PREAMBLE:
In today’s digital age, data has become one of the most valuable assets for businesses and individuals alike. The rapid advancement of technology and the widespread use of the internet have made data protection a critical concern globally, including in Nigeria. With the increasing number of cyber threats and privacy breaches, it is essential for the Nigerian government, organizations and individuals to prioritize data protection measures. This article aims to explore the importance of data protection in Nigeria, the present steps being taken by the Nigerian government to ensure the security and privacy of personal and sensitive information as well as the challenges confronting said efforts of data protection in Nigeria.
The Need for Data Protection:
Data protection is the practice of safeguarding digital information from unauthorized access, accidental loss, disclosure and modification, manipulation or corruption throughout its entire lifecycle, from creation to destruction.[1] It is quintessential for several reasons, including:
- Privacy Preservation: Every individual shall have a fundamental right to privacy [2] and data protection ensures that personal and sensitive information is not misused, sold or exposed without consent. Protecting personal data contributes to a safer digital environment which in turn fosters trust among individuals, businesses and the government, leading to increased participation in online activities and e-commerce transactions.[3]
- Economic Growth and Innovation: A comprehensive data protection framework can drive economic growth and innovation. For example, immediately after Kenya’s 2019 Data Protection Act was promulgated, Amazon Web Services announced new investments in the country, including establishing part of its data cloud infrastructure in Nairobi. The company reportedly characterized the new law as paving the way for the investment, noting that it had been awaiting such a law for seven years. [4] It goes without saying that when individuals feel secure about sharing their data, businesses can collect and analyze valuable insights, leading to improved products and services. Furthermore, it can also attract foreign investment by showcasing Nigeria as a safe and secure digital environment.
- Cybersecurity: As the digital landscape evolves, cyberthreats are becoming more sophisticated and prevalent. [5] Such Data breaches can result in significant financial losses, reputational damage, identity theft etc. and only Effective data protection measures can help mitigate these risks and ensure the resilience of Nigeria’s digital infrastructure. [6]
Legal Framework for Data Protection in Nigeria:
The promulgation of the Nigeria Data Protection Regulation (NDPR) of 2019, followed by the establishment of the Nigeria Data Protection Bureau (NDPB) in 2022 no doubt marked significant milestones in data protection in Nigeria. However, Nigeria made massive strides in data protection on the 14th of June, 2023, when President Bola Tinubu, 2023 signed the Nigeria Data Protection Bill, 2023 into law [7]. The Nigeria Data Protection Act, 2023 (hereinafter referred to as the Act) provides a legal framework for the protection of personal information, and the practice of data protection in Nigeria.
Innovations of the Data Protection Act, 2023:
- Application: In contrast to the NDPR, it appears that the applicability of the Act is more focused on data controllers and processors and not data subjects. This may be a somewhat beneficial approach as it places a higher burden on data controllers and processors to ensure and safeguard sensitive information. The applicability of the Act also seemingly excludes Nigerians living abroad. [8]
- The Nigeria Data Protection Commission: The new law establishes the Nigeria Data Protection Commission and replaces the Nigeria Data Protection Bureau (NDPB) earlier established by President Buhari in February 2022. The Commission will be led by a National Commissioner with the responsibility for regulating the processing of personal information, investigating, implementing and imposing penalties in respect of any infraction of the provisions of the act. [9]
- Child Rights: The Act also includes specific consent requirements for children and persons lacking the legal capacity to consent. While the NDPR was silent on whom to obtain such consent from, under the Act, consent shall be obtained explicitly from parents or other appropriate legal guardians [10]. In order to effect this, the Act requires controllers and processors to adopt consent and age verification mechanisms. Furthermore, in a bid to guarantee stronger privacy protections for children, the Commission will create Regulations to guide the personal data processing of a child of 13 years and above in the course of their usage of online products and services. [11]
Challenges of Data Protection in Nigeria:
As Nigeria continues to embrace digital transformation, safeguarding data becomes an imperative responsibility, the following are some of the numerous challenges that hinder the effective protection of data in Nigeria;
- Inadequate Cybersecurity Infrastructure: Nigeria, like many developing countries, faces challenges in establishing robust cybersecurity infrastructure. A lack of necessary resources, technological expertise, and proper governance frameworks makes it difficult to combat cyber threats effectively. [12]
- Cybercrime and Hacking: Cybercriminals pose a significant threat to data security in Nigeria. Hacking incidents, data breaches, and ransomware attacks are on the rise, targeting private businesses, government institutions, and individuals. [13] In April, one of Nigeria’s most recognizable betting platforms, Bet9ja suffered a ransomware attack from BlakCat. In May, barely days after its launch in Nigeria, MoMo Payment Service Bank suffered a breach that reportedly led to $53 million in losses. In a more parallel case, in 2019, the Lagos Internal Revenue Service (LIRS) was accused of exposing personal data online through its web portal and was fined 1 million naira by NITDA. According to a 2022 report by Sophos, 71 percent of Nigerian organizations were hit by ransomware in the past year and yet some of Nigeria’s worst cybersecurity incidents are still not reported. [14]
- Lack of Data Protection Regulations: Until recently, Nigeria had no comprehensive data protection laws. The absence of robust legislation makes it challenging to hold entities accountable for data breaches and privacy violations.
