Nigeria Data Protection Regulation Performance Report

Nigeria Data Protection Regulation

Performance Report2O19-2O2O

PREFACENigeria took a turn for an exciting and refreshing phase on 28th November, 2019 when President Muhammadu Buhari GCFR, launched the National Digital Economy Policy and 6WUDWHJ\��1'(36��ǳ��7KH�3ROLF\�KDV�OHG�WR�WKH�DFWLYDWLRQ�RI�PDQ\�ODWHQW�ODZV�DQG�LQLWLDWLYHV�WKDW�ZHUH�KLWKHUWR�XQGHUSHUIRUPLQJ�RU�XQGHUYDOXHG��7KH�YLVLRQ�RI�WKH�1'(36�LV�to transform Nigeria into a leading digital economy, creating sustainable wealth and oppor-WXQLWLHV�IRU�DOO��7R�GULYH�WKH�GLJLWDO�HFRQRP\�SROLF\��WKH�)HGHUDO�0LQLVWU\�RI�&RPPXQLFDWLRQV��which was renamed Federal Ministry of Communications and Digital Economy in 2019, ZDV�KDQGHG� WKH�PDQGDWH�� 7KH�0LQLVWU\� RYHUVHHV� WKH�1DWLRQDO� ,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\��1,7'$��

1'(36�KDV�HLJKW�SLOODUV��'HYHORSPHQWDO�5HJXODWLRQ��'LJLWDO�/LWHUDF\��6NLOOV��6ROLG�,QIUDVWUXF-WXUH��6HUYLFH�,QIUDVWUXFWXUH��'LJLWDO�6HUYLFHV�'HYHORSPHQW��3URPRWLRQ��6RIW�,QIUDVWUXFWXUH��'LJLWDO�6RFLHW\��(PHUJLQJ�7HFKQRORJLHV��DQG�,QGLJHQRXV�&RQWHQW�'HYHORSPHQW��$GRSWLRQ��7KH�1LJHULD�'DWD�3URWHFWLRQ�5HJXODWLRQ��1'35��IDOOV�XQGHU�WKH�ILUVW�SLOODU��'HYHORSPHQWDO�5HJXODWLRQ��7KH�REMHFWLYH�RI�WKLV�SLOODU�LV�WR�HQVXUH�DQ�HIIHFWLYH�UHJXODWRU\�RYHUVLJKW�RI�WKH�information, communication, technology and digital economy space to engender acceler-DWHG�DQG�LQFOXVLYH�GHYHORSPHQW�

1,7'$ŖV�LPSOHPHQWDWLRQ�RI�WKH�1'35�KDV�EHHQ�LQIOXHQFHG�E\�WKH�RYHUDOO�SROLF\�REMHFWLYH�RI�WKH�1'(36��(YHU\�UHJXODWLRQ�LVVXHG�PXVW�JR�EH\RQG�PHUH�SURVFULSWLRQ�RU�SUHVFULSWLRQ�RI�DFWLRQV�WR�XQOHDVKLQJ�WKH�WUHPHQGRXV�SRVVLELOLWLHV�LQQDWH�LQ�HYHU\�1LJHULDQ��7KH�1'35�as a subsidiary legislation was innovatively crafted to match all the foundational principles of data protection from the Convention 108+, the Malabo Convention on Cybersecurity and 'DWD�3URWHFWLRQ�WR�WKH�*HQHUDO�'DWD�3URWHFWLRQ�5HJXODWLRQ��*'35��+RZHYHU��WKH�UHJXODWLRQ�further creates huge economic possibilities for professionals, while improving the ease of GRLQJ�EXVLQHVV�LQ�1LJHULD�

7KLV�1'35�3HUIRUPDQFH�5HSRUW�� EHLQJ� WKH� ILUVW� RI� LWV� NLQG� LV� DLPHG� DW�KLJKOLJKWLQJ� NH\�LQLWLDWLYHV��VXFFHVVHV�DQG�FKDOOHQJHV�RI�LPSOHPHQWLQJ�WKH�5HJXODWLRQ��7KH�1'35�EHLQJ�D�flagship of the NDEPS, is expected to be used as a learning curve for Nigeria and Africa on how to effectively implement global laws with due consideration of local peculiarities and RSSRUWXQLWLHV�

3

NIGERIA DATA PROTECTION REGULATION PERFORMANCE REPORT (2019-2020)

NATIONAL INFORMATION TECHNOLOGY DEVELOPMENT AGENCY

Muhammadu Buhari, GCFRPresident, Federal Republic of Nigeria

On 28th November, 2019, directed all Ministries, Departments and Agencies RI�JRYHUQPHQW�WR�FRPSO\�ZLWK�WKH�1LJHULD�'DWD�3URWHFWLRQ�5HJXODWLRQ��1'35�

NIGERIA DATA PROTECTION REGULATION IMPLEMENTATION REPORT (2019-2020)

4


Dr. Isa Ali Ibrahim Pantami, FNCS, FBCS, FIIMMinister of Communications and Digital Economy

2Q��WK�1RYHPEHU��VLJQHG�WKH�1LJHULD�'DWD�3URWHFWLRQ�5HJXODWLRQ��1'35��DQG�KDV�championed the NDPR implementation in Nigeria

5



Kashifu Inuwa Abdullahi, CCIEDirector General / CEO, NITDA

2Q��WK�0D\��VLJQHG�WKH�*XLGHOLQHV�IRU�0DQDJHPHQW�RI�3HUVRQDO�'DWD�E\�3XEOLF�,QVWLWXWLRQV��+H�DOVR�LVVXHG�WKH�ŰUVW�'DWD�EUHDFK�ŰQH�LQ�1LJHULDŖV�KLVWRU\


6


TABLE OF CONTENTS

3UHIDFH� �

From the Director General 8

7KH�6WDWH�RI�'DWD�3URWHFWLRQ�LQ�1LJHULD� �

By the Numbers 10

Achievements 12

Capacity Building and Awareness 14

An Analysis of Audits Filed on Sectoral Basis 15

Cooperation and Partnerships 16

Compliance and Enforcement 17

1'35�$XGLW�&RPSOLDQFH�E\�1,7'$� ��

Key Reforms 19

Data Protection Compliance Organisations 20

Notes on Filed Audit Reports 21

Challenges 22

&RXUW�&DVHV�5HODWLQJ�WR�1'35�,PSOHPHQWDWLRQ� ��

Academic Publications and Opinions 25

Press Gallery 26

Video Links & Podcasts 26

7KH�)XWXUH�RI�'DWD�3URWHFWLRQ�LQ�1LJHULD� ��

3HUVRQDO�'DWD�DV�&DWDO\VW�IRU�WKH�'LJLWDO�(FRQRP\� ��

7



From the Director General

7KH�LVVXDQFH�RI�WKH�1LJHULD�'DWD�3URWHFWLRQ�5HJXODWLRQ��E\�P\�SUHGHFHVVRU�'U��,VD�$OL�,EUDKLP�3DQWDPL��WKH�+RQ��0LQLVWHU�IRU�&RPPXQLFDWLRQV�DQG�'LJLWDO�(FRQRP\��ZDV�D�WXUQLQJ�SRLQW�LQ�WKH�KLVWRU\�RI�GDWD�SURWHFWLRQ�LQ�1LJHULD��7KH�

1'35�WHVWHG�RXU�FDSDFLW\�IRU�UHJXODWRU\�LPSOHPHQWDWLRQ�WR�WKH�KLOW��7KH�1'35�LV�XQLTXH�in its implementation model which innovatively uses private sector professionals WR� � DFW�DV�'DWD�3URWHFWLRQ�&RPSOLDQFH�2UJDQLVDWLRQV� �'3&2V�� WKHUHE\�DFFHOHUDWLQJ�FRPSOLDQFH�DQG�FUHDWLQJ�D�WXUQ�NH\�VHFWRU��

,�DP�SURXG�RI�WKH�PRGHVW�VWULGHV�ZH�KDYH�PDGH�LQ�WKH�VKRUW�SHULRG�RI�LPSOHPHQWDWLRQ��Our success says a lot about what we can do, as a nation, if we believe and trust in our \RXQJ�SHRSOH��SULYDWH�VHFWRU�DQG�SXEOLF�VHUYLFH��,QGHHG��WKH�1'35�KDV�EHHQ�GULYHQ�E\�WKH�HQHUJ\�DQG�YLVLRQ�RI�RXU�GHGLFDWHG�WHDP�DW�WKH�1DWLRQDO�,QIRUPDWLRQ�7HFKQRO-RJ\�'HYHORSPHQW�$JHQF\��1,7'$��FRXSOHG�ZLWK�WKH�ZLVH�OHDGHUVKLS�SURYLGHG�E\�RXU�VXSHUYLVRU\�0LQLVWU\�

Our goal in this report is to give all stakeholders the opportunity to understand how we KDYH�IDUHG�LQ�WKH��LPSOHPHQWDWLRQ�RI�WKH�1'35��7KLV�XQGHUVWDQGLQJ�ZRXOG�JHQHUDWH�further research and provide guidance to other regulators, partners, data controllers, GDWD�SURFHVVRUV�DQG�DOO�RWKHU�VWDNHKROGHUV��$V�SDUW�RI�WKLV�UHSRUW��ZH�KDYH�PDGH�D�FRP-SLODWLRQ�RI�DOO�WKH�RUJDQLVDWLRQV�ZKR�ILOHG�WKHLU�DQQXDO�DXGLW�UHSRUW�IRU�WKH�\HDU��While the submission of an audit report does not conclusively indicate compliance with all tenets of data protection, this list shows organisations who have complied ZLWK�WKH�DXGLW�ILOLQJ�UHTXLUHPHQW�RI�WKH�1'35��ZKLFK�LV�D�NH\�PLOHVWRQH�WRZDUGV�FRP-SOLDQFH��,W�LV�LPSRUWDQW�WR�QRWH�WKDW�QRQ�ILOLQJ�RI�WKH�1'35�DXGLW�UHSRUW�LV�D�EUHDFK�RI�WKH�5HJXODWLRQ��,�XUJH�RUJDQLVDWLRQV�ZKR�PLVVHG�WKH�DXGLW�ILOLQJ�IRU��WR�SULRULWLVH�FRPSOLDQFH�IRU��DQG�EH\RQG��

We do appreciate your support and seek further collaboration and cooperation as we FRQWLQXH�WR�EXLOG�1LJHULDŖV�GLJLWDO�HFRQRP\�WR�EHFRPH�WKH�F\QRVXUH�RI�DOO�H\HV�

Kashifu Inuwa Abdullahi, CCIE

Director General/CEO, 1,7'$

EDITORIAL TEAM'U��9LQFHQW�2ODWXQML��1,7'$

Olufemi Daniel CDPO��1,7'$

,EUDKLP�<HNX��&&(3�,


8


Data has become the most critical resource in the Digital (FRQRP\��:LWK�WKH�GLJLWDO�HFRQRP\�DFFRXQWLQJ�IRU��RI�the GDP, the value of personal, economic, social and other

GDWD�W\SHV�ZRXOG�FRQWLQXH�WR�VXUJH��5HJXODWLQJ�WKH�XVH�RI�SHUVRQDO�data became critical for a number of reasons which include the prevalence of transactional internet, that has brought about ris-ing violations of privacy rights by digital companies; the need for Nigerian businesses to show compliance with international data SURWHFWLRQ�ODZV��DPRQJ�RWKHUV�

7KH�1'35�ZDV�LVVXHG�RQ��WK�-DQXDU\��SXUVXDQW�WR�6HFWLRQ��D�F��RI�WKH�1,7'$�$FW��7KH�5HJXODWLRQ�FRYHUV�HYHU\�SHUVRQ�VXEMHFW�WR�WKH�ODZV�RI�1LJHULD��ZKHWKHU�UHVLGHQW�LQ�1LJHULD�RU�QRW��,W�LV�aimed at safeguarding the rights of persons to privacy; fostering safe conduct for the transactions involving the exchange of personal data; preventing manipulation of personal data; and ensuring that Nigerian businesses remain competitive in international trade through the safe-JXDUGV�DůRUGHG�E\�D�MXVW�DQG�HTXLWDEOH�OHJDO�UHJXODWRU\�IUDPHZRUN��

6LQFH�WKH�LVVXDQFH�RI�WKH�1'35��1LJHULD�KDV�WXUQHG�D�VLJQLŰFDQW�FRUQHU�LQ�KHU�GULYH�WRZDUGV�WKH�PDWXUDWLRQ�RI�WKH�'LJLWDO�(FRQRP\��7KH�OHYHO�RI�FRPSOLDQFH�LV�JURZLQJ�DV�VKRZQ�LQ�D�NH\�FRPSOLDQFH�LQGLFDWRU�ZKLFK�UHTXLUHV�WKH�ŰOLQJ�RI�D�GDWD�DXGLW�UHSRUW�E\�HYHU\�GDWD�FRQWUROOHU�DQG�SURFHVVRU��$UWLFOH��RI�WKH�5HJXODWLRQ�UHTXLUHV�WKH�ŰOLQJ�RI�DQ�LQLWLDO�GDWD�DXGLW�UHSRUW�DQG�D�VXEVHTXHQW�DQQXDO�DXGLW�UHSRUW�E\�HYHU\�GDWD�FRQWUROOHU�DQG�SURFHVVRU��7KLV�SURFHVV�KDV�KHOSHG�1,7'$�WR�KDYH�DQ�RYHUYLHZ�RI�WKH�VWDWH�RI�GDWD�JRYHUQDQFH�in the reporting entity while also helping government understand UHTXLVLWH�LQWHUYHQWLRQ�SRLQWV�WR�LPSURYH�GDWD�JRYHUQDQFH��F\EHU�VH-FXULW\�DQG�SULYDF\�SURWHFWLRQ��7KH�LQLWLDO�DXGLW�UHSRUW�DQG�WKH��audit report were merged for the purpose of reducing compliance EXUGHQ��6XEVHTXHQW�DQQXDO�UHSRUWV�DUH�UHTXLUHG�WR�EH�ŰOHG�RQ�RU�EHIRUH��WK�0DUFK�RI�HYHU\�\HDU��

Before the introduction of the NDPR, no Nigerian entity could boast RI�FRPSOLDQFH�ZLWK�GDWD�SURWHFWLRQ� ODZV��6HOHFWHG�PXOWLQDWLRQDOV�had some level of compliance imposed on them by their parent

FRPSDQLHV��7KLV�KRZHYHU�FKDQJHG�GUDVWLFDOO\�EHWZHHQ��ǳ��WKH�\HDU�XQGHU�UHYLHZ��)URP�QHDU�]HUR�FRPSOLDQFH��WKH�FRXQWU\�KDV�UHFRUGHG�DQ�LPSUHVVLYH�JURZWK�LQ�GDWD�SURWHFWLRQ�FRPSOLDQFH��1LJHULD�QRZ�KDV�D�YHULŰDEOH�GDWDEDVH�RI�VWDWXWRU\�DXGLW�UHSRUWV�ŰOHG�E\��HQWLWLHV��$VLGH�WKH�DXGLW�UHSRUW�LQGLFDWRU��RXU�VXUYHLOODQFH�FRQŰUPV�WKH�JURZLQJ�UDWH�RI�FRPSOLDQFH�ZLWK�WKH�1'35�DFURVV�YDULRXV�VHFWRUV��7KLV�LV�D�PDMRU�OHDS�FRQVLGHULQJ�WKH�SDXFLW\�RI�IXQGV��WKH�OLPLWHG�WLPH�IRU�HQWLWLHV�WR�DWWDLQ�FRPSOLDQFH��LQDGHTXDWH�DZDUHQHVV�DQG�YDULRXV�FKDOOHQJHV�IDFHG�E\�DOO�VWDNHKROGHUV��

1,7'$��DV�WKH��UHJXODWRU��KDG�VRPH�LQLWLDO�UHVLVWDQFH�IURP�YDULRXV�TXDUWHUV�DV�WR�LWV�VWDWXWRU\�SRZHUV�DQG�FDSDFLW\�WR�LPSOHPHQW�WKH�1'35��+RZHYHU��1,7'$ŖV�LQQRYDWLYH�DSSURDFK�WR�WKH�1'35�LPSOH-PHQWDWLRQ�KDV�EHHQ�YDOLGDWHG�E\�FULWLFDO�VWDNHKROGHUV�VXFK�DV� ,Q-WHUQDWLRQDO�2UJDQLVDWLRQV��'DWD�3URWHFWLRQ�2ŲFHUV��'32V��DQG�'DWD�3URWHFWLRQ�&RPSOLDQFH�2UJDQLVDWLRQV��'3&2V��ZKR�UHSUHVHQW�WKH�RUJDQLVDWLRQV�PRVW�LPSDFWHG�E\�WKH�1'35��1,7'$ŖV�UROH�LQ�SLRQHHULQJ�data protection is pivotal, as the experiences garnered so far would EH�RI� LPPHQVH�EHQHŰW�WR�DQ\�VXFFHHGLQJ�RUJDQLVDWLRQ�KDYLQJ�DQ�RYHUVLJKW�RYHU�GDWD�SURWHFWLRQ��

,Q�D�VXUYH\�FRQGXFWHG�LQ�-XO\��RI�WKH�UHVSRQGHQWV�RSLQHG�WKDW�WKH�1'35�PHW�WKH�QHHG�RI�WKH�1LJHULDQ�HQYLURQPHQW��VDLG�WKH�XQLTXH�LQWURGXFWLRQ�RI�'DWD�3URWHFWLRQ�&RPSOLDQFH�2UJDQLVDWLRQV��'3&2V��KHOSHG�LQ�WKHLU�FRPSOLDQFH�ZLWK�WKH�1'35��QRWHG�WKDW�1,7'$�KDV�SURYLGHG�UHTXLVLWH�VXSSRUW�IRU�LQGXVWU\�DGRSWLRQ�RI�WKH�1'35��7KH�UDWH�RI�SXEOLF�DZDUHQHVV�ZDV�SXW�DW��RI�WKH�respondents stated that compliance with the NDPR enhances good SHUFHSWLRQ�DERXW�WKHLU�EXVLQHVV��5HVSRQGHQWV�ZDQW�WKH�UHJXODWRU�WR�work towards the increase of public awareness, upgrade the NDPR to an Act of the National Assembly and enforce punitive sanctions for non-compliance

7KLV�IHHGEDFN�ZRXOG�KHOS�1,7'$��WKH�)HGHUDO�0LQLVWU\�RI�&RPPXQLFD-WLRQV�DQG�'LJLWDO�(FRQRP\��)0R&'(��UHOHYDQW�JRYHUQPHQW�$JHQFLHV�DQG�WKH�1DWLRQDO�$VVHPEO\�WR��HůHFWLYHO\�GLUHFW�SROLF\��UHVRXUFHV�DQG�OHJLVODWLRQV�WR�EXLOG�RQ�WKH�VXFFHVVHV�DOUHDG\�DWWDLQHG�

1.O STATE OF DATA PROTECTION IN NIGERIA

9



2.O BY THE NUMBERS

SectorsRepresented

N12,650,000 Was Paid ToFederal Government For For Filing Of NDPRAudit Report

N12.6m7Data Controllers

Scheduled ForImmediate Enforcement

Compliance &Enforcement

Notices Issued

13

Jobs Created ThroughNDPR Implementation

2686

Highest Compliance:Financial Services Sector

36.3%

N2,295,240,000 Is The Value Of The NDPR Audit Market

N2.2B230

93NDPR EventsFacilitated

IssuesResolved

790

1230Phone CallsIn 15 Months

Fines Issued &Collected

1m

InvestigationsConducted OnAlleged DataBreaches15

InvestigationConcluded1

635Audit Filings

Received


10


SectorsRepresented

N12,650,000 Was Paid ToFederal Government For For Filing Of NDPRAudit Report

N12.6m7Data Controllers

Scheduled ForImmediate Enforcement

Compliance &Enforcement

Notices Issued

13

Jobs Created ThroughNDPR Implementation

2686

Highest Compliance:Financial Services Sector

36.3%

N2,295,240,000 Is The Value Of The NDPR Audit Market

N2.2B230

93NDPR EventsFacilitated

IssuesResolved

790

1230Phone CallsIn 15 Months

Fines Issued &Collected

1m

InvestigationsConducted OnAlleged DataBreaches15

InvestigationConcluded1

635Audit Filings

Received

11



NITDA appointed as the Vice Chair of the African Union

(Policy and Regulatory Initiative for Digital

Africa- PRIDA) Working Group on Data Protection

Harmonisation and Localisation.

Lagos Internal Revenue Service breach investigated

for which reprimand and ŰQH�RI�2QH�0LOOLRQ�QDLUD�ZDV�LVVXHG��7KLV�FDVH�LV�WKH�ŰUVW�successful data breach case

closed under the NDPR.

Data Protection sector is valued at N2,295,240,000 (using the median value of

audit implementation cost)

3.O ACHIEVEMENTS

The Federal Government earned the sum of

N12,650,000 from DPCO licensing and Audit report

ŰOLQJ�

Creation of over 2,686 new job roles.

Inauguration of Data Breach Investigation Team in

FRQMXQFWLRQ�ZLWK�WKH�RŲFH�of the Inspector General

of Police.


12


Issuance of 230 compliance and enforcement notices.

8 data breach cases initiated and deposited with the

Police.

Over 790 issues were resolved.

70 Data Protection Compliance Organisations

licenced.

Guidelines on the Use of Personal Data by Public

Institutions, 2020 issued.

Launch of the NDPR Portal IRU�ŰOLQJ�RI�DXGLW�UHSRUWV�DQG�

reporting of breaches.

The NDPR Implementation Framework 2020 issued.

A public advisory was issued on Truecaller service,

leading to the review and improvement of the Privacy

Policy. NITDA made inputs to the updated privacy policy.

13



MINING

61%

PUBLIC SECTOR

173%

AGRICULTURE

29

ENERGY

6510%

1%

35%

5%

HEALTH

264%

CONSTRUCTION

91%

MANUFACTURING / FMGG

92ICT

558%

FINANCIAL SERVICES

220

CONSULTANCY549%

TRADE & EDUCATION

7REAL ESTATE

224%

14%

TRANSPORT & LOGISTICS

335%

TOTAL:635/100%

NITDA officials participated in 93 public and private sector organised events some of which include:• 6HFXULW\�DQG�([FKDQJH�&RPPLVVLRQ�ZHELQDU�RQ�1'35�

• &KLHI�,QIRUPDWLRQ�2ŲFHUV�RI�%DQNV�)RUXP��&%1��

• &KDUWHUHG�,QVWLWXWH�RI�%DQNHUV�RI�1LJHULD�VHPLQDU�RQ�1'35�

• ,QVWLWXWH�RI�'LUHFWRUV��,R'��ZHELQDU�RQ�1'35�

• 1LJHULD�&RPSXWHU�6RFLHW\��1&6��RUJDQLVHG�SXEOLF�DZDUHQHVV�RQ�WKH�1'35�

• $EXMD�&KDPEHU�RI�&RPPHUFH�DQG�,QGXVWU\��$&&,��RUJDQL]HG�D�URXQGWDEOH�RQ�WKH�(XURSHDQ�8QLRQ�*HQHUDO�'DWD�3URWHFWLRQ�5HJXODWLRQ��(8�*'35��

