime. Moreover, the fundamental right to protection of personal data is recognized at the universal level in various human rights to privacy. It’s also an inalienable human right also guaranteed by the Nigerian constitution. The growing dependence on online services offered by the telecommunication sectors in Nigeria, as well as the increase rate of identity theft and other cyber misdemeanor have necessitated the need for data protection legislation that are aligned to international standard.
MEANING OF DATA PROTECTION.
Data protection means collection of data organized in a manner that allows access, retrieval, deletion, and procession of that data. It includes but not limited to structured, unstructured, cashed, and file system database. Data protection is also defined as the law designed to protect your personal data. There is presently no specific or comprehensive data privacy and protection law in Nigeria. The only legislation that provides for the protection of the privacy of the Nigerian citizens in general is the constitution of the Federal Republic of Nigeria 1999 (as amended) Act. Section 37 of the constitution provides thus:
The privacy of the citizens, their homes, correspondence, telephone conversation and telegraphic communication is hereby guaranteed and protected.
There are many kinds of data processing that occur without the knowledge of the people like cookies, web-bugs, spywares, persistent internet explorer, and ad wares. The case of collating and processing personal data mirrors the difficulty to find out legal means to guarantee effectively privacy of data on the internet.
DATA EXPLOITATION AND DATA INTENSIVE SYSTEMS.
Government across the world are radically changing policies and infrastructure in the hope of enabling economic opportunity and attracting international investment, by ensuring securities of their societies and strengthening institutions. Consequently; the government is continuously developing new policies that demand more data from people and a vast change in the relationship between the individual and the state through the accumulation of data. It’s not just about the government, Industries play an essential role too; they promote the ideas, support the sales of such system and provide the tools and services. This all result in what we call data intensive systems which processes data about people, places, and which they rely on the data to make decision about the people. Thus, with data intensive system government and industry see new opportunities for surveillance, income generation and control. There are few safe guards in place which result in technology been largely left unregulated and unchecked and this will have a significant ramification for privacy and will transform the exercise of power, by creating new possibilities for oppression, dominance, and strengthening existing inequality, discrimination and exclusion.
Everything we do today generate data, whether we are in possession of a device or not. Our device network, our transport system, car payment system, generates data through us and about us. With all this data we may be able to make the world a fairer, better, cleaner, more sustainable and safe place, the opposite may also be true. Consequently, our devices and infrastructure are been designed for data exploitation. Increasingly, it’s beyond the ability of the individual themselves to control the ways in which data about their lives are controlled, shared and processed. As a result, industries and government are amassing our data with impunity, they aspire to a data driven world which frees them to grab our data to look for patterns and similarities to generate intelligence and to make decision about us and shape our lives and future.
FREEDOM OF INFORMATION ACT.
The freedom of information Act (FOI) enables public access to public records and information but prevent institutions from disclosing personal information to the public unless the individual involved consent to the disclosure. Under section 14 of the (FOI) act a public institution is obliged to deny an application for information that contains personal information unless the individual involves consent to the disclosure or where such information is publicly available. Also, Section 16 of the (FOI) act also provides that a public institution may deny an application for disclosure of information that subject to various forms of professional privileged conferred by law.
In the case of HABIB NIGERIA BANK LIMITED V. FATHUDEEN SYED M. KOYA which involved an alleged disclosure by a bank of a customer’s transactional information. The court of appeal held that it’s elementary knowledge that the bank owed it’s customer a duty of care and secrecy. This case indicated that other than statutory protection afforded to information provided to lawyers, doctors, and journalist; certain persons such as banks owe a duty to maintain confidentiality to their clients.
One concern that often arises for employers in the absence of specific data protection legislation is in relation to the collection, storage, processing, management and treatment of personal information of employees which is common among multi -national corporations that usually have centralized data base of employees. Situations arise from the fact that the language of section 37 of the constitution could be breached without the consent of such individual.
In the absence of specific protection under the law, it appears that the only protection available to employers is contractual and as such employers are usually advise to ensure that the terms of each employees contract of employment contains a provision pursuant to which an employee consent to the purpose, the treatment and the use by the employer of any personal information provided by the employee to the employer in the context of the employment relationship.
WHY IS DATA PROTECTION NEEDED?
Every time you use a service, buy a product online, register for email, go to a doctor, pay your rent, Nepa bill, enter into a contract or services, you have to hand over some of your personal data, even without your knowledge, data and information about you is being generated and captured by companies and agencies that you are likely to have never knowingly interacted with. The only way citizens and consumers can have confidence in both the government and business organization is through data protection with effective legislation to help minimize state and corporate surveillance and data exploitation. Since the 1960’s and the expansion of information technology business organizations, corporations and governmental institutions have been storing our personal data in data base, and data base can be searched, edited, cross-referenced and the data shared with other organization across the world.