- Limited Awareness and Training: Many individuals and organizations in Nigeria lack awareness of data security best practices. Proper training and education about data protection are essential to empower users to safeguard their information effectively.
- Insufficient Investment in Cybersecurity: The limited investment in cybersecurity infrastructure by both private and public sectors leaves critical data vulnerable to breaches and unauthorized access.
Recommendations for Effective Data Protection in Nigeria:
Having identified the various challenges facing the protection of data in Nigeria, this paper goes a step further to proffer viable solutions and recommendations for effective data protection in Nigeria.
- Enacting Strong Data Protection Laws: Nigeria has taken strides towards data protection by enacting the Nigerian Data Protection Act, 2023. However, ongoing efforts are needed to strengthen these laws and ensure their enforcement. Additionally, fostering international partnerships can help learn from global best practices. Additionally, as technology evolves, it is pertinent that policymakers continuously assess and update the legislation to keep pace with emerging risks and challenges. Frequent consultations with industry experts and other stakeholders can help identify areas of improvement and ensure the Data Protection Act remains relevant and effective in the long term.
- Enhancing Cybersecurity Infrastructure: According to a report by Sophos, a UK-based cybersecurity company, 86% of Nigerian organisations surveyed said they suffered cyberattacks in the last 12 months; the second-highest after India. [15] No doubt, investing in advanced cybersecurity infrastructure is crucial to detect and prevent these cyberthreats effectively.
- Promoting Cybersecurity Awareness and Training: Launching nationwide awareness campaigns on data protection, cybersecurity, and safe online practices can empower individuals and organizations to take an active role in safeguarding their data.
- Encouraging Public-Private Partnerships: Collaboration between the government and private sector can lead to innovative cybersecurity solutions. Incentives for businesses to invest in cybersecurity and data protection can bolster the nation’s overall security posture.
Conclusion:
Data protection is a crucial aspect of Nigeria’s digital transformation and by establishing robust data protection regulations, fostering a culture of responsible data handling, Nigeria can build trust and confidence in its digital ecosystem. Protecting personal information not only safeguards individual privacy but also stimulates economic growth and innovation which is a desperate need in our nation’s current economic plight. It is vital for individuals, organizations, and the government to work together to ensure the implementation and enforcement of effective data protection measures, thereby securing Nigeria’s position in the global digital landscape.
REFERENCE
[1] Sharon Shea, “What is Data Security? The ultimate Guide.” https://www.techtarget.com/Data security guide everything you-need to know.
[2] Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended)
[3] Nubani Bright Eenee Ph.D, “Nigeria Data Protection Act 2023: A Boon for the Nigerian Economy.”https://www.linkedin.com/pulse/nigeria-data-protection-act-2023-boon-nigerian-eenee-ph-d.
[4] https://policyaccelerator.uncdf.org/policy-tools/brief-data-protection-digital-economy
[5] https://www.linkedin.com/pulse/cyber-security-attacks-prediction-2024-digialert
[6] “Managing Digital Security and Privacy Risk” OECD digital economy papers No. 254 2016 (MINISTERIAL MEETING ON THE DIGITAL ECONOMY BACKGROUND REPORT)
[7] https://www.mondaq.com/nigeria/dataprotection/1332160
[8] Ibid
[9] Section 6 of the Nigeria Data Protection Act
[10] Section 31(1) of the Act
[11] Section 31(5) of the Act
[12] https://www.researchgate.net/publication/318668652
[13] https://parachute.cloud/cyber-attack-statistics-data-and-trends
[14] https://www.wired.com/story/nigeria-cybersecurity-issues/
[15] https://techcabal.com/2020/07/21/why-some-of-nigerias-worst-cyberattacks-are-not-reported/
By: Kelvin Erue, an Associate at Adedunmade Onibokun & Co.