Nigeria has enacted the Data Protection Act to safeguard citizens\u2019 personal information and data. In the same period as the Act came into effect, the Central Bank of Nigeria (CBN) in what appears to be unrelated to banking services, is asking banks to collect social media handle information from its customers. The CBN claims that this is part of Know Your Customer (KYC) information needed from holders of accounts. <\/p>\n\n\n\n
The Nigeria Data Protection Act 2023 is among the\nfirst laws that President Bola Tinubu \nassented to after assuming the office of President of Nigeria on May 29,\n2023. It was passed by the Senate on May 3 and the House of Representatives on\nMay 23 in the 9th<\/sup> National Assembly and eventually gained\npresidential assent on June 12, 2023. The Act is the legal framework\nfor the protection and processing of personal information,\nin order to safeguard the fundamental rights, freedoms\nand interests of individuals guaranteed in the 1999 Nigerian Constitution. It\nestablishes the Nigeria Data Protection Commission headed by a National Commissioner\nwith the responsibility for regulating the processing of personal information in line with the provisions of the Act. <\/p>\n\n\n\n In the exercise of its functions, the Commission is\nempowered to carry out investigations into complaints of violation of the provisions of the Act, issue compliance\norders, make enforcement orders or impose sanctions on a party found to be in\nbreach of the provisions of the Act. In the course of investigation, the\nCommission must apply and obtain a warrant to among other things, enter and\nsearch any premises, stop and search any person on such premises, seize, seal,\nremove or detain anything, in the company of a law enforcement officer, for the\npurpose of obtaining evidence. Compliance orders issued by the Commission are\nsubject to judicial review and failure to comply with an order amounts to an\noffence punishable by a fine or imprisonment for a maximum of one year or both.\n<\/p>\n\n\n\n The\nAct stipulates that data collection must be for a specific purpose which must\nbe legitimate, and that it must be processed in a fair, lawful and transparent\nmanner and not retained for longer than necessary. To this end, it requires\ndata controllers and processors of major importance to be registered with the\nNigeria Data Protection Commission. It also stipulates that a data controller\nor processor must engage the services of a Data Protection Officer who will be\nresponsible for advising these data controlling entities and their employees on\ndata processing, as well as monitor compliance with the provisions of the Act\nand other related internal policies. A Data Protection Officer will be the\npoint of contact for the Data Protection Commission on matters of data\nprocessing. Data controllers and processors of major importance are defined by\nthe Act as those domiciled, resident in or operating in Nigeria and process or\nintend to process personal data of a specified number of data subjects who are\nwithin Nigeria or those processing personal data of particular value or\nsignificance to the economy, society or security of Nigeria. The Act also\nstipulates conditions for transfer of data outside Nigeria. <\/p>\n\n\n\n The\nNigeria Data Protection Act provides safeguards to individuals with respect to\ndata collection and processing. It makes it compulsory for an individual\u2019s\nconsent to be sought and received for the processing or his or her data. The\nindividual also reserves the right to withdraw this consent. A person whose\ndata is being collected and processed, also called a data subject has rights to\nrequest from a data controller, information relating to their data including\ncategory of data, purpose of processing and period of storage. Also, a data\nsubject has the right to request for erasure of data, correction or deletion of\ninaccurate, incomplete or misleading data, and has the right to lodge a\ncomplaint with the Commission. A data subject who suffers injury, loss or harm\nas a result of a violation of the provisions of the Act is entitled to seek\ndamages from the defaulting data controller or processor, in civil legal proceedings.\n<\/p>\n\n\n\n Other\nprocedural safeguards include that a data collector and processor is obliged to\napply measures to ensure the security, integrity and confidentiality of data in\nits control or possession. A data collector or processor is also under\nobligation to report to the Data Protection Commission, any breach with respect\nto personal data that is likely to result in a risk to the rights and freedoms\nof individuals. <\/p>\n\n\n\n The\nAct is a welcome development as it provides further protection for the rights\nof individuals to privacy, guaranteed by section 37 of the 1999 Nigerian\nConstitution. It is also the first comprehensive legislation for data\nprotection in Nigeria. Data protection was formerly regulated by the Nigeria\nData Protection Regulation, 2019 issued pursuant to the National Information\nTechnology Development Agency (NITDA) Act, 2007. With the enactment of the\nNigeria Data Protection Act, the Nigeria Data Protection Bureau formed in 2022\nis expected to transition into the Nigeria Data Protection Commission\nestablished by the Act. <\/p>\n\n\n\n In\nthe light of the Act, it is unclear why the CBN is asking banks to request\nsocial media handle information from customers. Critics worry that the CBN\u2019s\ndirective to banks may be politically motivated and lacking in legal basis. <\/p>\n\n\n\n PLAC had earlier provided some analysis into the Nigeria Data Protection Bill, 2023 transmitted to the National Assembly in April 2023 by immediate past President, Muhammadu Buhari. Read here – https:\/\/tinyurl.com\/4y2jseh4<\/a> . See the Act here: https:\/\/shorturl.at\/hlqLT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Nigeria has enacted the Data Protection Act to safeguard citizens\u2019 personal information and data. In the same period as the Act came into effect, the Central Bank of Nigeria (CBN) in what appears to be unrelated to banking services, is asking banks to collect social media handle information from its customers. The CBN claims that […]<\/p>\n","protected":false},"author":2,"featured_media":1803,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"class_list":["post-3284","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/posts\/3284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/comments?post=3284"}],"version-history":[{"count":2,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/posts\/3284\/revisions"}],"predecessor-version":[{"id":3291,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/posts\/3284\/revisions\/3291"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/media\/1803"}],"wp:attachment":[{"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/media?parent=3284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/categories?post=3284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/placng.org\/Legist\/wp-json\/wp\/v2\/tags?post=3284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}