By Clifford Agugoesi, Editor-in-Chief

The Nigeria Data Protection Act 2023 received the accent of President Bola Ahmed Tinubu on Democracy Day, June 12, 2023, and experts believe that this has effectively positioned Nigeria into an enviable place in the comity of nations as far as data protection and data privacy are concerned. Expectedly, not a few Nigerians are raising questions as to the import of the Act against the background of their asymmetrical grasp of the content and essence of the law.

In order to remove this asymmetry and place Nigerians as it were on the same page, concerning the Data Protection Act, the National Data Protection Commission(NDPC), the descendant of the former National Data Protection Bureau(NDPB), Sunday in a virtual press conference engaged ICT  newshounds in  Nigeria on the activities of the  Commission. The  interactive session  was graced by over 20 journalists.

Addressing the journalists on what his Commission’s priorities would be in the next few weeks or months, the National Commissioner at NDPC, Dr. Vincent Olatunji expressed his satisfaction with the presidential accent to the Data Protection Bill while underscoring the need for Nigerians to understand their rights and obligations under the Act.

” It is just normal that when you have a law or you have a document that has been approved, it is really important to ask what the next steps would  be?  And, from our own perspective, we believe that the Data Protection and Privacy Ecosystem is still emerging in Nigeria. So there are many things for us to do to ensure that our people, the data subjects, properly understand what their rights are, when they are being asked one question or the other in terms of collecting their data.  And it is also important that the data controllers and  processors must know their obligations to the data subjects, because the issue of accountability is really key and that is all about what we are talking about here on the part of data controllers and processors,” Dr. Olatunji said. 

He continued: “So there are three areas that we will focus on. One is the Awareness we have mentioned.  It is not enough to just have a law and people don’t even know what is even there.  It is important that data subjects know their rights and data controllers and processors to know their obligations to data subjects. So, awareness is key!  The number 2 thing that we are looking at is Capacity Building.  I am sure that you must have heard severally that this (Data Protection & Privacy ) ecosystem will create jobs , that it will make us globally-competitive.  And, it is really important to say ok, we want to be globally-competitive, to have competent professionals who will participate in building this ecosystem.  For instance, part of what we have in the Law is that each Data Processor and Controller must have a Data Protection Officer overseeing their Data Protection activities. Now, in Nigeria, there is shortage of Data Protection Officers(DPOs) and we are saying  over 500,000 Data Protection Compliance organizations Organisations(DPCOs) should have DPOs; how do we now resolve that challenge?  So, Capacity Building(building a pool of globally –competitive data professional experts)   is Number 2 on our Agenda and we have already put in measures to ensure that we get this done.  Number 3 thing on our mind is to actually break the Law down into short-medium-to-long-term- Frameworks, that is every part/section of the Law will be broken down into specific activities for people to actually understand what we intend to do going forward with the Law that Mr. President has graciously given accent to.”

To bolster his Commission’s awareness drive, Dr. Olatunji  announced a partnership between the NDPC and the National Orientation Agency(NOA). 

The NDPC chief stated that the Commission would take advantage of  the National Data Protection Adequacy Programme (NaDAP) to carry out training programmes for Data Protection Officers (DPOs) to improve the capacity of organisations and individuals within such organisations to respond adequately to the technical and regulatory nuances of a data-protected environment.

By way of statistics, the NDPC helmsman, among other things, explained that Data protection compliance in the public sector was about  49 per cent, with awareness ongoing to ensure the buy-in of the private sector.

According to him, the Commission, since inception, had  created 200 jobs and  enhanced the  capacity of experts working in the public and private sectors, with over 160 Data Protection Compliance Organisations (DPCOs)s  licensed and rendering almost  17 services in Nigeria.

NDPC will fine organizations based on the impact of the data protection breaches.

The NDPC is independent based on the law that set it up and will be able to sustain itself financially from licencing of DPO, annual returns and fines from data protection breaches.

NDPC has sealed a partnership with the National Orientation Agency to have a spread across the country. The partnership will also help in awareness creation.

Fidelity Bank, Guaranty Trust Bank, Leadway Assurance and Babcock University are still under investigation for possible data protection breaches.

The data protection law is today seen as a global benchmark as it is based on the General Data Protection Regulation (GDPR).