COMPLETE SCHOOL PROJECT TOPICS & MATERIALS :
CHAPTERS: Chapter 1-5 | DOC FORMAT: MS WORD/PDF | PRICE: ₦5,000

GET COMPLETE WORK

Abstract

The thesis examines the legal protection of data privacy in Nigeria. Investigating this issue is crucial in the wake of the rise in data processing activities as a result of the relative advances in technology which challenge human rights. Generally, the right to data privacy emerged because of the need to protect individuals from risks resulting from the automated or manual processing of their personal information. The thesis, therefore, argues that the extant legal framework in Nigeria is manifestly inadequate to effectively protect individuals from the threats resulting from the processing of their personal information. This view is held based on an analysis of the major data privacy issues in Nigeria today and a review of the current legal regime. Thus, scholarship that contends that there is insufficient processing in the country which is a reason why data privacy right is neglected is challenged. In carrying out this study, the focus is placed on the constitutional and statutory mechanisms for data privacy protection. The statutory mechanism in this case is the comprehensive data privacy code. In addition, the thesis brings together contemporary debates on improving data privacy regimes and a ‘rights-based’ approach is proposed for Nigeria. This is because, data privacy protection in African countries is usually misconceived as basically for economic purposes without due regard to human rights and fundamental freedoms. In conclusion, the thesis contends that, contrary to the common belief, merely enacting a legislation, which is a ‘cut and paste’ of foreign data privacy laws, is not a silver bullet to resolving the data privacy problem in Nigeria.

 CHAPTER ONE

GENERAL INTRODUCTION

• General Introduction

Lately, developing countries like Nigeria are beginning to experience, first-hand, the myriad issues brought about by personal information. Firstly, personal data/information is now an extremely valuable commodity which has been aptly described as the lifeblood and basic currency of the information economy.[1] This has made it increasingly sought by various entities without, in many cases, regard to the rights of the individuals who are the subject of the data. Secondly, there is a difficulty in comprehending the exact purpose or value of data protection in African countries (in general) and Nigeria (in particular).[2]According to Makulilo, data protection in African countries is basically perceived as being confined to economic purposes, and this has been a driving force in enacting data protection laws across Africa.[3] This is problematic from the perspective of human rights because an individual’s personal information is an embodiment of, or a facet of, his/her personality since it is capable of telling a story about him/her.[4]

The threats to individuals brought about by the processing of their personal information (also referred to as the personal information or data processing problem)[5] is usually discussed in relation to technological developments,¹⁸ although scholars, like Purtova, contend that this problem is also motivated by institutional, market and societal developments.[6] Without a doubt, the on-going digitalization of many African economies, especially that of Nigeria, makes this investigation focused largely on the effects of advances in technology on the data protection of individuals. This by no means, however, undermines other developments identified by Purtova. The internet and other ICTs are now inevitable tools in the lives of many people in Nigeria. This view is justified by the fact that Nigeria has one of the highest populations of internet users in the world.²⁰ The Nigerian Minister for communication technology recently stated that the country had recorded a fifty two percent (52%) internet growth rate and a rapid increase in the ‘adoption and use of ICTs to automate some operations and processes of government Ministries, Departments and Agencies.’ Similarly, Nigeria has recently been described ‘as [a] country with the highest potential for Information and Communication Technology. investment on the African continent.’^[7]

Nigeria today records a very heavy presence online in various e-commerce platforms such as online shopping and e-banking.^[8] In fact, it was recently reported that the country has an estimate of over two million US Dollar worth of e-commerce retail transactions weekly.^[9] Similarly, a number of governmental services are, in recent times, being offered online with e-government initiatives.^[10] Both government and commercial services are increasingly rendered with the aid of personal information processing. This significant leap in the application of ICTs in Nigeria increases the availability and ease of the accessibility to personal information with consequences which are sometime dire for human rights and fundamental freedoms.^[11]

The negative effects of the processing of individuals’ personal information sans significant legal protection are no longer in contention. Concerns have been widely expressed regarding these effects.^[12] Bennett, however, contends that the harm resulting from computerised data processing ‘is not immediately obvious.’^[13] Roos expresses the fear that personal information being processed may be: inaccurate, incomplete or irrelevant; accessed or disclosed without authorisation; used for purposes other than that for which they were collected or destroyed.^[14]

In a more structured manner, Purtova, relying on Zarsky, analysed the concerns based on the various stages of data processing.^[15] In the data collection process, the main issues identified are issues of secrecy, imbalance in power and autonomy.^[16] With regard to the data analysis stage, the main concerns relate to fear of errors, misrepresentation, dehumanisation and aggregation.³² The final stage is the implementation of data and the main threats are the possibility of discrimination, manipulation and inequality.^[17] Other authors, like Birnhack,^[18] Bernal^[19] and Neethling,^[20] focused more on human rights concerns such as the effect of (unlawful) data processing on dignity, autonomy and personality. All these concerns can, debatably, also be attributed to data processing activities in Nigeria.