• American Business Council workshop on the Data 3URWHFWLRQ�%LOO�

• Lagos State Government Ministries, Department and $JHQFLHV�WUDLQLQJ�RQ�1'35�

• DPCO-organised awareness workshops and seminars on WKH�1'35�

NITDA hosted the following capacity building and awareness events• Privacy Week 2020 featured schools debate, media

campaign, national symposium and press conference

• 6WDNHKROGHUVŖ�ZRUNVKRS�RQ�WKH�1'35�,PSOHPHQWDWLRQ�)UDPHZRUN��/DJRV�DQG�$EXMD

• 'DWD�3URWHFWLRQ�2ŲFHUVŖ�WUDLQLQJ��/DJRV�

• '3&2�ZRUNVKRS��$EXMD

• 0HGLD�([HFXWLYHVŖ�:RUNVKRS��$EXMD

• 1,7'$ŖV�JHQHUDO�VWDů�WUDLQLQJ�RQ�WKH�1'35

• 3HUVRQDO�,QIRUPDWLRQ�0DQDJHPHQW�6\VWHPV�WUDLQLQJ�IRU�VHOHFWHG�VWDů

4.O CAPACITY BUILDING AND AWARENESS

$VWXWH�0RQWHVVRUL�6FKRRO��.XMH��&KDPSLRQV��-XQLRU��1DWLRQDO�3ULYDF\�:HHN�'HEDWH�&RPSHWLWLRQ��-DQXDU\��


14


MINING

61%

PUBLIC SECTOR

173%

AGRICULTURE

29

ENERGY

6510%

1%

35%

5%

HEALTH

264%

CONSTRUCTION

91%

MANUFACTURING / FMGG

92ICT

558%

FINANCIAL SERVICES

220

CONSULTANCY549%

TRADE & EDUCATION

7REAL ESTATE

224%

14%

TRANSPORT & LOGISTICS

335%

TOTAL:635/100%

5.O ANALYSIS OF AUDITS FILED ON SECTORAL BASIS

15


A. African Union PRIDA Project1,7'$�ZDV�QRPLQDWHG�E\�WKH�)0R&'(�WR�UHSUHVHQW�1LJHULD�RQ�WKH�3ROLF\�DQG�5HJXODWRU\�,QLWLDWLYH�IRU�'LJLWDO�$IULFD��35,'$��ZRUN�JURXS�RQ�'DWD�3URWHFWLRQ�/DZV�+DUPRQLVDWLRQ�DQG�/RFDOLVDWLRQ�KRVWHG�E\�WKH�$IULFDQ�8QLRQ�&RPPLVVLRQ��1,7'$�ZDV�DSSRLQWHG�DV�WKH�Vice-Chair of the group which comprises 26 African countries and WKH�(XURSHDQ�8QLRQ�&RPPLVVLRQ�UHSUHVHQWDWLYHV��

7KH�JURXS�KDV�GUDZQ�XS�D�IUDPHZRUN�WR�KDUPRQLVH�GDWD�SURWHF-tion laws on the continent, highlighting the economic and social REMHFWLYHV��JRDOV�DQG�LQGLFDWRUV��7KH�GUDIW�IUDPHZRUN�LV�FXUUHQWO\�EHLQJ�WHVW�UXQ�LQ�ŰYH�VHOHFWHG�FRXQWULHV�DIWHU�ZKLFK� LW�ZRXOG�EH�UHSOLFDWHG�LQ�RWKHU�$IULFDQ�FRXQWULHV�

B. Participation at the Africa Forum Hosted by Hogan Lovells LLP

7KH�$JHQF\�ZDV�LQYLWHG�WR�VSHDN�DW�WKH�$IULFD�)RUXP�KRVWHG�DQQX-DOO\�E\�+RJDQ�/RYHOOV��DQ�LQWHUQDWLRQDO�ODZ�ŰUP�ZLWK�RŲFHV�LQ��FRXQWULHV��7KH�)RUXP�DůRUGHG�1LJHULD�DQ�RSSRUWXQLW\�WR�VSHDN�RQ�WKH�VWULGHV�EHLQJ�PDGH�IROORZLQJ�WKH�LPSOHPHQWDWLRQ�RI�WKH�1'35��7KH�HYHQW�RSHQHG�1LJHULD�XS�WR�LQYHVWPHQW�HQTXLULHV�WKHUHE\�DWWUDFWLQJ�a wide array of international investors to explore opportunities in WKH�1LJHULDQ�GLJLWDO�HFRQRP\�VSDFH�

C. Participation at the American Business Council Workshop on Data Protection

7KH�$JHQF\�VSRNH�DQG�SDUWLFLSDWHG�DFWLYHO\�DW�WKH�$PHULFDQ�%XVLQHVV�&RXQFLO�ZRUNVKRS�RQ�'DWD�3URWHFWLRQ��1,7'$ŖV�SRVLWLRQ�RQ�GDWD�protection for Nigeria was strongly canvassed while getting other SHUVSHFWLYHV�WR�PDNH�WKH�FXUUHQW�LQLWLDWLYHV�VWURQJHU�

D. Exploratory Meeting with the European Data Protection Office (EDPO)

7KH�$JHQF\�PHW�ZLWK�RŲFLDOV�RI�WKH�('32�DW�WKH��HGLWLRQ�RI�*XOI�,QWHUQDWLRQDO�7HFKQRORJ\�([SR��*,7(;��7KH�PHHWLQJ�VRXJKW�to initiate partnership to enable Nigerian data controllers who de-

VLUH�WR�GHDO�ZLWK�(XURSHDQ�GDWD�VXEMHFWV�SHUVRQDO�GDWD��WR�PHHW�WKH�UHTXLUHPHQW�RI�$UWLFOH��RI�WKH�*'35��ZKLFK�UHTXLUHV�WKH�SUHVHQFH�RI�D�ORFDO�UHSUHVHQWDWLYH�IRU�D�IRUHLJQ�GDWD�FRQWUROOHU�

E. NITDA-Central Bank of Nigeria (CBN) Cooperation on Data Protection

1,7'$�DQG�WKH�&%1�KDYH�HQJDJHG�LQ�D�VHULHV�RI�PHHWLQJV�WR�H[SORUH�the possibilities of harmonising and deepening data protection FRPSOLDQFH�LQ�WKH�EDQNLQJ�VHFWRU��7KLV�LV�EHDULQJ�IUXLW�DOUHDG\�DV�WKH�ŰQDQFLDO�VHFWRU�UHFRUGHG�WKH�KLJKHVW�OHYHO�RI�GDWD�DXGLW�UHSRUW�ŰOLQJ��DFFRXQWLQJ�IRU��RI�WRWDO�ŰOLQJV�

F. NITDA- Securities and Exchange Commission (SEC) Cooperation on Data Protection

7KH�6(&�RUJDQLVHG�D�ZHELQDU� IRU�&DSLWDO�0DUNHW�2SHUDWRUV��7KH�event had Management of SEC and 590 participants in the audi-HQFH��1,7'$�DQG�6(&�KDYH�DJUHHG�WR�ZRUN�WRJHWKHU�WR�DFFHOHUDWH�GDWD�SURWHFWLRQ�FRPSOLDQFH�LQ�WKH�FDSLWDO�PDUNHW�

G. NITDA-MDAs Cooperation on Data Protection1,7'$�KDV�EHHQ�HQJDJHG�WR�KHOS�YDULRXV�0'$V�WRZDUGV�FRPSOL-DQFH�ZLWK�WKH�1'35��7KH�$JHQF\�KDV�EHHQ�SURYLGLQJ�DGYLVRU\�DQG�FDSDFLW\�EXLOGLQJ�VXSSRUW�IRU�VHOHFWHG�0'$V�DQG�VHFXULW\�DJHQFLHV�

H. DPOs under DTTWG of MDAs6HOHFWHG�PHPEHUV�RI�WKH�UHFHQWO\�LQDXJXUDWHG�'LJLWDO�7UDQVIRUPDWLRQ�7HFKQLFDO�:RUNLQJ�*URXS�RI�0'$V�ZRXOG�EH�DSSRLQWHG�DQG�WUDLQHG�DV�WKH�'DWD�3URWHFWLRQ�2ŲFHUV�IRU�WKHLU�RUJDQLVDWLRQV�

6.O COOPERATION AND PARTNERSHIPS


16


7.O COMPLIANCE AND ENFORCEMENT

,Q�WKH�\HDU�XQGHU�UHYLHZ��1,7'$�VHUYHG��HQIRUFHPHQW�QRWLFHV�RQ�GDWD�FRQWUROOHUV�ZKR�DUH�SHUFHLYHG��WR�KDYH�EUHDFKHG�WKH��SURYLVLRQV�RI�WKH�1'35��$OVR��FRPSOLDQFH�QRWLFHV�ZHUH�VHUYHG�RQ�0LQLVWULHV��'HSDUWPHQWV�DQG�$JHQFLHV�RI�JRYHUQPHQW��RQH�RI�ZKLFK�LV�WKH�Lagos Internal Revenue Service (LIRS)�EUHDFK�

7KH�/,56��ZDV�IRXQG�WR�KDYH�H[SRVHG�WKH�SHUVRQDO�GDWD�RI�VRPH�WD[SD\HUV�LQ�WKH�SURFHVV�RI�KDUPRQLVLQJ�KLVWRULFDO�WD[�GDWD��1,7'$�LQLWLDWHG�DQ�LQYHVWLJDWLRQ�RQ�/,56�DQG�LWV�PDMRU�GDWD�SURFHVVRU��

$�ŰQH�RI�2QH�0LOOLRQ�QDLUD��N1,000,000.00��over $2,500��ZDV�LPSRVHG�RQ�WKH�/,56��7KH�GHFLVLRQ�RQ�ŰQH�YDOXH�ZDV�UHDFKHG�DIWHU�FRQVLGHULQJ�WKH�FRRSHUDWLRQ�DQG�SURPSW�UHPHGLDO�DFWLRQV�WDNHQ�E\�WKH�/,56�LQ�WKH�FRXUVH�RI�WKH�LQYHVWLJDWLRQ��

A. Enforcement Activities1,7'$�KDV�FRPPHQFHG�LQYHVWLJDWLRQ�LQWR�WKH�DFWLYLWLHV�DQG�RSHUDWLRQV�RI�VHYHQ��GDWD�FRQWUROOHUV�DV�SDUW�RI�LWV�HQIRUFHPHQW�GULYH��1,7'$�EHLQJ�PLQGIXO�of the implications of negative publicity on business, has refrained from making public statements on breach until the legal and procedural basis KDV�EHHQ�HVWDEOLVKHG�

17



1,7'$�LQ�FRPSOLDQFH�ZLWK�WKH�1'35��HPEDUNHG�RQ�LWV�FRPSOLDQFH�DXGLW��7KH�DXGLW�FRYHUHG�DOO�RI�WKH�RUJDQLVDWLRQŖV��SURFHVVLQJ�DF-WLYLWLHV��7KH�IROORZLQJ�DFWLYLWLHV�ZHUH�FDUULHG�RXW�LQ�WKH�FRXUVH�RI�WKH�DXGLW�

,�� 7UDLQLQJ�RI�0DQDJHPHQW�DQG�VHOHFWHG�6WDů�RQ�WKH�1'35�

,,�� Security testing on all websites, and information security assets;

,,,�� Review of policies and documents;

,9�� 6:27�DQDO\VLV�

9�� Gap Analysis;

9,�� Recommendations for improved data protection; and

9,,�� &RPSOHWLRQ�RI�WKH�$XGLW�4XHVWLRQQDLUH�SURYLGHG�LQ�WKH�1'35�)UDPHZRUN�

9,,,��3ODFHPHQW�RI�WKH�1'35�1RWLFH�RQ�HQWU\�DW�WKH�1,7'$�SUHPLVHV�

8.O NDPR AUDIT COMPLIANCE BY NITDA

Accountabilityand Governance

Data ProtectionOfficer/Data ProtectionComplianceOrganization

Documentationto DemonstrateCompliance

0%

20%

10%

40%30%

50%60%

70%

80%

1,7'$�&RPSOLDQFH�OHYHO�DFURVV�WKH�WKUHH�DXGLW�GRPDLQV


18


A. Guidelines on the Use of Personal Data by Public Institutions 2020 7KLV�*XLGHOLQH�PDQGDWHV�HYHU\�SXEOLF�LQVWLWXWLRQ�WR�DSSRLQW�D�'DWD�3URWHFWLRQ�2ŲFHU�DQG�D�'DWD�3URWHFWLRQ�&RPSOLDQFH�2UJDQLVDWLRQ��$OVR�HYHU\�PDMRU�GDWD�SURFHVVLQJ�SURMHFW�PXVW�EH�SUHFHGHG�E\�D�UHSRUW�RI�'DWD�3URWHFWLRQ�,PSDFW�$VVHVVPHQW��3XEOLF�LQVWLWXWLRQV�FDQQRW�XQL-ODWHUDOO\�SURFHVV�SHUVRQDO�GDWD�ZLWKRXW�FRPSO\LQJ�ZLWK�VDIHJXDUGV�SURYLGHG�E\�WKH�*XLGHOLQH��$YDLODEOH�IRU�GRZQORDG�DW�ZZZ�QLWGD�JRY�QJ�

B. NDPR Implementation Framework7KH�)UDPHZRUN�SURYLGHV�FODULŰFDWLRQ�RQ�YDULRXV�SURYLVLRQV�RI�WKH�1'35��,W�JXLGHV�DOO�VWDNHKROGHUV�RQ�KRZ�WKH�5HJXODWLRQ�VKRXOG�EH�LP-SOHPHQWHG��7KH�)UDPHZRUN�SURYLGHV�D�WHPSODWH�DXGLW�TXHVWLRQ��D�VDPSOH�SULYDF\�SROLF\�DQG�D�ZKLWHOLVW�RI�FRXQWULHV�ZLWK�DGHTXDWH�GDWD�SURWHFWLRQ�ODZV��$YDLODEOH�IRU�GRZQORDG�DW�ZZZ�QLWGD�JRY�QJ�

C. Licensing of Data Protection Compliance Organisations7KH�'3&2�FRQFHSW�ZDV�RULJLQDOO\�FRQFHLYHG�DQG�LPSOHPHQWHG�E\�1,7'$�WR�DFFHOHUDWH�FRPSOLDQFH��EULGJH�FDSDFLW\�JDS�DQG�GHYHORS�D�GDWD�SURWHFWLRQ�VHUYLFH�LQGXVWU\��WKHUHE\�FUHDWLQJ�YLDEOH�HFRQRPLF�RSSRUWXQLWLHV��,Q�WKH�SDVW�RQH�\HDU��WKH�QXPEHU�RI�'3&2�JUHZ�IURP��LQ�-XO\��WR��LQ�$SULO��7KH�OLFHQVLQJ�FULWHULD�LV�DYDLODEOH�DW�ZZZ�QGSU�QLWGD�JRY�QJ

9.O KEY REFORMS

19



2QH�RI�WKH�QRYHOWLHV�RI�WKH�1'35�LV�WKH�LQWURGXFWLRQ�RI�WKH�'3&2V�� A DPCO is an organisation licensed to provide data protection compliance services, audit and training for data controllers and SURFHVVRUV�DPRQJ�RWKHU�IXQFWLRQV��7KH�'3&2V�KDYH�FRQWULEXWHG�immensely to the awareness and compliance level we have achieved LQ�VXFK�D�VKRUW�SHULRG��7KH�DXGLWV�EHLQJ�FRQGXFWHG�E\�'3&2V�KHOS�WR�GHWHUPLQH�RUJDQLVDWLRQV�ZKR�KDYH�EHJXQ�WKHLU�MRXUQH\�WR�GDWD�SURWHFWLRQ�FRPSOLDQFH��,QGHHG��VXEPLVVLRQ�RI�DXGLW�UHSRUW�DORQH��does not indicate full compliance, however, it helps regulators know DUHDV�IRU�IXWXUH�UHJXODWRU\�LQWHUYHQWLRQ�

7KH�'3&2�VFKHPH�UHTXLUHV�D�PRUH�VWULQJHQW�UHJXODWRU\�RYHUVLJKW�DV� WKHUH�DUH� LQVWDQFHV�RI�XQSURIHVVLRQDO�FRQGXFW�� $�GUDIW�'3&2�&RGH�RI�3UDFWLFH��&RGH��KDV�EHHQ�GHYHORSHG�E\�1,7'$�WR�HQWUHQFK�SURIHVVLRQDOLVP�DQG�UHJXODWH�WKH�DFWLYLWLHV�RI�WKH�'3&2V��7KH�&RGH�ZRXOG�EH�UHOHDVHG�XSRQ�FRQVXPPDWLRQ�RI�WKH�VWDNHKROGHUVŖ�HQ-JDJHPHQW�SURFHVV�

7KH�OLVW�RI�OLFHQVHG�'3&2V�LV�DYDLODEOH�IRU�GRZQORDG�DW�KWWSV��QLWGD�JRY�QJ�ZS�FRQWHQW�XSORDGV��9��ǳ83'$7('ǳ'3&2ǳ/,67B��SGI�

10.O DATA PROTECTION COMPLIANCE ORGANISATIONS (DPCOs)


20


1,7'$�LV�FXUUHQWO\�UHYLHZLQJ�ŰOHG�DXGLW�UHSRUWV��7KH�SUHOLPLQDU\�evaluation indicates that data controlling and processing entities QHHG�WR�LPSURYH�WKHLU�V\VWHPV�DQG�SURFHVVHV��2XU�DJJUHJDWH�REVHU-YDWLRQV�DQG�UHFRPPHQGDWLRQ�WR�DOO�HQWLWLHV�DUH�DV�IROORZV�

,�� digitise visitor register;

,,�� conduct of vulnerability assessment and penetration testing on all critical portals on a periodic basis;

,,,�� develop and implement risk-based approach to management of information security;

,9�� FRQGXFW�GDWD�SURWHFWLRQ�DZDUHQHVV�IRU�VWDů�DQG�VXSSOLHUV�

9�� document policies and procedures to align with the NDPR;

9,�� develop a framework and methodology for the review of policies and procedures in the organisation;

9,,�� GHYHORS�FDSDFLW\�EXLOGLQJ�SODQ�IRU�DOO�VWDů�

9,,,��develop a framework for data mapping and conduct a data mapping for all type of personal data collected and processed;

,;�� identify and document all sources of personal data which cut across the product portals and websites;

;�� UHYLHZ� DQG� XSGDWH�+XPDQ�5HVRXUFH� 3ROLF\� WR� FDSWXUH� WKH�

PDQDJHPHQW�RI�HPSOR\HHVŖ�SHUVRQDO�GDWD�LQ�FRPSOLDQFH�ZLWK�the NDPR;

;,�� LPSOHPHQWDWLRQ�RI�VHFXULW\�WRROV�LQFOXGLQJ�EXW�QRW�OLPLWHG�WR�

� encryption – Ensure volume encryption on all critical sys-tems and Database Encryption

� ORJ�0DQDJHPHQW�6,(0�'$0

� ŰOH�,QWHJULW\�0RQLWRULQJ��),0�

� data Loss Prevention Solution

� data Discovery Solution

� identity and Access Management Solution

� DQRQ\PL]DWLRQ�3VHXGRQ\PL]DWLRQ�6ROXWLRQ

� information Lifecycle Management Solution

;,,�� develop a framework and methodology for conducting Data 3URWHFWLRQ� ,PSDFW�$VVHVVPHQW� �&RYHULQJ�ERWK�H[LVWLQJ�DQG�SRWHQWLDO�SURMHFWV�

;,,,��GHYHORS�DQG�RSHUDWLRQDOLVH�,QFLGHQW�0DQDJHPHQW�3ROLF\�DQG�Procedure

11.O NOTES ON AUDIT REPORTS FILED

21



12.O CHALLENGES

/LNH�PRVW�GDWD�SURWHFWLRQ�DXWKRULWLHV��1,7'$�ZDV�KDPSHUHG�E\�ODFN�RI�DGHTXDWH�IXQGV��KXPDQ�UHVRXUFH�DQG�FDSDFLW\�WR�IXOO\�H[HFXWH�WKH�KXJH�PDQGDWH�YHVWHG�RQ�LW��7KH�1'35�DV�D�VXEVLGLDU\�OHJLVODWLRQ��KDV�OLPLWDWLRQV�LQ�WHUPV�RI�HQIRUFHPHQW�SRZHUV��$QRWKHU�FKDOOHQJH�LV�WKH�XQHYHQ�DZDUHQHVV�RI�WKH�UHJXODWLRQ��2YHU��RI�RUJDQLVDWLRQV�WKDW�ŰOHG�WKH�VWDWXWRU\�DXGLW�UHSRUW�DUH�EDVHG�LQ�1LJHULDŖV�ODUJHVW�FRPPHUFLDO�FHQWUH��/DJRV��ZKLOH�RWKHU�SDUWV�RI�WKH�FRXQWU\�DUH�\HW�WR�DSSUHFLDWH�WKH�LPSDFW��RI�WKH�1'35�RQ�WKHLU�RSHUDWLRQV�

)XUWKHUPRUH��SXEOLF�LQVWLWXWLRQV�KDYH�EHHQ�VORZ�LQ�FRPSOLDQFH�ZLWK�WKH�1'35��7KLV�KRZHYHU�KDV�VWDUWHG�FKDQJLQJ�JRLQJ�E\�WKH�QXPEHU�RI�HQTXLULHV�DQG�UHTXHVW�IRU��VXSSRUW�1,7'$�KDV�UHFHLYHG�

7KH�PDLQ�FKDOOHQJHV�WR�WKH�1'35�LPSOHPHQWDWLRQ�FDQ�EH�VXPPDUL]HG�DV�IROORZV�

,�� ,QDGHTXDWH�DZDUHQHVV

,,�� 3DXFLW\�RI�KXPDQ�DQG�ŰQDQFLDO�UHVRXUFHV

,,,�� Bottleneck to data breach investigation and prosecution

,9�� Limitation of power for enforcement


22


LIST OF DATA PROTECTION CASES INVOLVING NITDA

S/N PARTIES SUIT NUMBER

, ,QFRUSRUDWHG�7UXVWHHV�RI�/DZV�DQG�5LJKWV�$ZDUHQHVV�,QLWLDWLYHV�� )DFHERRN�,QF�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�$%-�&6��

,, ,QFRUSRUDWHG�7UXVWHHV�RI�'LJLWDO�5LJKWV�/DZ\HUV�,QLWLDWLYHV�� &KHVVSOXV�,QWHUQDWLRQDO�/LPLWHG�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�$%-�&6��

,,, �� Olumide Babalola LP�� Olasukanmi Bello V�� 1LJHULD�,PPLJUDWLRQ�6HUYLFH�� National Population Commission�� 1DWLRQDO�+HDOWK�,QVXUDQFH�6HUYLFH�� )HGHUDO�,QODQG�5HYHQXH�6HUYLFH�� National Pension Commission�� ,QGHSHQGHQW�1DWLRQDO�(OHFWRUDO�&RPPLVVLRQ�� Federal Road Safety Commission�� Nigeria Communication Commission�� Nigeria Police Force�� Nigerian Correctional Service�� &RUSRUDWH�$ůDLUV�&RPPLVVLRQ�� Economic and Financial Crimes Commission�� Central Bank of Nigeria�� 1DWLRQDO�,GHQWLW\�0DQDJHPHQW�&RPPLVVLRQ�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�/�&6��

13.O COURT CASES ON DATA PROTECTION INVOLVING NITDA

23



S/N PARTIES SUIT NUMBER

,9 ,QFRUSRUDWHG�7UXVWHHV�RI�'LJLWDO�5LJKWV�/DZ\HUV�,QLWLDWLYH�V�� Lekki Concession Company Limited�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�$%-�&6��

V �� Olumide Babalola LP�� Olasukanmi Bello V�� 7UXH�6RIWZDUH�6FDQGLQDYLD�$%�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�/�&6��

9, �� ,QFRUSRUDWHG�7UXVWHHV�RI�3DUDGLJP�,QLWLDWLYH�IRU�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�� ,QFRUSRUDWHG�7UXVWHHV�RI�'LJLWDO�5LJKWV�/DZ\HUV�,QLWLDWLYH�� Olasukanmi BelloV�� 1LJHULD�,PPLJUDWLRQ�6HUYLFH�� 1DWLRQDO�,PPLJUDWLRQ�6HUYLFH��1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�$%-�&6��

9,, �� ,QFRUSRUDWHG�7UXVWHHV�RI�'LJLWDO�5LJKWV�/DZ\HUV�,QLWLDWLYH�� Sukanmi Bello V�� /DJRV�6WDWH�,QODQG�5HYHQXH�6HUYLFH�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�$%-�&6��

9,,, �� ,QFRUSRUDWHG�7UXVWHHV�RI�'LJLWDO�5LJKWV�/DZ\HUV�,QLWLDWLYH�� Sukanmi Bello V�� /DJRV�6WDWH�,QODQG�5HYHQXH�6HUYLFH�� 1DWLRQDO�,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\

)+&�/�&6��


24


,�� The Huge Prospects of Nigeria Data Protection Regulation KWWSV��RSLQLRQ�SUHPLXPWLPHVQJ�FRP��WKH�KXJH�SURVSHFWV�QLJHULDV�GDWD�SURWHFWLRQ�UHJXODWLRQ��E\�LVD�DOL�LEUD-him-pantami/

,,�� Data Protection in Nigeria ��.DVKLIX�,QXZD�$EGXOODKL��$LVVDWRX�6\OOD��+RJDQ�/RYHOOV�//3��DQG�2OXIHPL�'DQLHO� KWWSV��LFOJ�FRP�DOE��GDWD�SURWHFWLRQ�LQ�QLJHULD�

,,,�� Imperative of the Nigeria Data Protection Regulation�œ�'U��9LQFHQW�2ODWXQML�D�SDSHU�DW�&\EHUVHFXULW\�$ZDUHQHVV�:RUNVKRS��6HS-WHPEHU��

,9�� Data Privacy and Protection: The Role of Regulation and Implications for Data Controllers In Developing Countries- Agballi 0'��HW�DO�SDSHU�SUHVHQWHG�DW�,),3�:*��(XURSHDQ�5HJLRQDO�&RQIHUHQFH�RQ�WKH�,PSOLFDWLRQV�RI�&RPSXWHUV�LQ�'HYHORSLQJ�&RXQWULHV��3XEOLVKHG�E\�6SULQJHU��

9�� (QDEOLQJ�WKH�3URWHFWLRQ�RI�3HUVRQDO�'DWD�WKURXJK�(ůHFWLYH�5HJXODWLRQ KWWSV��RSLQLRQ�SUHPLXPWLPHVQJ�FRP��HQDEOLQJ�WKH�SURWHFWLRQ�RI�SHUVRQDO�GDWD�WKURXJK�HůHFWLYH�UHJXODWLRQ�E\�NDVKL-fu-inuwa-abdullahi/

9,�� Data Protection Adaptation in emerging economies a ‘Herculean task’- A conversation with Ibrahim Yeku published in 5HSRUW�RQ�6XSSO\�&KDLQ�&RPSOLDQFH��9RO��1R��0DUFK�� KWWSV��FRPSOLDQFHFRVPRV�RUJ�

9,,�� Guide on Data Protection by Design - KWWSV��WHFKKLYHDGYLVRU\�RUJ�QJ�ZS�FRQWHQW�XSORDGV��*XLGH�'DWD�3URWHFWLRQ�%\�'HVLJQ�FRS\�SGI

14.O ACADEMIC PUBLICATIONS AND OPINIONS

25



�� Press Release on Issuance of Guidelines on Use of Personal Data by Public Institutions KWWSV��QLWGD�JRY�QJ�SUHVV�UHOHDVH�JXLGH-lines-for-the-management-of-personal-data-by-public-institutions-in-nigeria/

�� ,VVXDQFH�RI�1RWLFH�RQ��$QQXDO�$XGLW�ŰOLQJ KWWSV��DQGHUVHQWD[�QJ�QLWGD�LVVXHV�QRWLFH�RQ�ŰOLQJ�RI��DQQXDO�DXGLW�UHSRUW��

�� 1&&�*XLGHOLQH�QRW�LQ�FRQűLFW�ZLWK�WKH�1'35�KWWSV��QLWGD�JRY�QJ�SUHVV�UHOHDVH�QFF�UHJXODWLRQ�QRW�LQ�FRQűLFW�ZLWK�WKH�QLJHULD�GD-ta-protection-regulation/

�� 'DWD�&ROOHFWLRQ�LQ�UHVSHFW�RI�&29,'ǳ��PDQDJHPHQW�KWWSV��LWHGJHQHZV�QJ��FRYLG��GDWD�FROOHFWLRQ�FRPSOLHV�ZLWK�ndpr-says-nitda/

�� *UDQW�RI�([WHQVLRQ�WR�ŰOH�$QQXDO�'DWD�$XGLW�5HSRUW KWWSV��ZZZ�PRQGDT�FRP�QLJHULD�GDWD�SURWHFWLRQ��QLWGD�JUDQWV�D��PRQWK�H[WHQVLRQ�WR�GDWD�FRQWUROOHUV�WR�ŰOH�WKHLU�LQLWLDO�GDWD�SURWHFWLRQ�DXGLW�UHSRUW

�� NITDA Investigates Truecaller on potential breach of NDPR KWWSV��QLWGD�JRY�QJ�SUHVV�VWDWHPHQW�QLWGD�FRPPHQFHV�LQYHVWLJD-tion-into-potential-breach-of-privacy-rights-of-nigerians-by-the-truecaller-service/

�� NITDA Trains media executives on NDPR KWWSV��ZZZ�IDFHERRN�FRP�QLWGD�QLJ�SRVWV�QLWGD�WUDLQV�PHGLD�H[HFXWLYHV�RQ�QLJHULD�GD-WD�SURWHFWLRQ�UHJXODWLRQ�ODZWKH�QDWLR��

�� +RZ�7HFKSRLQW�PHW�WKH�1'35�$XGLW�ŰOLQJ�GHDGOLQH KWWSV��WHFKSRLQW�DIULFD��WHFKSRLQW�DIULFD�QGSU�FRPSOLDQW�

Videos and Podcast,�� FG Begins Campaign on Data Protection to Curb Cybercrime KWWSV��ZZZ�\RXWXEH�FRP�ZDWFK"Y .WVXDN3)'�$

,,�� Report On The Nigeria Data Protection Regulation KWWSV��ZZZ�\RXWXEH�FRP�ZDWFK"Y '4�4�%25D2N

,,,�� The Nigeria Data Protection Law KWWSV��ZZZ�\RXWXEH�FRP�ZDWFK"Y DUE�]F0R;Z$

,9�� NDPR Podcast with South Africa’s Techlaw Journalist��7HIR�0RKDSL�KWWSV��ZZZ�LDIULNDQ�FRP��WHFKOHJDOPDWWHUV��

15.O PRESS GALLERY


26


Despite the laudable strides already made as enumerated above, data protection in Nigeria still has a lot of room IRU�LPSURYHPHQW��7KH�IROORZLQJ�DUH�VRPH�RI�WKH�RQJRLQJ�HůRUWV�WR�VWUHQJWKHQ�GDWD�SURWHFWLRQ�LQ�1LJHULD�

A. Data Protection Bill 20207KH�LQFUHDVHG�FRRSHUDWLRQ�E\�DOO�UHOHYDQW�JRYHUQPHQW�RUJDQV�WR�HQVXUH�1LJHULD�SDVVHV�D�ZRUOG�FODVV�GDWD�SURWHFWLRQ�ODZ��DSSURSULDWH�IRU�WKH�1LJHULDQ�HQYLURQPHQW�LV�VDOXWDU\��1,7'$��DV�D�PDMRU�VWDNHKROGHU��VXS-SRUWV�WKHVH�HůRUWV�DQG�ZH�DUH�HQJDJLQJ�ZLWK�DOO�UHOHYDQW�SDUWLHV�WR�HQVXUH�WKDW�WKH�JDLQV�DQG�OHVVRQV�RI�WKH�1'35�LPSOHPHQWDWLRQ�DUH�QRW�ORVW�

B. Creation of the Data Protection Commission7KH�%LOO�KDV�PDGH�SURYLVLRQV�WKDW�ZRXOG�PDNH�WKH�&RPPLVVLRQ�RQH�RI�WKH�VWURQJHVW��LQGHSHQGHQW�DQG�YDOXH�DGGLQJ�'DWD�3URWHFWLRQ�$XWKRULWLHV�LQ�$IULFD��7KH�FRXQWU\�LV�IRFXVHG�RQ�GDWD�SULYDF\�SURWHFWLRQ�DQG�DOVR�OHYHUDJLQJ�RQ�GDWD�DV�WKH�RLO�RI�WKH�GLJLWDO�HFRQRP\�

C. Data Protection in the Digital Economy$QDO\VLV�RI�UHFHLSWV�IURP�DXGLW�LPSOHPHQWDWLRQ�E\�'3&2V�VKRZV�WKDW�RYHU�7ZR�ELOOLRQ��WZR�KXQGUHG�PLOOLRQ�QDLUD��1��KDV�EHHQ�HDUQHG�LQ�RQH�\HDU��:KLOH��MREV�UROHV�KDYH�EHHQ�FUHDWHG��7KHVH�ŰJXUHV�DUH�D�WLS�RI�WKH�LFHEHUJ�FRQVLGHULQJ�ZKDW�LV�DKHDG��7KH�GDWD�SURWHFWLRQ�VHUYLFH�PDUNHW�LV�H[SHFWHG�WR�JURVV��PLOOLRQ�GROODUV�E\��

1,7'$�ZRXOG�ZRUN�ZLWK�DOO�VWDNHKROGHUV�DQG�WKH�VXFFHVVRU�Commission to ensure Nigeria continues to improve on its current standings and help replicate its model in RWKHU�VLVWHU�FRXQWULHV�ZLWKLQ�DQG�RXWVLGH�$IULFD�

16.O THE FUTURE OF DATA PROTECTION IN NIGERIA

27



4.1

The NDPR meets the need of the Nigerian environment

Rate the state of public awareness on theNDPR as at June, 2020

List 3 top actions the Regulator should implement

As a DPCO my fee for compliance audit ranges from (in Naira)

Give your overall impression of the NDPRImplementation thus far

Rating Ratio

1 - 5

Are you convinced NITDA has proven technicalcompetence on the NDPR implementation?

