Who can legislate on data protection in Nigeria? An Opinion by Olumide Babalola<\/p>\n
In recent times, I have had a number of stimulating on and offline conversations with privacy professionals and enthusiasts on the reasons for the dearth of data protection laws and materials in Nigeria and possible solutions.<\/p>\n
There is no gainsaying that our country remains on the list of African Countries without a data protection law (the Nigeria Data Protection Regulation 2019 (NDPR) is not considered a law in this context). It is further sad that, in spite of being a signatory to the ECOWAS Supplemantary Act on Personal Data Protection 2010 and African Union Convention on Cyberscurity and Personal Data, we are yet to have a general data protection law.<\/p>\n
It must however be noted that, some commendable attempts have been made by in the past by the National Assembly in the mould of the Data Protection Bill 2010 (HB 276, HB 45) and later the Data Protection Commission Bill 2019 as presented to the Executive in May 2019 but it was not deemed worthy of presidential assent for some right or wrong reasons. I also understand that two (2) Data Protection Bills are currently pending before the 9th National Assembly as sponsored by Hon. Yakubu Dogara (HB: 564) and Hon. Ndudi Elumelu (HB: 504) but not so much has been heard about the progress of these very significant bills.<\/p>\n
However, as the Federal Government continues to, with respect, struggle in its tracks to deliver a Data Protection Act to the country, States\u2019 Governments have also appeared uninterested in legislating data protection with the exception of one of the states in the southwest which I hear, has concluded works on a bill on data protection in readiness for sponsorship to their House of Assembly.<\/p>\n
As it appears that, the States may come to our nation\u2019s rescue faster than the Federal Government, we may need to interrogate the legislative competence of the various Houses of Assembly to make laws on data protection under our extant Constitution.<\/p>\n
Data protection as a component of right to privacy<\/p>\n
An interrogation of legislative competence must necessarily start from first ascertaining the nature of \u2018data protection\u2019 as a concept within the context of law-making powers of the legislative houses concerned. For localization purposes, I will restrict myself to some Nigerian academics who have written on the subject for clarity on the vexed argument as to the relationship of data protection with right to privacy.<\/p>\n
Dr. Kemi Omotubora, lecturer of Information Technology Law, University of Lagos, is perhaps, the fiercest critic of conflation of data protection and privacy. In a recent paper she co-authored with another academic from Leeds University, United Kingdom, the learned data protection lecturer decried the problematic definition of personal data because it has blurred the fine lines between the concepts of privacy and data protection that has been drawn from the inception of the data protection regime\u201d<\/p>\n
However, she went ahead to acknowledged that: \u201cFollowing the same track, the European courts have consistently conflated data protection and privacy and treated the former as an extension of the latter.\u201d She referred to a number of decisions (Breyer, Volker, Rundfunk etc) reported in my Casebook on Data Protection, where the European courts ruled on the fusion of data protection with privacy. See \u2018Next Generation Privacy\u2019 Information and Communications Technology Law accessible at https:\/\/doi.org\/10.1080\/13600834.2020.1732055<\/p>\n
In another co-authored paper titled \u201cPersonal Data Protection in Nigeria: Reflections on opportunities, options and challenges to legal reforms\u201d, Dr. L.A. Abdulrauf of the Department of Public Law, Faculty of Law, University of Ilorin, states that:<\/p>\n
\u201cIn spite of its commercial purposes, there is no denying that, data protection has its roots in the right to privacy in international human rights instruments\u2026Thus, the normative basis of data protection is in the human rights instruments which arguably makes it human right too. While some jurisdictions do not even distinguish privacy from data protection, others have anchored their data protection laws on right to privacy. The relationship between data protection and other human rights also strengthens the argument in favour of it being a human right.\u201d<\/p>\n
In his contribution to a book titled \u201cAfrican Data Privacy Laws\u201d, Iheanyi Samuel Nwankwo, a research associate at Institute for Legal Informatics, Leibniz Universitat, Hannover, Germany states at page 47 that:<\/p>\n
\u201cBut irrespective of these conceptual differences, this chapter will focus on information privacy in Nigeria, that is, the aspect of the law that regulates how personal information is collected, processed, accessed, shared and stored by others\u2026.The words \u201cdata protection\u201d and \u201cinformation privacy\u201d are used interchangeable and they are\u00a0intended to mean the same thing…\u201d<\/p>\n
From the foregoing interventions, it appears that, from whatever perspective one decides to view \u2018data protection\u2019, the underpinning presumption, especially in Nigeria where there exists no judicial decision at the moment, favours the concept of data protection as an integral constituent of right to privacy and that is where this writer has, unassertively, chosen to pitch his tent until a defining decision is handed down by our courts.<\/p>\n
Can State governments legislate data protection?<\/p>\n
Apparently, \u201cdata protection\u201d or its semblance does not exist under the exclusive legislative list but some commentators have curiously argued that, only the Federal Government of Nigeria has the legislative competence to make laws relating to data protection. Senator Ihenyen, Esq.- a consistent Information Technology Lawyer, in a data guidance note, stated that:<\/p>\n
\u201cFollowing Nigeria\u2019s federal system, only the National Assembly has the power to legislate on broadcasting, posts, telegraphs, telephones, televisions, wireless communication and any incidental matters. This is in accordance with the provisions of the second schedule of the Constitution. The implication of this is that, if Nigeria\u2019s federal legislature failed to legislate on data and privacy related matters, state legislators do not have the power to legislate on them\u201d<\/p>\n
Without necessarily commenting on the aptitude or otherwise of Mr. Ihenyen\u2019s opinion above, it is worth of note that, item 28 of the exclusive list provides for \u201cfingerprints identification and criminal records\u201d which are universally classified as sensitive data covered by data protection laws, but that is not to say that, sensitive data alone forms the whole gamut of data protection to make it an exclusive matter.<\/p>\n
Although a direct answer to the poser here cannot be found in the Constitution which does not prohibit states from legislating fundamental rights, I will attempt an answer by drawing inferences from a similar but specific data protection laws passed by States Houses of Assembly in relation to fundamental right to privacy.<\/p>\n
Freedom of Information Act 2011 (FOIA)<\/p>\n
The FOIA was passed in 2011 by the National Assembly to, among other things, make information freely available and for the protection of personal privacy. This Act has been repeatedly argued in various courts to guarantee freedom of expression which includes \u201cfreedom to receive information\u201d under section 39(1) and right to privacy under section 37 of the Constitution.<\/p>\n
In that same 2011, the Ekiti State House of Assembly followed suit when it passed its own Freedom of Information Law to make information available and protect personal privacy. Not long after that Imo and Delta States also passed their own Freedom of Information Laws which, in part, protect personal data as well.<\/p>\n
Conclusively, although these laws are not comprehensive as far as standard data protection provisions are concerned, they are nevertheless States enactments on data protection and right to privacy.<\/p>\n
With the absence of any item under the exclusive legislative list ceding sole powers to legislate data protection to the Federal Government, it is this writer\u2019s respectful opinion that, States\u2019 Houses of Assembly possess requisite legislative competence to make laws on the subject.<\/p>\n
Olumide writes from Lagos, Nigeria.<\/p>\n","protected":false},"excerpt":{"rendered":"
Who can legislate on data protection in Nigeria? An Opinion by Olumide Babalola In recent times, I have had a number of stimulating on and offline conversations with privacy professionals and enthusiasts on the reasons for the dearth of data protection laws and materials in Nigeria and possible solutions. There is no gainsaying that our […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[],"tags":[],"class_list":["post-75611","post","type-post","status-publish","format-standard"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t