In spite of these widely acknowledged concerns,^[21] data protection has, arguably, not received the desired attention in Africa unlike other parts of the world. Scholars have advanced various reasons for this unhappy state of affairs. The main explanation is that Africans tend to underestimate the risks resulting from the processing of their personal information.^[22] It must, however, be stated that, notwithstanding this, some African countries are beginning to recognise the value of data protection.^[23] Such is also the case at regional and sub-regional  levels where we find various data protection instruments springing up.^[24] Unfortunately, the same cannot be said of Nigeria, where data protection issues seem to be totally neglected or ignored.^[25] This is so in spite of a number of recent activities which shows significant threat to individuals’ right to control the use of their personal information. For example, there is currently an effort by the government to integrate personal information records of different agencies in Nigeria with the attendant ease of aggregation of personal information.^[26] Similarly, there is a sharp increase in surveillance activities by the Nigerian government.^[27] All these imply substantial loss of control by the people over the use of a significant aspect of their personality. The implication of some of these activities, are, however, far from being appreciated in Nigeria. From the human rights perspective, this study brings to the fore a number of salient issues with regard to data protection in Nigeria and how effective protection can be realised.

• Statement of Problem

Nigerian policymakers are yet to understand the human rights implications of the unfair and unlawful processing of the people’s personal information. Data protection is yet to be given significant attention in Nigeria in spite of the considerable global interest it has gained.^[28] There is still no coherent legal regime for the protection of data protection as narrowly construed.^[29] This is so in spite of the rising incidents of identity thefts^[30] and data breaches.^[31] The extant legal framework, which merely protects secret or private information, arguably cannot cope with the modern-day ‘personal information problem’ which affects the public as much as the private information of individuals.  From this perspective, while the interest of individuals in protecting ‘their hidden worlds’ cannot be undermined, there are contemporary threats to their personal information which goes beyond threats to its privacy.^[32] Thus understood, personal information, which may not necessarily be secret or confidential, also deserves independent protection because of the power it holds over individuals. This state of affairs, therefore, calls for profound legal reforms in this area. Policymakers in Nigeria, however, appear to be at a loss as to how such reforms should take place.

While there is a number of proposed data protection legislation in Nigeria, the likelihood of their being able to influence effective data protection protection remains doubtful. Presently, there are three draft bills which, arguably, contain basic data protection principles – the Privacy Bill,^[33] Data Protection Bill^[34] and the Personal Information Protection Bill.^[35] A number of issues can be raised with regard to these proposed laws which depict the level of government’s commitment on data protection protection. Firstly, these bills, as will be shown subsequently, are fundamentally weak when compared to the data protection legislation in other jurisdictions. Similarly, questions arise as to the need for several bills which are poorly drafted within short intervals. There is, in addition, no evidence suggesting that any of these draft pieces of legislation have gone through sufficient debates and consultation such as are usually associated with law-making of data protection legislation because of the complexities involved.  In addition, the exact status of each of these bills remains largely unknown.

 

• Objective of The Study

This study acknowledges existing works on data protection in Nigeria and adds a new dimension to this literature by looking at data protection from a strictly human rights perspective (based on its human rights value).

• Methodology

In an attempt to answer the main objective of this study, a desk research or ‘library-based’ method is adopted.^[36] This means that both primary and secondary sources will be used for the purpose of the study. Primary sources that will be consulted are international and regional data protection instruments,^[37] constitutional provisions^[38] and statutory data protection codes of the selected countries.^[39] Similarly, case laws also form an important primary source for the purpose of this research.^[40] In addition, the study also relies heavily on secondary sources which include textbooks, published and unpublished dissertations, journal articles, preparatory works of legislation (travaux préparatoires), and conference and seminar papers.^[41] Although the realisation of effective data protection protection depends on the political will of the government and the level of awareness of the people, the quality of the legal framework also has a crucial role to play. The current state of the legal framework is captured sufficiently in these primary and secondary sources which makes the desk research method apt for this study.

 

• Scope of Study

This study looks specifically at the protection of data protection in Nigeria. In this light, the research project carefully considers only legal regimes that protect personal information as narrowly construed since they are the main concern of data protection regimes. Legal frameworks that focus on privacy generally are, therefore, outside the scope of this work. This is because data protection is now debatably a subject of law that can stand on its own, independent of privacy laws.^[42]

• Significance of Study

This study is significant to Nigerian policymakers, and most scholars, as they tend to overlook the ‘added-value’ of a right to data protection.^[43] Similarly, their attention seems to be focused on the economic dimension of data protection, especially from the point of view of the EU adequacy requirement and its implications for Nigeria’s development. They seem also to believe erroneously that simply enacting a data protection law is all that is needed for the realization of data protection right in Nigeria. This misconception misses certain important points with regard to data protection and its regulation. Enacting a data protection law is, without doubt, a necessary move towards realizing data protection protection. For effective realization in a country like Nigeria, however, other crucial issues must be taken into consideration. A close examination of the present draft bills on data protection shows that these important points are neglected. It is, therefore, arguable that, in the event that any of them is eventually enacted, it will join the collection of several other laws with little or no impactor dead letter laws.^[44] In this regard, the Bill, if enacted, may hardly stand the test of time because decisive matters that are to be taken into consideration in the preparatory works are overlooked. In essence, while the lack of a coherent legal framework for the protection of data protection is a problem, this is not the major problem in the area.

