Identity thefts, data privacy abuses and other sundry crimes on digital platforms have become common in Nigeria in recent times. In this report, Assistant Editor BLESSING OLAIFA examines how government institutions respond to the challenges
The past three years have witnessed a critical transformation for Nigeria in the Information and Communications Technology (ICT) industry, and the navigation of Nigeria towards digital platforms to address multiple challenges. The ICT sector, with the attendant infrastructure deficits, poses a challenge to the socio-economic transformation of the country. No country in modern economy toys with ICT infrastructures upon which digital transformation and inclusion are built.
The President Muhammadu Buhari administration came on the mantra of tackling economic woes, addressing security challenges and fighting corruption.
Therefore, for the administration to succeed, especially in its assigned tasks, the ICT industry became a platform upon which every pillar of development is built. The administration initiated far-reaching policies to address infrastructure challenges, develop local content, promote competition through regulatory mechanisms and framework, drive digital inclusion; boost employment generation and investment opportunities, among others.
Among many of the institutions birthed by the policies of the Federal Government through the Ministry of Communications and Digital Economy was the Nigeria Data Protection Bureau (NDPB) led by its first Chief Executive Officer and National Commissioner, Dr Vincent Olatunji.
The Bureau was established last year to respond to critical challenges in the data protection sector and leveraged available platforms to harness the vast opportunities within the digital ecosystem.
Prior to its creation, it was a department under the National Information Technology Development Agency, NITDA. But with the resolve of the government to give data administration its pride of place with an enabling law, the creation of the Bureau became imperative.
It is believed that for a country seeking to deepen global competitiveness, boost employment generation, investments in the data economy became crucial. This explains why economic experts now refer to data as the new oil since crude oil revenues continue to shrink across the globe.
The Minister of Communications and Digital Economy, Prof. Isa Ali Ibrahim Pantami, during the maiden edition of the ‘Digital Economy Regional Conference at the Transcorp Hotel, Abuja, emphasised the importance of building strong digital platforms, especially among African countries for the growth of African economies.
Pantami, who spoke on the theme “Positioning West Africa’s Digital Economy for the Future,” submitted that in the fourth industrial revolution, data remains a key factor. He maintained that the future is data, not oil revenues anymore and that Nigeria must not, in any way, lag behind.
The minister, who buttressed his points by reeling off statistics on ICT contributions to Nigeria’s Gross Domestic Product for the past three years, noted that no sector has achieved much like the ICT sector for the economy.
He advocated that for the gains to be sustained, it was imperative for the administration to back up the digital economic sector in relation to data protection with enabling law.
The minister had a strong driving force towards Nigeria’s digital identity to promote economic development, improve security and prosperity.
“Today, it is a global best practice to have a data protection law in place; otherwise you will find it difficult to attract so many interventions that are of benefit to your country. Even potential investors may ask questions to know whether you have data protection laws in your country or not.
“If you don’t have any data protection law in place, they will feel uncomfortable investing because today, data is critical. Whenever we engage with potential investors, we try to convince them of the need to come to Nigeria to invest, and they always ask if we have a data protection law.
“But we have subsidiary law. Many of them do agree with subsidiary law, at the same time, many disagree that subsidiary law is sufficient for them, but in Nigeria it is sufficient,” he said.
Pantami also said to address the issues, his ministry proposed the establishment of a fully-fledged data protection institution and principal legislation of data protection in Nigeria to President Buhari and subsequently obtained the approval for establishing the Nigeria Data Protection Bureau.
Another aspect of the matter is data awareness. For data awareness advocacy across the country, the minister ensured that Nigeria keyed into the annual observance of the World Data Privacy Day on January 28 January every year.
The advocacy to raise awareness on privacy also coincides with the anniversary of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108 of the United Nations) which was opened for signature on January 28, 1981.
Nigeria is now foremost in Africa when it comes to creating awareness on Data Privacy. The development has made citizens to become conscious of their rights and the need to enforce them.
In a chat with ICT stakeholders, Pantami said Data protection law is not crafted in any way to punish citizens, but rather to create awareness “so that we will all be accountable to one another; whether as data controllers or as data processors.” Pantami further advocated a culture of compliance by design.
However, some experts in the private sector have expressed concerns about personal information and data, and how they are protected by the laws of the land especially as the country now has multiple social media platforms and digital outfits that manage information on finances, loans, health, businesses, insurance, travels, etc. Experts also expressed fears over the fall of vital information regarding an individual or individuals into the wrong hands.