3.4

2.1

3.2

NITDA: NDPR PERFORMANCE 2019/2020 FOR DPCOs QUESTION SUMMARIES

38.46%

20.51%

2,000,000 and above

100,000 - 500,000

500,001 - 1,000,000

1,000,001 - 2,000,000

2.56%

5.13%

33.33%Punitive Sanctions

Enact an Act of the Natonal Assembly

Publicise the NDPR success more

Increase Awareness


28


Our Data Protection function involves the IROORZLQJ�QXPEHU�RI�VWDů

Highlight key actions taken by NITDA that you appreciate

Rate the perception of data controllers to the implementation of the NDPR

,QGLƁHUHQ

W

0

0

0

0-2 2-5 5-10 10-Above

10

10

10

20

20

20

3030

30

4040

40

50

50

50

60

ND

PR

is a

re

gul

ato

ry b

urd

en

ND

PR

co

mp

lianc

e en

hanc

es p

erce

pti

on

abo

ut m

y b

usin

ess

Tran

spar

ent

DP

CO

Li

cens

e Sc

hem

e

6WDƁ

�5HVSRQVLYHQ

HVV�

and

Inte

gri

ty

Oth

ers

Bus

ines

s F

rien

dly

Ap

pro

ach

of

Man

agem

ent

Stak

eho

lder

Eng

agem

ent

on

Pro

po

sed

Act

ions

Pub

licat

ion

of

Rel

evan

t F

ram

ewo

rks,

Gui

del

ines

an

d R

epo

rts

We

have

no

cho

ice

Oth

ers

29



17.O PERSONAL DATA AS CATALYST FOR THE DIGITAL ECONOMY(A research commissioned by NITDA)1

A data-driven economy1 is critical to addressing challenges FRQIURQWLQJ�DQ�HPHUJLQJ�HFRQRP\�VXFK�DV�1LJHULD��5HFHQWO\��cyber-security breaches involving high tech companies

VXFK�DV�%ULWLVK�$LUZD\V�DQG�*RRJOH�OHG�WR�WKH�LVVXDQFH�RI�ŰQHV��e��PLOOLRQ�DQG�e��PLOOLRQ�UHVSHFWLYHO\�LQ�WKH�8QLWHG�.LQJGRP�2 7KLV�KDV�EURXJKW� DERXW� WKH�QHHG� IRU� WKH�1DWLRQDO� ,QIRUPDWLRQ�7HFKQRORJ\�'HYHORSPHQW�$JHQF\��1,7'$��WR�SXVK�IRU�WKH�SUR-tection of personal data while providing a Regulation which will HQDEOH� LQYHVWPHQW� DQG� HFRQRPLF� RSSRUWXQLWLHV�� 7KLV� KDV� DOVR�raised the concern about how personal data can be generated, VKDUHG�DQG�XWLOLVHG�ZLWK�WKLUG�SDUWLHV��7KH�1LJHULD�'DWD�3URWHFWLRQ�5HJXODWLRQ� �1'35��SURYLGHV� D�GLUHFWLRQ� IRU� IXWXUH�XVH�RI� GDWD��JLYLQJ�FLWL]HQV�ULJKWV�RQ�WKH�XVH�RI� WKHLU�SHUVRQDO�GDWD�DQG�WKH�RSSRUWXQLWLHV�DYDLODEOH�

*HQHUDOO\��GDWD�KDV�ORQJ�EHHQ�RI�JUHDW�LQWHUHVW�DQG�YDOXH��'XULQJ�FRORQLDO�WLPHV��JLYLQJ�ORDQV�WR�IDUPHUV�UHTXLUHG�WKDW�WKH�GDWD�RI�the farmer be checked in the local registry in order to ascertain WKH�QXPEHU�RI�SURSHUWLHV�VXFK�DQ�LQGLYLGXDO�SRVVHVVHG��Ancient VWDWHV�FRQGXFWHG�FHQVXVHV�WR�JDWKHU�LQIRUPDWLRQ�RQ�WKHLU�VXEMHFWV�to formulate policies and framework, which facilitated the task of OHY\LQJ�WD[HV��3HUVRQDO�GDWD�FROOHFWLRQ�KDV�RIWHQ�UHTXLUHG�D�WUDGH�Rů�EHWZHHQ� UHVSHFWLQJ� WKH� ULJKW� IRU� WKH�SULYDF\�RI� WKH�SHUVRQ��including protection from extreme government intrusion, and WDNLQJ�DGYDQWDJH�RI�WKH�VRFLDO�DQG�FRPPHUFLDO�EHQHŰWV�WKDW�FDQ�EH�JDLQHG�IURP�GDWD�SURFHVVLQJ�

While technology increases the possibility of data processing for WKH�EHQHŰW�RI�WKH�ELJ�WHFKQRORJ\�RUJDQLVDWLRQV��WKHUH�DUH�DOVR�PDQ\�VRFLDO�EHQHŰWV�WR�EH�GHULYHG�IURP�SHUVRQDO�GDWD�

�� 7KH�5HVHDUFK�7HDP�ZDV�OHG�E\�'U��:RULPHJEH�3RZHO�0D[ZHOO�ZLWK�LQSXWV�IURP�1,7'$�6WDů��'U��9LQFHQW�2ODWXQML�DQG�2OXIHPL�'DQLHO�(VT�

�� $MRJERU�DQG�,VLDQGLV��RQ�'DWD�3ULYDF\�5HJXODWLRQV�8QGHU�WKH�1LJHULDQ�'DWD�3URWHFWLRQ�5HJXODWLRQ��

�� <DQ�&DUUL¢UH�6ZDOORZ�DQG�9LNUDP�+DNVDU��7KH�(FRQRPLFV�DQG�,PSOLFDWLRQV�RI�'DWD�DQ�,QWHJUDWHG�3HUVSHFWLYH�

�� $IULFDQ�UHYLHZ�RI�EXVLQHVV�DQG�WHFKQRORJ\��3URWHFWLQJ�WKH�SULYDF\�DQG�SHUVRQDO�GDWD�FUXFLDO�WR�$IULFDŖV�GLJLWDO�HFRQRP\�

�� +0�7UHDVXU\��7KH�HFRQRPLF�YDOXH�RI�GDWD�

17.1 UNLOCKING THE ECONOMIC AND MARKET VALUES OF PERSONAL DATA7KH�$IULFDQ�8QLRQ�&RPPLVVLRQ�DQG�WKH�,QWHUQHW�6RFLHW\�LVVXHG�guidelines for a responsible use of personal data while highlight-ing the pivotal role of privacy protection in advancing the digital HFRQRP\�LQ�$IULFD�4

7KH�JXLGHOLQHV�UHFRPPHQGHG�VKRXOG�JXLGH�WKH�FLWL]HQV��SROLF\-makers, governments at all levels and other stakeholders to take VWUDWHJLF�DFWLRQV��$PRQJ�WKH�VLJQLŰFDQW�UHFRPPHQGDWLRQV�IRU�WKH�JRYHUQPHQW�LV�WKH�QHHG�WR�SURWHFW�DQG�UHVSHFW�LQGLYLGXDOVŖ�SULYDF\�RųLQH�DQG�RQOLQH�ZKLOH�SULRULWLVLQJ�WKH�UHVSRQVLEOH�DQG�VXVWDLQDEOH�XWLOLVDWLRQ�RI�SHUVRQDO�GDWD�LQ�WKH�GLJLWDO�HFRQRP\�

Personal data when leveraged and correctly utilised by governmental and non-govermental actors can be used in divergent ways (actions DQG�RXWSXWV��ZLWKLQ�D�OHJDO�IUDPHZRUN�WR�HPSRZHU�WKH�FLWL]HQV��LQFUHDVH�HŲFLHQF\��FUHDWH�HFRQRPLF�RSSRUWXQLWLHV�DQG�VROYH�VRFLHWDO�SUREOHPV��'DWD�DOVR�SOD\V�DQ�LQFUHDVLQJO\�LPSRUWDQW�HFRQRPLF�UROH�LQ�DGGLQJ�YDOXH�WR�DOO�VHFWRUV�RI�WKH�HFRQRP\�

Data has become essential in international relations as it breeds FRRSHUDWLRQ�DQG�HQKDQFHV�LQWHUQDWLRQDO�WUDGH��7KH�JOREDO�űRZ�RI�GDWD�LQFUHDVHG��WLPHV�ZLWKLQ�D�SHULRG�RI��\HDUV��WR��DQG�EURXJKW�DERXW��Œ��WULOOLRQ�� LQFUHDVH� LQ�JOREDO�*'3�LQ��5�7R�XQORFN�WKH�HFRQRPLF�DQG�PDUNHW�YDOXH�RI�GDWD��WKHUH�LV�the need to introduce a market-based mechanism which will en-hance the capacity of individuals to express how their personal data FRXOG�EH�XVHG��7KH�PDUNHW�EDVHG�PHFKDQLVP�LQYROYHV�JRYHUQPHQW�LQLWLDWLYHV�ZKLFK�HQFRXUDJH�DQG�LPSURYH�WKH�FDSDFLW\�RI�GLůHUHQW�RUJDQLVDWLRQV�WR�JLYH�FLWL]HQV�DFFHVV�WR�WKHLU�GDWD��SURYLGH�WKH�FLWL]HQV�ZLWK�D�SODWIRUP�WR�VHFXUH�GDWD�DQG�FRQWURO�KRZ�VXFK�GDWD�LV�XWLOLVHG�


30


One of the crucial ingredients missing in the personal data discus-VLRQ�KDV�EHHQ�KRZ�WR�HůHFWLYHO\�HQJDJH�FLWL]HQV�DQG�HQKDQFH�WKHLU�capacity by giving them tools and a voice to control and express WKHLU�YLHZ�RQ�KRZ�WKHLU�GDWD�PD\�EH�XWLOLVHG�

17.2 LEVERAGING PERSONAL DATA AS A NEW ASSET FOR DEVELOPMENT IN NIGERIADue to the mixed evidence on how personal data can be leveraged, a framework has been provided in this research to showcase personal GDWD�DV�D�QHZ�DVVHW�IRU�GHYHORSPHQW�LQ�1LJHULD��,Q�RUGHU�WR�FDSWXUH�and analyse the evidence available and inform future comparative evaluations across sectors, market and organisations, there is a need to identify, create, test and expand existing frameworks on personal GDWD��%HORZ�DUH�SDUDPHWHUV�IRU�WKH�SURSRVHG�DQDO\VLV�

I. 'HŰQLQJ�WKH�/RFDO�&RQGLWLRQV�DQG�,GHQWLI\LQJ�WKH�8VHUV� the most successful personal data initiatives as seen in the developed countries and big tech organisations are those designed and executed with particular attention paid to the complexities of ORFDO�FRQGLWLRQV�DQG�LGHQWLŰFDWLRQ�RI�WKH�VWDNHKROGHUV��5HJXODWRUV�VKRXOG�KDYH�D�GHŰQHG�DQG�FOHDU�VHQVH�RI�WKH�LVVXH�DW�KDQG��LGHQWLI\�WKH�GLůHUHQW�XVHUV�DQG�WKH�SRWHQWLDO�EHQHŰFLDULHV��)X]]\�DQG�RYHUO\�EURDG�SURMHFWV�WKDW�KDYH�QRW�LGHQWLŰHG�WKH�SURVSHFWLYH�users will generate less meaningful results, regardless of the YLDELOLW\�RI�VXFK�SURMHFWV�

�� 6WHIDDQ�*��9HUKXOVW�DQG�$QGUHZ�<RXQJ��2SHQ�'DWD�LQ�'HYHORSLQJ�(FRQRPLHV�7RZDUG�%XLOGLQJ�DQ�(YLGHQFH�EDVH�RQ�:KDW�:RUNV�DQG�+RZ�

II. Stakeholders Readiness: Successful creation and usage of personal data depends on the readiness of all stakeholders in-YROYHG��7KH�1'35�DQG�UHODWHG�UHJXODWLRQV�HQDEOH�WKH�FROOHFWLRQ��FXOWXUDO�WUDQVIRUPDWLRQ��FRQVXPSWLRQ�DQG�VKDULQJ�RI�GDWD��7KH�readiness of the stakeholders will provide the necessary feedback WR�JRYHUQPHQW��7KLV�LV�DQ�HVVHQWLDO�FDWDO\VW�IRU�HůHFWLYH�DQG�IDVW�GHYHORSPHQW�RI�SHUVRQDO�GDWD�FDSDELOLWLHV��7KH�FRPPLWPHQW�RI�VWDNHKROGHUV�LV�FUXFLDO�LQ�GHWHUPLQLQJ�WKH�UHDGLQHVV�WR�HQMR\�WKH�HFRQRPLF�YDOXH�RI�SHUVRQDO�GDWD�

,,,�� Building Institutional Framework and Partnership: Data cannot H[LVW�LQ�LVRODWLRQ��7KH�VXFFHVV�RI�SHUVRQDO�GDWD�LQLWLDWLYHV�GHSHQGV�RQ�FRRSHUDWLRQ�DPRQJVW�GLYHUVH�VWDNHKROGHUV��7KH�VWDNHKROGHUVŖ�engagement process should be designed to explore issues that ZRXOG�HQKDQFH�WKH�SURSHU�DQG�OHJDO�XVH�RI�SHUVRQDO�GDWD�

,9�� Risk Mitigation Strategy:�'DWD�LQWHQVLYH�SURMHFW�LPSOHPHQWHUV�should be mindful of some of the risks associated with threats WR�LQGLYLGXDO�SULYDF\��7KHUH�LV�D�QHHG�IRU�VWDNHKROGHUV�WR�HQVXUH�WKDW�SURMHFWV�GHDOLQJ�ZLWK�SHUVRQDO�GDWD�DUH�DQRQ\PLVHG�DQG�DXGLWHG�DGHTXDWHO\�LQ�RUGHU�WR�PLWLJDWH�DQ\�GDWD�ULVNV��$�FRQFLVH�and clear strategy should be formulated to mitigate these risks EHIRUH�SURFHHGLQJ�ZLWK�FROODERUDWLRQV�

V. Building Sustainability:�7KHUH�LV�D�QHHG�WR�IRFXV�RQ�VXVWDLQD-ELOLW\�ZKLOH�VHFXULQJ�SHUVRQDO�GDWD��D�FUXFLDO�UHVRXUFH��3HUVRQDO�GDWD�SURMHFWV�UHTXLUH�UHVRXUFHV�DQG�IXQGLQJ�WR�EH�VXVWDLQHG��DOWKRXJK�LW�FDQ�EH�LQLWLDWHG�ZLWK�PLQLPDO�UHVRXUFHV��$�űH[LEOH�yet long term business strategy or model is crucial in driving VXVWDLQDELOLW\��DQG�WKLV�VKRXOG�EH�LQFRUSRUDWHG�LQWR�DOO�SURMHFWV�FHQWUHG�DURXQG�SHUVRQDO�GDWD�6

17.3 Adopting the Verhulst and Young Logic Model6 for Unlocking the Economic and Market Values of Personal Data in Nigeria.

