{"id":85911,"date":"2024-08-04T20:51:28","date_gmt":"2024-08-04T20:51:28","guid":{"rendered":"https:\/\/dnllegalandstyle.com\/dnl\/?p=85911"},"modified":"2024-08-04T20:51:28","modified_gmt":"2024-08-04T20:51:28","slug":"the-draft-national-artificial-intelligence-ai-strategy-a-diminution-of-privacy-and-data-protection","status":"publish","type":"post","link":"https:\/\/dnllegalandstyle.com\/dnl\/the-draft-national-artificial-intelligence-ai-strategy-a-diminution-of-privacy-and-data-protection\/","title":{"rendered":"The (Draft) National Artificial Intelligence (AI) Strategy: A Diminution of Privacy and Data Protection?"},"content":{"rendered":"

By Olumide Babalola<\/strong><\/em><\/p>\n

On the 3rd day of August 2024, Dr Bosun Tijani \u2013 Nigeria\u2019s Minister of Communication, Innovation and Digital Economy \u2013 released a draft document titled \u2018National Artificial Intelligence (AI) Strategy\u2019 and invited the public to make \u2018input\u2019 and \u2018further dissect its contents.\u2019 As a member of the public and a stakeholder in the privacy and data protection industry, I have decided to make my input public for posterity\u2019s sake especially since this is not the first time the Federal government would draft a strategy. An attempt was made in 2021.<\/p>\n

Clarity of purpose<\/strong><\/p>\n

If the 73-page document is meant to be put to good use by all and sundry, its introduction must clearly articulate the purpose. I read through the document but struggled to find a clear expression of what purpose it is meant to serve.<\/p>\n

However, on page 12, it states that: \u201cA national strategy therefore must \u201cA national AI strategy, therefore, must provide nuanced guiding principles clearly defined and articulated in alignment with country values and goals, as well as ensure consistency with higher-order goals for the future of humanity and civilisation.\u201d There are two problems with this statement. First, while the statement reiterates a part of the normative value of a national strategy, it does not confirm whether or not that is its own purpose. Secondly, assuming the statement contains the objective of the document, the proposition of principle \u2026 in alignment with country\u2019s values and goods\u2019 falls short of the utility of a national strategy. Conceptually, a document conveying national strategy ought to essentially contain a guide and communicate the government\u2019s plan to \u201callocate\u201d resources towards attainment of its policy objectives. The allocation of resources is either omitted or hidden in the document. I however stand to be corrected on this. For whatever it is worth, these clear and lucid objectives need to be set out at the beginning of the document to ease reading, understanding and utility by all concerned.<\/p>\n

Insufficient commitment to privacy and data protection<\/strong><\/p>\n

For a document that proposes to enhance citizens\u2019 welfare and quality of life, one would have expected a real and articulate devotion to fundamental rights and freedoms, especially privacy and data protection. Surprisingly, in the entire 73-page document, \u2018human rights\u2019 is only mentioned three times with no clear-cut explanation of real protection and surprisingly, reference to the Nigerian Constitution is conspicuously omitted. In the words of Neil Richard, (a professor of privacy) in his recent book \u2018Why Privacy Matters\u2019 published in 2022 by Oxford University Press at page 9:<\/p>\n

\u201cIf we want to build a digital society consistent without hard-won social values \u2013 a society that is fair, just, equitable, free and sustainable \u2013 then a meaningful commitment to privacy must continue to be a part of that society. Privacy matters and it will continue to matter, not just because privacy is a proxy for social power but because good privacy rules promote the essential human value of identity, freedom and protection\u201d<\/p>\n

For clarity, I will narrow down my observations on privacy and data protection into the following sub-headings hereunder:<\/p>\n

i. Avoidable misnomer and typographical errors<\/em><\/p>\n

Contrary to the reference to 2024 on page 12, the Nigeria Data Protection Act was enacted in 2023 although the correct date was stated in the subsequent opportunity. On page 15, the statement \u2013 \u201cAIs dependence on data makes the National Data Protection (NDP) Act 2023 statutes protect data subjects and guide processing of personal data essentials\u201d \u2013 needs to be rejigged for many reasons. First, it is fraught with some grammatical and typographical errors: the \u2018N\u2019 in NDPA stands for \u2018Nigeria\u2019 but not \u2018National\u2019. Secondly, for the purpose of syntax, \u2018statutes\u2019 should be expunged not only because the NDPA is not plural but also for logical reasons. Third, the \u2018essential\u2019 after personal data should also be removed \u2013 it is clearly an erroneous addition which robs the statement of its desired meaning.<\/p>\n