The Nigeria social media space had in recent times become a platform for the abuse of personal information and data. There are cases of impersonation, identity theft, hacking and attacks and bullying amongst others. But government authorities maintained they are equal to the task of protecting citizens’ rights and privacy rights.
However, the prevailing view among some experts is that without a principal law, it may be difficult to guarantee the stability of the gains already recorded. For them, it is also important to attract investment through strong institutions and legislation.
They believe that the 9th National Assembly, though in its twilight, should urgently transmit the data protection bill to President Buhari for assent before May 29, 2023. The bill would provide an additional layer of protection for the country’s digital identity ecosystem and ultimately safeguard Nigeria’s digital economy, boost investor’s confidence, grow foreign direct investment, improve the GDP, and ensure robust protection of personal information, should the President assent to it before the exit of the administration.
It is the position of the NDPB that businesses and organisations will be held accountable for any data breaches or privacy violations with the appropriate penalty paid. But foremost, is the integrity, security and trust built within the sector as a driving force for the overall development of the economy. Industrial players are encouraged to take data protection seriously and implement adequate technological and organizational measures in order to protect personal data, a senior official of the Bureau told our correspondent.
Similarly, the Chief Executive Officer of Jidaw Systems, an ICT Consulting Firm, Mr. Jide Awe, said Nigeria needs to have a strong data protection law as more Nigerians use different Artificial Intelligence (AI) tools which expose their data.
According to Mr Awe, data protection has now gone beyond having a regulatory agency. He insisted that there should be a strong law that can be enforced to protect the privacy of citizens.
Awe said: “While Nigeria has a national data protection regulatory agency, the Nigeria Data Protection Bureau (NDPB), responsible for regulating data protection and ensuring compliance with the Nigerian Data Protection Regulation (NDPR), protecting data privacy rights may requires more than just having a regulatory agency.
“It is hoped that Nigeria and other countries in a similar situation would enact comprehensive national data protection legislation to provide stronger legal and regulatory backing to data protection regulation and help to ensure consistency and effectiveness in addressing data privacy concerns.”
For investors, a data-secured environment is a major attraction. It is an assurance that their information is safe and secure and not subject to abuse. It also explains why many developed countries do not toy with data protection.
Our correspondent observed that many development partners, international financial institutions, critical stakeholders as well as potential investors have continued to ask questions in relation to the effectiveness of Nigeria’s data protection law going by the series of infractions across the country. There are online loans giving outfits that have allegedly abused citizens’ rights to privacy of information and data. The NDPB has also carried out clamp-down operations against such platforms. But the advice to the public is that many of such outfits have no known or authentic addresses.
Interestingly, Data Protection Law is constitutionally captured in Nigeria. Section 37 of the 1999 Constitution as amended provides that: “The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”
In the same manner, the core rights of data subjects under the Nigeria Data Protection Regulation provide that a data subject has a right to be informed, right to access, right to object, right to data portability, right to erasure, right to restriction of processing, rights to rectification and rights regarding automated decision making.
It is evident that having such a law in place will align the country with scores of others around the globe and make Nigeria a global player, while the lack thereof is economically injurious.
According to Dr Olatunji, the risk of not having a principal act is enormous not least because the legal reliefs enforceable by citizens could be extremely difficult to obtain.
Dr Olatunji said: “First, it is about our reputation as a country. Individuals and organizations are moving almost everything into digital platforms. The foundation to anything you do online is your digital identity. You must have an identity.
“Furthermore, there are some countries that are regarded as whitelist countries. Mostly, these are countries that have their laws and supervisory authority in place. And there are some things you need to put in place to be able to qualify to get to that level.
“The opposite of a white list is the black list. This implies that countries that are not on the whitelist do not have adequate regulatory frameworks in place and they do not have independent supervisory authorities.
“Similarly, we have to address privacy breaches which result in identity theft and other abuses online. These are issues which are really important to any digital economy. But when you have a law in place, and you have a supervisory authority, there is a reasonable assurance that the rights and bona fide interests of all parties will be protected.
“There are strong signs that Nigeria will get it right eventually. The Nigeria Data Protection Bill has been transmitted to the National Assembly. ICT and Cybersecurity Committees members of both the Senate and House of Representatives have shown a strong commitment to the passage of the Bill.
“Nigerians will continue to keep their fingers crossed as stakeholders collaborate in ensuring that data privacy takes firm root in the overall interest of sustainable development in Nigeria.”