Input (Supply) Stakeholders (Demand)

Enabling Conditions

Activities Output Value Added

Personal Data • Private Sector

• Government

Agencies

• Academia

• ,QWHUHVW�*URXSV��

NGOs

• Entrepreneurs

• Corporate Bodies

• Collaboratives

• ,QWHUPHGLDULHV

• ,QIUDVWUXFWXUH

• Policies

• Resource

Availability

• Problem

'HŰQLWLRQ

• Resource Allocation

• Data Collection

• Storing

• Sharing

• 8WLOLVDWLRQ

3HUVRQDO�'DWD�KDV�PDQ\�UHDO�ZRUOG�HůHFWV��DQG�

these can be evaluated using indicators such as,

• apps

• data-driven enterprises

• new enterprises

• MRE�FUHDWLRQ�LQ�GDWD�GULYHQ�VHFWRUV

• HŲFLHQW�VHUYLFH�GHOLYHU\

• FLWL]HQV�HGXFDWLRQ

• industry level growth

• tracking impact and targeting interventions

• enhanced decision making and satisfaction

LQ�FLWL]HQV

• social mobilisation through advocacy

• government transparency and accountability

• collaborations and increased information

VKDULQJ�DPRQJ�HQWLWLHV�

• ,PSURYLQJ�

Governance

• Empowering

&LWL]HQV

• Creating Economic

Opportunities

• Solving Public

Problems

31



17.4 THE IMPACT OF PERSONAL DATA ON THE SOCIETY AND ECONOMYI. Empowering Citizens3HUVRQDO�GDWD�ZDV�HPSOR\HG�LQ�VWUHQJWKHQLQJ�WKH�FLWL]HQVŖ�FDSDFLW\�to vote through mobile technologies as evidenced in the Democratic 5HSXEOLF�RI�&RQJR��'5&��ZKHUH�HOHFWURQLF�YRWLQJ�ZDV�GHSOR\HG�

A proper utilisation of personal data increases transparency and DFW�DV�D�VRFLDO�PRELOLVDWLRQ�LQVWUXPHQW�IRU�WKH�FLWL]HQV��7KH�DYDLO-DELOLW\�RI�SHUVRQDO�GDWD�LQűXHQFHV�DGYRFDF\�HůRUWV�IRU�FRQVXPHU�SURWHFWLRQ�JURXSV�DQG�KHDOWKFDUH�VHUYLFH�GHOLYHU\��7KLV�LV�HYLGHQW�LQ�VRFLDO�PRELOLVDWLRQ�LQ�%UD]LO�ZKHUH�HůHFWLYH�SHUVRQDO�GDWD�XVH�KHOSHG�ŰJKW�DJDLQVW�SROOXWLRQ��ZRPHQ�ULJKW�YLRODWLRQ�

&LWL]HQV�DOVR�PDNH�EHWWHU�FKRLFHV�DQG�LQIRUPHG�GHFLVLRQV�GXH�to the availability of personal data as evident in Kenya, where DFFHVV�WR�SHUVRQDO�GDWD�SURYLGHG�WKH�FLWL]HQV�ZLWK�LQIRUPDWLRQ�RQ�YRWHUVŖ�UHJLVWUDWLRQ�FHQWUHV�DQG�KRZ�WKH\�FRXOG�QDYLJDWH�WKHLU�ZD\V�WKHUH�

3HUFHLYHG�FRUUXSWLRQ�SUDFWLFHV�DUH�DOVR�GLVFRYHUHG�DQG�FKHFNHG��7KH�UHFHQW�VXFFHVVHV�RI�WKH�1LJHULDQ�(FRQRPLF�DQG�)LQDQFLDO�&ULPH�&RPPLVVLRQ��()&&��FDQ�EH�VDLG�WR�EH�ODUJHO\�GXH�WR�WKH�DYDLODELOLW\�RI�SHUVRQDO�GDWD�DQG�UHODWHG�LQIRUPDWLRQ�

II. Tackling Societal ChallengesPersonal data is also a critical component in tackling societal challeng-HV��*RYHUQPHQW�DW�QDWLRQDO�DQG�VWDWH�OHYHOV�KDYH�PDGH�UHFRXUVH�WR�SHUVRQDO�GDWD�SURFHVVLQJ�WR�WUDFN��WUDFH�DQG�WUHDW�&29,'ǳ��SDWLHQWV�DQG�H[SRVHG�SHUVRQV��&ROOHFWLRQ�DQG�VKDULQJ�RI�SHUVRQDO�GDWD�KDYH�DOVR�DLGHG�WKH�H[HFXWLRQ�RI�LQWHUYHQWLRQ�SURJUDPPHV��7KH�1SRZHU�programme and other social investment programmes are cases in SRLQW�LQ�1LJHULD�

III. Improving GovernancePersonal data is pivotal in improving governance and in the formu-ODWLRQ�RI�SROLFLHV��7KHUH�DUH�VHYHUDO�ZD\V�WKLV�LPSDFW�LV�PDQLIHVWHG��

• it drives data-driven and enhanced decisions in government and provides the necessary platform for the government to DFFHVV�LWV�FLWL]HQV�

• LW�IRVWHUV�HŲFLHQW�DQG�EHWWHU�VHUYLFH�GHOLYHU\��:LWK�WKH�RQJRLQJ�process innovations in the electioneering process, personal data ZLOO�SOD\�D�FUXFLDO�UROH�LQ�IXWXUH�HOHFWLRQV�LQ�1LJHULD�

IV. Creating OpportunitiesPersonal data, under the right conditions, create economic oppor-WXQLWLHV��7KH�IROORZLQJ�RSSRUWXQLWLHV�DUH�FUHDWHG�

• access to data has increased the capacity of businesses and individuals to access loans without the rigours of collateral or EXON\�LQIRUPDWLRQ�

�� 6WLJOLW]��-RVHSK��,QIRUPDWLRQ�DQG�WKH�&KDQJH�LQ�WKH�3DUDGLJP�LQ�(FRQRPLFV�LQ�$PHULFDQ�(FRQRPLF�5HYLHZ�

• personal data serves as a new business asset for start-ups and HQWUHSUHQHXUV��:KHUH�VXFK�GDWD�LV�PDGH�HDVLO\�DQG�FKHDSO\�available, it opens the doors for innovative ideas in the pri-YDWH�VHFWRU�

When integrated with proprietary data, personal data has the po-WHQWLDO�WR�FUHDWH�IDU�UHDFKLQJ�DQG�PRUH�V\VWHPLF�HFRQRPLF�JURZWK��

17.5 CREATING MARKETS FOR PERSONAL DATA,Q�FUHDWLQJ�D�PDUNHW�IRU�SHUVRQDO�GDWD��LW�LV�LPSRUWDQW�WR�QRWH�ŰUVWO\��that personal data serves as an input factor in the production of VHUYLFHV�DQG�JRRGV��DQG�FRQWULEXWHV�LPPHQVHO\�WR�HŲFLHQF\�DQG�LQQRYDWLRQ��6HFRQGO\��SHUVRQDO�GDWD�VKLIWV�DQG�FUHDWHV�LQIRUPDWLRQ�DFURVV�HFRQRPLF�DJHQWV�DůHFWLQJ�VWUDWHJLF�LQWHUDFWLRQV�DQG�LQIRU-PDWLRQ�IULFWLRQV�7

,Q�LWV�FDSDFLW\�DV�DQ�LQSXW�LQ�WKH�SURGXFWLRQ�SURFHVV��SHUVRQDO�GDWD�fosters the creation of knowledge which is directed towards the development of goods and services or enhancement of existing DVVHWV�� &UHDWLQJ� YDOXH� IURP�SHUVRQDO� GDWD� DV� DQ� LQSXW� IDFWRU� RI�SURGXFWLRQ�UHTXLUHV�VXSSRUW�IURP�VNLOOHG�ODERXU�ZKLFK�PDNHV�LWV�SURFHVVLQJ�DQG�WUDQVIRUPDWLRQ�SRVVLEOH��3HUVRQDO�'DWD��LI�FRUUHFWO\�utilised by stakeholders can create new insight, innovations in the development of a wide range of products in the banking, agricul-WXUH��KHDOWK�DQG�RWKHU�VHFWRUV�FULWLFDO�WR�WKH�1LJHULDQ�HFRQRP\�

,Q�FUHDWLQJ�LQIRUPDWLRQ�DFURVV�HFRQRPLF�DJHQWV��SHUVRQDO�GDWD�LQ-FRUSRUDWHV�FRPPHUFLDO�DJHQWV�VXFK�DV�FRPSDQLHV�DQG�FRQVXPHUV��7KLV�FUHDWHV�EHWWHU�DQG�HŲFLHQW�WUDQVDFWLRQV�VLQFH�SHUVRQDO�GDWD�UHGXFHV�LQIRUPDWLRQ�DV\PPHWULHV��:KHUH�D�VHOOHU�JHWV�DFFHVV�WR�SRWHQWLDO�FXVWRPHUŖV�LQWHUHVW�DQG�LQGLYLGXDO�FKDUDFWHULVWLFV��VXFK�D�VHOOHU�ZRXOG�RůHU�DQG�GHOLYHU�FXVWRPLVHG�JRRGV�DQG�VHUYLFHV�WR�WKH�FXVWRPHUV��&XVWRPHUV�ZLWK�VSHFLŰF�IHDWXUHV�ZLOO�EHQHŰW�IURP�VXFK�SHUVRQDOLVHG�VHUYLFHV�ZKLFK�ZLOO�DFFXUDWHO\�ŰW�LQWR�WKHLU�QHHGV�DV�SURYLGHG�E\�WKH�ŰUPV��$YDLODELOLW\�RI�SHUVRQDO�GDWD�ZLOO�LQFUHDVH�WKH�FRPPHUFLDO�YDOXH�IRU�WKH�ŰUP�ZKLOH�LQFUHDVLQJ�LWV�HFRQRPLF�HŲFLHQF\��*DLQLQJ�DFFHVV�WR�SHUVRQDO�GDWD�ZLOO�DOVR�LQűXHQFH�LWV�DELOLW\�WR�DSSO\�SULFH�GLVFULPLQDWLRQ�VWUDWHJLHV�

,Q�EXLOGLQJ�D�UREXVW�PDUNHW��SHUVRQDO�GDWD�SOD\V�D�SLYRWDO�UROH�LQ�WKH�LQWHUPHGLDWLRQ�RI�ŰQDQFLDO�VHUYLFHV��$FFHVV�WR�SHUVRQDO�GDWD�LV�DQ�HVVHQWLDO�LQSXW�LQWR�WKH�EXVLQHVV�RI�ŰQDQFLDO�LQWHUPHGLDWLRQ�DQG�D�YLWDO�SDUW�RI�WKH�SURPLVH�WKDW�WHFKQRORJ\�RůHUV�WR�WKH�SURYLVLRQ�RI�ŰQDQFLDO�VHUYLFH��$V�VHHQ�LQ�WKH�ŰQDQFLDO�LQGXVWU\��ŰQDQFH�SUR-YLGHUV��OHQGHUV��XWLOLVH�WKH�SHUVRQDO�GDWD�RI�SRWHQWLDO�FXVWRPHUV�WR�GHWHUPLQH�WKHLU�FDSDFLW\�WR�SD\�EDFN�DQG�WKHLU�FUHGLWZRUWKLQHVV��$ELOLW\�WR�DFFHVV�SHUVRQDO�GDWD�SURYLGHV�WKH�ŰQDQFLDO�LQVWLWXWLRQV�ZLWK�IXOO�LQIRUPDWLRQ�RQ�WKH�FXVWRPHUVŖ�FDSDFLW\�WR�SD\��ORFDWLRQ��whom to go to in the case of default and the authenticity of the FXVWRPHUV�FODLP��7KH�DFFHVV�WR�FXVWRPHUVŖ�SHUVRQDO�GDWD�FDQ�UH-duce information irregularities, holding the promise of lowering OHQGLQJ�FRVWV�DQG�H[SDQGLQJ�WKH�DYDLODELOLW\�RI�FUHGLW��6KDULQJ�RI�SHUVRQDO�GDWD�DPRQJ�ŰQDQFLDO�VHUYLFH�LQVWLWXWLRQV�FDQ�FUHDWH�PRUDO�


32


KD]DUG�LVVXHV�DQG�DWWHQXDWH�DGYHUVH�VHOHFWLRQ�WKHUHE\�LQFUHDVLQJ�WKH�SURYLVLRQ�RI�FUHGLW�E\�UHGXFLQJ�LQIRUPDWLRQ�DV\PPHWULHV��7KLV�LV�ZKDW�WKH�1'35�LQWHQGV�WR�SUHYHQW�RU�UHGXFH�

Competitive parameter is achieved in a modern economy through DFFHVV�WR�GDWD��:KLOH�WKH�H[WHQW�WR�ZKLFK�UHJXODWRUV�ZLOO�HQIRUFH�competitiveness as regards personal data utilisation is yet to be GHWHUPLQHG��1,7'$�SURYLGHV�WKH�IRXQGDWLRQDO�IUDPHZRUN�IRU�SHU-VRQDO�GDWD�XVH�LQ�1LJHULD��:KRHYHU�FRQWUROV�DQG�UHJXODWHV�GDWD�KDV�the power and means to create services and products, allowing WKHP�WR�EHQHŰW�IURP�EXVLQHVV�LQVLJKWV�DQG�SURYLGLQJ�WKHP�GLV-WLQFW�PDUNHW� DGYDQWDJHV�8�8QOHDVKLQJ� WKH� IXOO� SRWHQWLDO� RI� GDWD�SURGXFHG�E\�WKH�GLJLWDO�HFRQRP\�ZLOO�UHTXLUH�ERWK�WKH�FUHDWLRQ�of infrastructure to facilitate data exchange and development of QHZ�PDUNHW�PRGHOV�DQG�PHFKDQLVPV�

17.6 THE VALUE OF PERSONAL DATA IN CRITICAL SECTORS OF THE ECONOMYAgricultural Sector• 7DNLQJ�D�FXH�IURP�VPDOOKROGHU�IDUPHUV�LQ�8JDQGD��DFFHVV�WR�SHU-

sonal data by the government made it possible for government DQG�LWV�DJHQFLHV�WR�VHQG�PHVVDJHV�WR�DERXW��FLWL]HQV�on strategies to protect their crops from infections and how WR�WUHDW�LQIHFWHG�FURSV��7KH�IDUPHUV�ZHUH�DOVR�DEOH�WR�LPSURYH�RQ�WKHLU�FURS�\LHOGV�DQG�VDYH�PRQH\�

• Personal data is always important in digital agriculture since it adds value to the agricultural value chain by contributing to better services and products, enhanced decision making DQG�SURYLGLQJ� WKH� UHVRXUFHV� IRU� HŲFLHQW�GLVVHPLQDWLRQ�RI�LQIRUPDWLRQ��7KH�1DWLRQDO�$GRSWHG�9LOODJH� IRU�6PDUW�$JUL-FXOWXUH� �1$96$��SURMHFW�FKDPSLRQHG�E\�1,7'$�XQGHU�WKH�FMoCDE is a good example of how data can be leveraged for EHWWHU�DJULFXOWXUDO�RXWSXWV�

• ,Q�HPSRZHULQJ�WKH�VPDOOKROGHU�IDUPHUV�LQ�*KDQD��SULYDWH�VHF-tor stakeholders disseminated information to farmers through their mobile phones with assistance from telecommunication ŰUPV�LQ�ORFDO�ODQJXDJHV�

• 7KH�XWLOLVDWLRQ�RI�SHUVRQDO�GDWD�DOVR�LPSURYHV�IDUPHUVŖ�SURGXF-tivity by providing access and knowledge to key farm inputs, addressing critical constraints, providing advice and getting LQVLJKWV�LQWR�WKH�ZHDWKHU�DQG�PDUNHW�SULFHV�

I. Health Sector• 7KH�KHDOWK�VHFWRU�KDV�HQMR\HG�WKH�DSSOLFDWLRQ�RI�SHUVRQDO�GDWD�

LQ�LWV�RSHUDWLRQV��7KHUH�LV�LPSURYHG�HŲFLHQF\�DQG�SHUIRUPDQFH�DPRQJ�+HDOWK�0DLQWHQDQFH�2UJDQL]DWLRQV��+02V��GXH�WR�WKH�DYDLODELOLW\�RI�FXVWRPHUVŖ�SHUVRQDO�GDWD�WKHUHE\�HQKDQFLQJ��FXV-WRPHUVŖ�H[SHULHQFH�

�� )RWHLQL�=DPSDWL��'RHV�GDWD�PHDQ�SRZHU�IRU�VPDOOKROGHU�IDUPHUV"

�� :RUOG�(FRQRPLF�)RUXP�DQG�WKH�%RVWRQ�&RQVXOWLQJ�*URXS��8QORFNLQJ�WKH�9DOXH�RI�3HUVRQDO�'DWD��)URP�&ROOHFWLRQ�WR�8VDJH�

• Evidences from some African countries also reveal that access to personal data has helped in the provision of bed nets (which SUHYHQWV� WKH�VSUHDG�RI�PRVTXLWRHV��DQG�DOVR� WUDFN�KXPDQ�PRYHPHQW�WKXV�FXUWDLOLQJ�WKH�VSUHDG�RI�GLVHDVHV�

• ,W�KDV�DOVR�UHGXFHG�WKH�LQFLGHQFH�RI�FRUUXSWLRQ�LQ�WKH�KHDOWK�VHFWRU�DQG�HQKDQFHG�WUDQVSDUHQF\�LQ�WKH�PDQDJHPHQW�RI�Ű-QDQFHV�LQ�WKDW�VHFWRU�

• 7KH�XWLOLVDWLRQ�RI�SHUVRQDO�GDWD�KDV�SURYLGHG� WRROV� WR�GULYH�innovative, high-value societal and business outcomes in the KHDOWK�VHFWRU�

II. Education Sector• 7KH�HGXFDWLRQ�VHFWRU�LV�PRUH�WUDQVSDUHQW�DQG�HŲFLHQW�WKURXJK��

WKH�DSSURSULDWH�XVH�RI�GDWD��)RU�LQVWDQFH��WKH�1LJHULDQ�JRYHUQPHQW�LV�DEOH�WR�PRQLWRU�DQG�HůHFWLYHO\�H[HFXWH�D�SROLF\�ZKLFK�IHHGV�over 24 million primary school pupils through appropriate use RI�SHUVRQDO�GDWD�

• As evidenced in Mexico, the availability of personal data led to the discovery of corruption in the education sector as “ghost” WHDFKHUV�ZHUH�GLVFRYHUHG�LQ�WKH�SD\UROOV�RI�WKH�JRYHUQPHQW��$W�WKH�VDPH�WLPH��LW�ZDV�DOVR�XVHG�WR�FKHFN�PLVDSSURSULDWLRQ�RI�IXQGV��7KLV�KDV�DOVR�EHHQ�DFKLHYHG�LQ�WKH�1LJHULDQ�HGXFDWLRQ�VHFWRU�

• Government and the Ministry of Education can also leverage RQ�SHUVRQDO�GDWD� WR� UHIRUP�WKH�HGXFDWLRQDO�VHFWRU��7KLV�KDV�EHHQ�DFKLHYHG�LQ�7DQ]DQLD��.HQ\D��3KLOLSSLQHV�DQG�0H[LFR�

III. Business Sector• 7KHUH�DUH�HQRUPRXV�RSSRUWXQLWLHV�IRU�FXVWRPHUV�DQG�EXVLQHVVHV�

WR�FUHDWH�YDOXH�WKURXJK�SHUVRQDO�GDWD��'ULYHQ�E\�WHFKQRORJLFDO�innovation, personalised services and products that can better PHHW�WKH�EXVLQHVV�DQG�FXVWRPHU�QHHGV��+RZHYHU��LQ�RUGHU�WR�optimise these opportunities, there is a need for greater par-ticipation among stakeholders and regulations on how data VKRXOG�EH�FRUUHFWO\�XWLOLVHG�

• 3HUVRQDO�GDWD�ZDV�DQDO\VHG�E\�7UXH&DU�DQ�DXWRPRELOH�FRPSDQ\�in providing better transparent prices in the retail automotive market place which saved time and cost and increased cus-WRPHUŖV�HŲFLHQFLHV�

• 8VLQJ� SHUVRQDO� GDWD� YDXOWV� �ORFNHUV�� FDQ� VDYH� WKH�ZRUOG� ��billion hours and improve the delivery of public and private VHFWRU�VHUYLFHV�9

IV. Humanitarian Service• Accurate and highly comprehensive personal data enhances

the capacity of organisations to identify and better provide KXPDQLWDULDQ�DLGV�WR�HůHFWLYHO\�VROYH��VRFLDO�SUREOHPV��EHWWHU�FRRUGLQDWH�UHOLHI�HůRUW�DQG�XUJHQWO\�LGHQWLI\�VHFWRUV�WKDW�DUH�LQ�GLUH�QHHG�RI�KXPDQLWDULDQ�DVVLVWDQFH�

To see those taking your data privacy seriously,Download NDPR Audit Filing Compliant

Organisations’ List 2019-2020 at

www.nitda.gov.ng

• As witnessed in Egypt and East Africa, personal data was utilised LQ�UHFRQQHFWLQJ�UHIXJHHV�ZLWK�WKHLU�IDPLOLHV��7KLV�KDV�VLJQLŰFDQWO\�DPSOLŰHG�WKH�QXPEHU�RI�UHIXJHHV�KHOSHG�10

�� KWWS��ZZZ��ZHIRUXP�RUJ�GRFV�:()B,7B8QORFNLQJ9DOXH3HUVRQDO'DWDB&ROOHFWLRQ8VDJHB5HSRUWB��SGI

CONCLUSIONFrom the foregoing, the value of personal data in the digital economy LV�KXPRQJRXV��7KLV�UHVHDUFK�LV�LQWURGXFWRU\�LQ�WKDW�LW�LV�DLPHG�DW�titillating further research interests with a view to devising work-DEOH�PRGHOV�IRU�D�VXVWDLQDEOH�XVH�RI�GDWD�ZKLFK�LV�WKH�QHZ�RLO��


34


Nigeria Data Protection Regulation Performance Report ��ǳ��

©2020 NITDA. Proudly Designed and Printed in Nigeria. O7O379317O7, O8111939221

Documents

Nigeria Data Protection Regulation Performance Report