Nigeria needs a data protection law now

By Muhammad Mikailu

In today’s digital world, data is key to the extent that some scholars have termed ‘data as the new oil’. This speaks to the huge revenue potential data has for every country serious about growing its digital economy. Nigeria is certainly one. This data is in the form of personal information, which is frequently collected, stored, and shared by businesses, governments and individuals.

According to Professor Isa Ali Ibrahim Pantami, the  Minister of Communication and Digital Economy who spoke at the recently held maiden edition of the ‘Digital Economy Regional Conference’ in Abuja with the theme ‘Positioning West Africa’s Digital Economy for the Future’, “In the fourth industrial revolution, data is key. In 48 hours, the quantity of data generated globally is equal to the quantity of data that was generated within 5,000 years.”

However, without clear regulations to govern the use of such data, individuals and entities are left vulnerable to privacy violations such as data breaches, identity theft, and other forms of abuse. Today, it is a global best practice to have a data protection law in place, otherwise nations find it difficult to attract so many interventions beneficial to their countries.

A data-secured environment is an investment wonderland. This explains why many development partners, international financial institutions, critical stakeholders in the digital economy space and even potential investors today have continued to ask questions as to why Nigeria does not have a data protection law in place.

Nigerians Write EFCC To Arrest skit maker, Sabinus, For Promoting Ponzi Scheme

Nigeria needs a data protection law now

Having such a law in place will align the country with scores of others around the globe and make Nigeria a global player. Put differently, the costs of a lack of a proper data protection law are enormous.

To address this issue, the Federal Government of Nigeria established the Nigeria Data Protection Bureau (NDPB) in 2022 as the regulatory institution responsible for ensuring that people’s personal information is kept private and safe when used for ‘digital things.’

Furthermore, in January 2023, the Federal Executive Council (FEC) approved the Nigeria Data Protection Bill presented by the  Minister of Communication and Digital Economy for transmission to the National Assembly for consideration.

The draft data protection bill was sent to the National Assembly and read on the floors of both chambers on  April 4. The bill has gone through the first and second readings and sent to the ‘Committee of Whole’ in the National Assembly to harmonize positions from both chambers. This Bill will provide a legal framework for the protection of personal information, safeguard people’s basic rights and freedoms, and establish a data protection commission for the regulation of processing of personal information and data when passed into law.

The Draft Data Protection Bill was previously passed by the 8th Assembly, but President Muhammadu Buhari declined assent. This was due to concerns raised by stakeholders on some identified areas and clauses. So far, the Nigeria Data Protection, in collaboration with the Nigeria Digital Identification for Development Project (NDID4D) have been working with critical stakeholders, captains of industries and policymakers on addressing those concerns and perfecting the bill.

Recently, a validation workshop was held to present the draft bill to stakeholders for their buy-in, comments, criticism, and suggestions to improve the bill.  Senator Ibrahim Hossein, and Representative Lado Suleja both Chairman Senate and House Committee on ICT and Cybersecurity respectively, have on numerous outings conveyed the support and willingness of the National Assembly to diligently work on the bill to ensure speedy passage and eventual assent by the President.

‘Data Protection is a constitutional right in Nigeria’, is an oft-quoted statement of Prof. Pantami, the communications minister, as Section 37 of the 1999 Constitution as amended provides that: “The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”

In the same vein, the core rights of data subjects under the Nigeria Data Protection Regulation provide a data subject has a right to be informed, right of access, right to object, right to data portability, right to erasure, right to restriction of processing, rights to rectification and rights regarding automated decision making.

Thus, data protection law is urgently needed in Nigeria as citizens have had one form of data or the other compromised without the ease of recovery, leading to huge financial losses, reputational damage, revenue losses, and other forms of abuse.

This is pertinent, especially with the growing rate of identity theft, cyberstalking, data mining, theft, internet fraud and increasing reported cases of abuse of financial information by financial institutions, mobile service providers and telecom companies, unregulated loan credit companies and so on.

The current National Assembly needs to pass the data protection bill for President Buhari to assent to it before May 29. This will provide an additional layer of protection for the nation’s digital identity ecosystem and in no small measure safeguard the nation’s fast-growing digital economy, boost investor’s confidence, attract foreign direct investment, improve our GDP, and ensure robust protection and safeguarding of personal information from being stolen and misused for fraudulent purposes, reducing the incidence of identity theft and fraud as well as serve as a buffer for citizens’ personal data privacy.

Data is critical to the survival of every nation’s economy particularly in today’s digitised global home. It is on record that Nigeria is the first African country to join the developed countries in celebrating international data privacy day. This demonstrates the nation’s drive and willingness to take its pride of place as a leading African digital economy hub amongst the comity of nations.

The data protection law is not in any way meant to punish our citizens, but rather to create awareness so that we will all be data compliant. We are urged to comply. Today, because of awareness creation, collaboration amongst digital economy ecosystem partners, critical stakeholders in the data sphere, reaching out to institutions, sanctions, and interrogating others, the data protection and privacy compliance rate is on a steady increase.

Additionally, businesses and organisations will be held accountable for any data breaches or privacy violations, which will encourage them to take data protection seriously and implement proper measures to protect personal data.

The current National Assembly should take due credit and ensure the speedy passage of this lofty bill, and President Buhari should quickly assent to it for the good of posterity. For, the passage of a comprehensive data protection law in Nigeria is urgent and should not be delayed any further.