Legal and Regulatory Responses to Processing of Personal Data in Nigeria

Description

ABSTRACT

Legal and Regulatory Responses to Processing of Personal Data in Nigeria

Dr. Adekemi Omotubora*

In recent years, private and public organisations in Nigeria have engaged in extensive processing of personal data. This involves the collection of information such as names, addresses, date of birth and biometric data and the storage of the information on multiple proprietary databases. The justifications for the collection include identity management, crime prevention and the security of payments and banking transactions. This paper examines the legal regime for privacy and security of personal data in Nigeria. It finds that although there is a constitutional provision protecting the right to privacy and there are a number of sector specific guidelines regulating data processing, these are inadequate to protect personal data. The paper argues that from a data protection perspective, inadequate regulation leads to the lack of accountability and irresponsible practice by organisations that process personal data. Based on a comparative study of the approaches to regulation of data processing in the EU and the US, this paper recommends the development of a general data protection law in Nigeria. It however proposes that in developing the law, two critical issues must be addressed; one, the relativeness and cultural context of privacy and how these affect the definition and scope of the concept of personal data. Two, the challenges of enforcement in view of the complexity and evolving nature of technology.

INTRODUCTION
The processing of personal data impugns the right to privacy and puts persons whose data are processed (data subjects) at risk. Such risks may arise from security breaches or theft of personal data if organisations collecting the data fail to take appropriate steps to safeguard the data. Therefore, calls for a comprehensive data protection law are justified in the face of recent large scale processing of personal data in Nigeria. This paper aims to contribute to this call but goes further by critically appraising the regulation of data processing from the perspective of how the law should be developed. It focuses in particular on the definition and scope of the concept of personal data.

The paper is divided into three sections. The first section examines the conceptual and theoretical underpinnings for data protection. It argues that in view of the nature and scope of data protection, the right to privacy under the constitution does not go far enough to protect personal data. The second section of the paper considers some specific activities that give rise to concerns about data protection and the extent to which existing regulations address these concerns. It is argued that although there are laws and regulations purporting to regulate data processing in Nigeria,₁ they also fail to define personal data in a manner that ensure meaningful protection. The final section of the paper is a comparative analysis of the approaches to data protection in the UK and US. Arguments in this section aim to justify the position that a single legislative framework (the omnibus law approach) provides better protection for personal data. The section concludes with recommendations on how to develop a workable and enforceable concept of personal data.

* Ph.D., BL. Lecturer, Department of Commercial and Industrial Law, University of Lagos.

1. These include the Nigeria Identity Management Act, 2007; Freedom of Information Act, 2011 and various sectoral regulations on data protection discussed below

THE GRAVITAS REVIEW OF BUSINESS & PROPERTY LAW VOL.8 NO.3