A Bird’s Eye Rundown of Nigeria’s Data Protection Legal and Institutional Model

Description

ABSTRACT

A Bird’s Eye Rundown of Nigeria’s Data Protection Legal and Institutional Model

Olumide Babalola*

Prior to the issuance of the Nigeria Data Protection Regulation (NDPR) in January 2019, a somewhat handful of academic articles had been published on data protection in Nigeria as a subject. Two years after, not so much has changed in terms of scholarly intervention on the piece of legislation. In a descriptive style, this article provides a synopsis of the Nigerian data protection legal system as envisaged by NDPR alongside other sectoral and general data protection enactments. The article chronicles the rather humdrum origin of data protection in the country vis a vis its current legal and regulatory enforcement mechanism. With some mild and interjectory comparisons with the GDPR model, the article succinctly explains how the NDPR works or ought to work.

Keywords: Personal data, Data protection, NDPR, Enforcement mechanism, Overview, Nigeria.

INTRODUCTION
Nigeria has had a subsidiary data protection legislation for over two years, but her legal framework around the subject lacks holistic academic appraisal to date. The Nigeria Data Protection Regulation1 (NDPR), which remains the country’s most comprehensive piece of legislation on data protection, substantially mirrors the EU General Data Protection Regulation in its scope, definitions, principles of processing and enforcement mechanism, albeit not without its teething problems.2 Being the twenty-fifth country to regulate data protection in Africa, expectations are unsurprisingly high on Nigeria’s model of redress and enforcement mechanisms. However, it
remains doubtful if any scholarly paper has been written on the NPDR’ classic,’ particularly concerning the data protection ecosystem in Nigeria.3

This article briefly narrates the origin of data protection in Nigeria by capturing the legislative and administrative trajectory en route issuance of the NDPR.4

** LL.B, BL. Managing Partner, Olumide Babalola LP, Nigeria; Secretary, Human Rights Committee, Nigerian Bar Association, Lagos Branch; Member, International Association of Privacy Professionals (IAPP); Member, International Network of Privacy Law Professionals (INPLP). The author is indebted to Dr. Abubakri Yekini (Lagos State University, Nigeria), Iheanyi Nwankwo (Leibniz Universität, Hannover, Germany) and Ajibike Babalola for making invaluable comments on the draft of this article

1. Nigeria Data Protection Regulation (NDPR) was released by the National Information Technology Development Agency (NITDA) on 25 January 2019. Although, a subsidiary legislation, it is Nigeria’s only enactment wholly dedicated to data protection.
2. Graham Greanleaf, ‘Nigeria Regulates Data Privacy: African and Global Significance’ (2019) 158 Privacy Laws & Business International Report 23; [2019] UNSWLRS 66.
3. Nigeria comes behind Caper Verde (2001), Burkina Faso, Tunisia, Mauritius (2004), Senegal (2008), Benin, Morocco (2009), Angola, Gabon, Lesotho (2011), Ghana (2012), Cote d’Ivoire, Mali, South Africa (2013), Chad, Madagascar (2015), Equatorial Guinea, Guinea Conakry, Malawi, Mauritania (2016), Niger (2017), Algeria, Botswana, Kenya (2018).
4. Here, this article deliberately underplays the nexus between privacy and data protection so as to avoid 27 any conflation in the history of the closely linked concepts.

THE GRAVITAS REVIEW OF BUSINESS & PROPERTY LAW VOL.12 NO.2