Once the collection of data and processing of data become widespread people started asking questions about what was happening to their data, who had the right to access the data? Was it kept accurately? Was it being collected and disseminated without their knowledge? Could it be used to discriminate or violate other fundamental rights? From all these questions and amid growing public concern, data protection principle were devised through numerous national and international consultations, for example the German region of hesse passed the first law in 1970’s which continue to shape data protection law today. At around the same time the UK established a committee to review threats by private companies.
Similarly, National laws emerged soon afterwards beginning with Sweden, France, and as of January 2018 over hundred countries had adopted data protection laws with pending bills and initiatives to protect data. The sheer volume of data generated and the rapid development technology including sophisticated profiling and tracking, Artificial intelligence, means that some existing data protection laws are out of date and unfit to deal with current situations. A strong data protection framework can empower individuals,’ restrain harmful data practices and limit data exploitation. It’s essential to provide the much needed government framework nationally and globally to ensure individuals’ have strong data in both public and private sectors.
CHALLENGES OF THE DATA PRIVACY AND PROTECTION IN NGERIA.
Personal information protection is an integral part of fundamental right. Data protection is a complex issue, and has become a topical issue in recent times. Despite the regulation of the Nigeria Data Protection Regulation 2019 (NDPR), this regulation does not consider privacy protection online, access to internet, video surveillance, search engines and social media networking. All these are current challenges to the effective enforcement of the Act. The lack of a comprehensive database and data protection Authorities pose a major challenge for the enforcement of the Act. The process of obtaining information about an individual may cause delays in some important legitimate activities. For example it may hinder effective criminal investigation by authorized agencies. Individuals may take advantage of data protection laws to perform illegal activities, since to a large extent they can influence who get access to their information. The bill may constrain legitimate users of information (e.g. embassies, financial institutions, police, educational institutions, employees,) from obtaining adequate information about an individual and taking appropriate decisions based on such information.
Similarly, there is the shortage of judicial decisions on data privacy violation in Nigeria. Judicial precedent constitutes the building blocks on which every jurisprudential system is hinged. The Nigerian judiciary is not exception; there is a dearth of questions, issues, emanating from the current body of rules regulating the industry before the courts. This state of affairs has and continues to make it difficult for a body of decided cases that could provide guidance for this area to be developed and followed. There are several issues yawning for authoritative resolution and unless interpreted by courts, may limit the development and growth in this space. For example the question of the full purport of what is a data subject is a daunting enquiry that needs urgent elucidation.
The enactment of an effective Nigeria Data Protection Regulation will propel companies doing business in Nigeria especially those involved in marketing activities to review their business procedures relating to capturing and employing of personal data. Besides it may negate the objectives of transparency, whistle blowing, freedom of information and code of conduct rules.
RECOMMENDATIONS
Engage the National Human Rights Commission (NHRC) to enforce data protection cases
The NHRC should enforce cases of personal data protection breaches by exercising its section 5(a) and (b) functions, which respectively authorizes it to deal with human rights matters and their breaches under the (NHRC) Act.
Engage the Consumer Protection Council (CPC) to provide redress:
Exercise its Section 2(i) function under the CPC Act to provide redress to obnoxious practices or the unscrupulous exploitation of consumers. Ensure that the NIMC and sector-specific regulation with Consumer Protection Council including the CPC and NCC to take action and mandate data protection by design and transparency obligations by specifying that Ministries, department, agencies and related data organization acting as data controllers implement data protection by design in systems and technologies that processes personal information.
Enact a data protection Act:
Enact into law a data protection Act that contains data protection principles consistent with those contained in the African Union Convention on cyber Security and personal data protection or the UE’s General Data Protection Regulation (GDPR).
Amend NIMC Act:
Amend the NIMC act to incorporate robust data protection principles and expand the power of the NIMC to function as a data protection authority to ensure that the public and private institutions in Nigeria comply with data Protection Principles when Processing Personal data.
CONCLUSION
The Nigeria Data Protection Regulation (NDPR) should ensure that the protection of data in Nigeria is in consonant with developing global best practices and fills the gap in the regulation of privacy rights and data protection in Nigeria. However, there is urgent need for a substantive data protection act in the absence of a comprehensive legislation from the National Assembly. In the era of technological proficiency and raging increase in cyber misdemeanor, it is in the interest of the citizenry that urgent steps in the form of water-tight legislation are taken into consideration to ensure rights of citizens are thoroughly protected.
REFERENCE
- European Union Agency for Fundamental Rights (2010) Data Protection in the European Union, the Role of National Data Protection Authorities.
- Emeka Eweozor: An Analysis of the Data Privacy and Protection Laws in Nigeria.
- Section 3.1 of the Nigerian Data Protection Regulation 2019.
- Data Protection, Information Privacy and Security Measures, December, 2018, Paolo Gaurdo p.2.
- The keys to the Data Privacy: A Guide for policy Engagement on Data Protection August 2018.
- Olumide Babalola, Data Protection and Privacy, Challenges in Nigerian Legal issues. 2020.
- Abu-bakr Sani Aliyu, The Nigerian Data Protection Bill: Appraisal, issues, and Challenges, Supra, Note2.
