By Kingsley I. Ilechukwu, Bureau Chief, South West

The Nigeria Data Protection Commission (NDPC) has urged all banks, telecom operators, educational institutions, government parastatals and other organizations that collect and process data in Nigeria to register with the Commission between now and December, 2023 for data protection compliance monitoring.

A heads-up from the Head, Media Unit  at NDPC,  Itunu Dosekun says the National Commissioner at NDPC, Dr. Vincent Olatunji stated this at a sensitisation workshop on Data Privacy & Protection, held in Lagos, south west, of the country.

According to the NDPC National Commissioner  the charge to the aforementioned institutions was in line with the provisions of the Act which mandated all data controllers and data processors to get registered within 6 months of the enactment of the law.

Dr. Olatunji said that all the registered organizations would also be required to file their annual audit report with the Commission between January and March yearly. 

While noting that the Commission was also increasing awareness to let Nigerians know their rights when it came to their data, Olatunji said the registration of all organizations handling data was to ensure that the citizens’ rights were preserved by all data processors and controllers in Nigeria. 

Registration and audit return

Speaking on the timeline for the registration of all data controllers and processors, which included all organizations that dealt with people’s personal data such as banks, telecom operators, insurance companies and schools, among others, the nation’s data ombudsman said: “What we have in the law is that all data controllers and processors in Nigeria should register with the data protection authority. What the law says is that we should give them six months to acquaint themselves with the provisions of the law.  He noted that data controllers & processors are over 500,000 in Nigeria.”

 “From now till Dec 31st, they  have to register with the Commission while they are expected to file their data compliance audit return between 1st of January to 31st, March, every year,” he added.

The NDPC boss explained that the Nigerian Data Protection Commission was saddled with the responsibility of creating awareness, guarding the rights of individuals to control and protect their personal information in the interconnected world, conduct investigations and meet out penalties for violators.

Olatunji affirmed that aside from increasing foreign direct investment  (FDI) inflows into Nigeria, the DPA would boost the confidence of investors knowing full well that there were workable legal frameworks on ground to protect them and their businesses.

Said he: “Because a lot of countries now, when you don’t have your data protection law and the Data Protection Supervisory Authority, they don’t want to do business with you, with this law you will be able to cross that stage that the average investors coming to Nigerian will know that we have a law, and an independent DPA (Data Protection Authority).

While highlighting the rights of data subjects, Olatunji said every Nigerian was a data subject as they all had data with either the government or private organizations.

“Data subjects have the right to give their consent or not when their data is being collected; the right of rectification where data is not correct,” he said adding  other rights included portability, erasure, refusal of processing, and more.

On the part of data controllers and data processors, “they owe us the duty of care and accountability to ensure that the data with them is well protected. What kind of measures are they putting in place in terms of technological measures and organization measures to ensure that the data with them is secure” he explained.

The NDPC boss stated that one of the aims of the data protection law was to create confidence and trust in the economy and to attract foreign direct investments in Nigeria. 

A Senior Advocate of Nigeria(SAN) and Managing Partner  at Alliance Law Firm Uche Val Obi, remarked: “With a workable legal framework on data protection and privacy, even children who cannot ordinarily give legitimate consent are protected. Before you can obtain their data, you need the consent of parents or caregivers. The issue of breach is serious and can lead to criminal consequences, where the defaulters could be prosecuted, arraigned, and even sent to jail.”

The Head of Legal Enforcement & Regulations Department at NDPC, Babatunde Bamigboye Esq,  added: “People won’t be able to steal your identity; your personal data, for instance, is like a key in the digital space. You want to get your password, you want to get your drivers’ licences, you want to communicate, you want to go online, your identity is your key, so if this identity is not protected, how are you going to secure your digital assets.”

It will be recalled that President Bola Ahmed Tinubu signed the country’s Data Protection Bill into law on June 12 this year. This transformed the existing National Data Protection Bureau headed by Olatunji into a Commission that will be driving the implementation of the law.