On page 43, the phrase \u201cadditional Acts on Data Protection Regulation\u201d is confusing. Since the passage references relevant legislation and policies, why not simply state the Nigeria Data Protection Act 2023? Also \u201ccybercrime\u201d \u201cNOTAP\u201d and \u201cNUC\u201d in the paragraph are neither legislation nor policies, they should be corrected to reflect the specific laws concerned. It may also be helpful for the document to have a definition section to clear any misconception of (technical) terms. For example, \u201cdata\u201d and \u201csensitive data\u201d are used carelessly throughout the document but these terms have varying meanings under specific laws. Within the context of data protection, \u201csensitive personal data\u201d has a statutory meaning which may be at variance with similar terms under other legislation. Worthy of note is also an erroneous reference to the repealed Copyright Act of 2004 instead of the extant 2022 Act.<\/p>\n

ii. Misconception of the coverage of the NDPA<\/em><\/p>\n

On page 12, the document audaciously declares: \u201c\u2026the 2023 Data Protection Act does not particularly address AI-related data concepts\u201d. This is somewhat misleading since most, if not all AI mechanisms process personal data \u2013 the subject of NDPA. Interestingly, section 37 of the NDPA particularly prohibits the use of rights-impacting AI (i.e automated decision-making) for processing activities exclusive of human intervention except under listed circumstances. Secondly, in addition to referenced issues like data security and cross-border transfers in relation to AI, the NDPA also regulates the entire life cycle of personal data processed by AI; transparency; accuracy (data quality); data minimization (big data issues); storage limitation (retention periods); consent mechanism; sensitive personal data; purpose limitation (misuse of data\/secondary use) and data breach etc. Since it proposes to be a roadmap, the document ought to be as directional as possible.<\/p>\n

iii. Ethical principles for privacy<\/em><\/p>\n

On page 27, the fourth pillar proposes clear and comprehensive ethical principles for privacy among other interests. Flowing from this, page 39 reproduces the same as one of the outcomes, but privacy is conspicuously omitted from the strategies proposed on page 40. As if that is not odd enough, apart from transparency and accountability, all other principles of data protection are completely omitted. Moving forward, due consideration ought to be given to the force ascribable to the proposed \u201cEthical principles for AI\u201d. Are they going to be enforceable legislation or another initiative like the legislative House of Representatives Committee\u2019s curious \u2018developing and implementing AI policies\u2019 as referenced on page 35?<\/p>\n

iv. Funding of another regulator despite omission\/refusal to fund the NDPC?<\/em><\/p>\n

As it is with every industry, page 42 proposes the establishment of an AI Governance Regulatory Body. While I am not particularly against this, my concerns are twofold. One, the Nigeria Data Protection Commission (NDPC) \u2013 one of the existing agencies recognised (on page 13) in the AI ecosystem for its implementation is currently cash-starved. It is yet to be funded by the Ministry of Digital Economy, Innovation and Communication and other agencies as prescribed under section 19 of the NDPA. While this weight is yet to be shed by the ministry, the document\u2019s proposal of an additional body and financial burden may not be justifiable. Two, there exists the National Centre for AI and Robotics (NCAIR) \u2013 a subsidiary of NITDA with statutory functions woven around the development of technology and sundry infrastructure. It is more cost-effective and efficient to empower the agency in this regard. Conclusively, regardless of this scepticism, the document ought to propose workable plans for funding and allocation of resources to the outlined objectives.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Olumide Babalola On the 3rd day of August 2024, Dr Bosun Tijani \u2013 Nigeria\u2019s Minister of Communication, Innovation and Digital Economy \u2013 released a draft document titled \u2018National Artificial Intelligence (AI) Strategy\u2019 and invited the public to make \u2018input\u2019 and \u2018further dissect its contents.\u2019 As a member of the public and a stakeholder in […]<\/p>\n","protected":false},"author":9,"featured_media":48335,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[11,5],"tags":[],"class_list":["post-85911","post","type-post","status-publish","format-standard","has-post-thumbnail","category-techlaw-digest","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t