An Examination of the Power to Legislate on Data Privacy under the Nigerian Constitution

Description

ABSTRACT

An Examination of the Power to Legislate on Data Privacy under the Nigerian Constitution

Agbada S. Agbada*

With the advance in technology, social media’s ubiquitous nature, and rapid growth in electronic transactions, personal data has become more easily accessible and vulnerable to exploitation and abuse. This incident of digital transformation of life and business poses severe risks to data subjects just as it provides a boost to electronic commerce and the profits of digital companies. The risks of abuse of data privacy by those with access to and in custody of personal data of others underline the imperative of data protection laws and regulations. In response to the urgent need for adequate data protection, the National Information Technology Development Agency (“NITDA”) issued the Nigerian Data Protection Regulations, 2019 (“NDPR”). Still, the NDPR is plagued with severe validity questions due to NITDA’s lack of powers to regulate data privacy. This article examines the powers of the National and States Houses of Assembly to legislate on data privacy to ascertain the scope and limits of powers of these legislative bodies on the subject. The article argues that the National Assembly has only limited powers over data privacy while the bulk of the power to legislate on the subject resides with the States Houses of Assembly.

Keywords: Data privacy, NITDA, 1999 Constitution, Technology, NDPR.

INTRODUCTION
With the advance in technology, social media’s ubiquitous nature, and rapid growth in electronic transactions, personal data has become more easily accessible and vulnerable to exploitation and abuse. This incident of digital transformation of life and business poses severe risks to data subjects just as it provides a boost to electronic commerce and the profits of digital companies. The risks of abuse of data privacy by those with access to and in custody of personal data of others underline the imperative of data protection laws and regulations. Different states and the European Union have enacted their versions of data protection laws and regulations to impose obligations on companies and individuals regarding custody, transfer, use etc., of personal data.

In response to the urgent need for adequate data protection laws, the National Information Technology Development Agency (“NITDA”) issued the Nigerian Data Protection Regulation, 2019 (“NDPR”), with the objectives of safeguarding the rights of natural persons to data privacy; to foster safe conduct of transactions involving the exchange of personal data; to prevent manipulation of personal data; and to ensure the competitiveness of Nigerian businesses through the safeguards afforded by a just and equitable framework on data protection.₁ However, the author had argued in a previous article that the NDPR is invalid because the National Information Technology Development Agency Act, 2007, under which

*Associate at Streamsowers & Köhn, Lagos Nigeria. The author can be reached at st************@ya***.uk

1. See NDPR, art 1.1 115 accessed 30 May 2022.

THE GRAVITAS REVIEW OF BUSINESS & PROPERTY LAW VOL.13 NO.2