• Literature Review

Literature on data protection in Nigeria can largely be categorised based on the main issues considered. Some of the works, however, fall into more than one category. The first category consists of literature which identifies several data protection challenges in Nigeria. In this respect, quite a number of commentators have devoted considerable attention to articulating the data protection problem in Nigeria, especially in the light of recent advances in ICTs. Adeniyi recently advocated the need for data protection law in Nigeria.^[45] His contention is based on an analysis of the data protection challenge which resulted from the recent SIM card registration directive of the government. He argues that ‘[a]s laudable as the goal of the directive may seem, the registration of [a] SIM card poses [an] inherent danger to the security of Nigerians.’^[46] Izuogu also carried out a similar but more detailed study of the government policy.^[47] Both scholars conclude that the solution to the personal information proliferation would be the adoption of a law in line with the EU Directive without anything more. Adelola et al discuss the data protection challenge resulting from the emergence of e-commerce and the proliferation of the internet.^[48]  Their discussion is quite brief and devoted rather too much space to an analysis of the legal framework of other jurisdictions. Jemilohun, in an article on legislating for cyberspace, also briefly raised concerns on biometric information collection by the Independent National Electoral Commission (INEC) during the last general election.^[49] A country report by the Electronic Privacy Information Centre (EPIC) provides details on data protection challenges that arise from a comprehensive national identity database in Nigeria.^[50] Yusuff considers the impact of the growing use of CCTV cameras in public places in Nigeria.^[51] His robust discussion, however, does not devote much space to the Nigerian situation. A publication by Freedom House presents facts on systematic government surveillance of the activities of people on the internet.^[52] All the above works are narrow as they consider only specific challenges resulting from the proliferation of ICTs in Nigeria. A recent article by this researcher brings together most of these issues in a concise form and identifies other overlooked threats to data protection, such as the data processing activities of credit bureaus in Nigeria.^[53]  This research project takes these discussions further by elaborating on most of these issues based on an analysis of recent data processing activities.

The second category of literature in Nigeria evaluates the extant legal framework on data protection.Most scholarship falls into this category. Two scholars consider data protection elaborately in their doctoral dissertations.^[54] A cursory look at these works shows that data protection is currently protected via the Constitution, common law, sectoral law and soft laws (regulations and guidelines). Allotey, in discussing transborder data flow (TBDF), evaluates the privacy and data protection regime.^[55] He concludes that the extant legal framework is insufficient to enable Nigeria to benefit from the global network economy. He identifies several reasons for the paucity of case law on privacy (and data protection).^[56] Laosebikan also carries out a similar study, with, however, a special focus on internet cafés.^[57] She concludes, like Allotey, that ‘[i]n Nigeria, while protection is provided for the right to privacy in the Constitution and under certain statutes, there is very little constitutional protection for data.’¹³⁹ Other works, like those of Nwauche,¹⁴⁰ Kusamotu,^[58][59] Jemilohun,^[60] Akinsuyi,^[61] and Puddephatt et al^[62] also briefly examine the extant legal regime and reach conclusions similar to those of Allotey and Laosebikan. A closer look at all these works shows that the discussions on privacy and data protection are conflated, thereby suppressing the added-value of a right to data protection. A more lucid example of this fact is the research project by Salami, which appears to be skewed in favour of data protection being solely for the purpose of protecting the confidentiality of personal information.^[63] An article by this researcher points out that there is a total neglect of data protection in Nigeria based on an analysis of the present data protection regime vis-à-vis the current processing activities.^[64] In this article, the point was made that a lack of recognition of the subtle differences between data protection and privacy is one of the reasons for the neglect of data protection in Nigeria. This research project expands on this argument by focusing narrowly on data protection alone, thereby bringing out its added-value in this information society.

• Definition of Terms

Data protection (protection): Unlike privacy, the term ‘data protection’ is, arguably, not fraught with definitional difficulties. This is without prejudice to the generally acknowledged problems associated with the conceptualization of legal terminologies.

Personal data/information: Schwartz and Solove note that ‘personal data’ is a ‘central concept in [data] privacy regulation around the world.’ A common misconception with respect to the notion of personal information under data protection law is that it is information which is private, secret or confidential. This misconception seems to be because of the use of the word ‘personal’, being interpreted to mean ‘private’.

• Chapter Outline

Chapter one sets the base for the study. It looks at the general background and states the primary problem that provoked this research. In addition, the chapter sets out the objectives of the study be investigated. Chapter two contains the concept of data protection which focused on analyzing the conceptualization of data protection in terms of Nigeria legal system. Chapter three discusses the legal regime of data protection as contained the Nigerian constitution while highlighting the various promulgations that are related to data and information protection. The chapter four discusses the gap and challenges in Nigerian legal system for data protection while chapter fives gives the summary, conclusion and recommendations based on findings.

 

 

CHAPTER TWO

THE CONCEPT OF DATA PROTECTION

2.1 Introduction

The right to data protection is, without a doubt, an important contemporary issue in this age of ‘big data’ and ‘digital devices’. Its development has enjoyed