The protection of privacy of communication in Nigeria finds its roots in Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (the Constitution) which guarantees the privacy of Nigerian citizens, their correspondence and telegraphic communications among others.
The need for comprehensive protection of the freedoms and privacy of persons online and offline has become even more glaring in the face of continued incidents of cyber harassment, theft, unauthorized use of data, unwanted surveillance, spamming and related conduct.
Apart from the Constitution, the data protection regulations which exist in Nigeria are either sector specific such as the Nigerian Communications Commission RTS Regulation 2011, or are not yet operational such as the NITDA Guidelines on Data Protection of 2013 which are in fact currently under review. Against this background it is easy to see why the Digital Rights and Freedom Bill (the Bill) was passed by the House of Representatives on 19th December, 2017 and by the Senate on 13th March, 2018.
The Bill seeks, amongst other things, to promote the freedoms of expression, assembly and association online; guarantee the fundamental privacy rights of citizens, define the legal framework regarding surveillance of communications and guarantee application of the human rights which apply offline within the digital environment and online.
One of the major innovations of the Bill is the introduction of more comprehensive protections for personal data. “Personal Data” is defined under the Bill as any information relating to an identified or identifiable natural person (‘data subject’); information relating to an individual, whether it relates to his or her private, professional or public life. It includes but is not limited to anything from a name, address, a photo, an email address, bank details, posts on social networking website, medical information or a Computer’s IP address.
The Bill provides for the protection of personal data, circumstances when such data may be disclosed as well as the duties of every person (natural or legal) who controls, collects, uses or otherwise processes data of others. By the provisions of the Bill, individuals and organizations will only be able to collect, use or disclose personal data of other persons with the knowledge and consent of the data owners. The purpose for which data is being collected will be required to be disclosed to the owner of the data and the use of the data collected must be reasonable.
Very significantly, the Bill seeks to minimise unwanted and undisclosed surveillance of individual’s communications by ensuring that such surveillance is only carried out in cases of necessity and even at that, with the knowledge of the person whose communication is under surveillance or pursuant to an appropriate order of court.
The National Human Rights Commission is designated as the administrative Agency that will be responsible for the administration of the Act, in consultation with other relevant government Agencies, relevant civil society actors and relevant private sector members. It may however be more expedient for a separate entity to be established to administer and enforce the provisions of the Bill because of the technical aspects involved.
The Bill provides for general offences and penalties for violation of its provisions. By Section 16 of the Bill, most of the penalties for violation of provisions of the Bill
are, upon conviction, terms of imprisonment of between five to ten years with options of fines in some cases ranging from N5,000,000 to N10, 000,000. It is expected that the steepness of these penalties will be an effective deterrent to would-be offenders.
The need for the passage of a law such as the Digital Rights Bill is most certainly overdue, in view of the volume of data exchanged daily and a proliferation of media through which the data, including those containing sensitive and personal information are exchanged. The passage and implementation of the Bill will certainly reduce the abuses of personal data. It is therefore important that the Bill receives presidential assent in order to become operational and trigger the much needed reforms in the area of data protection in Nigeria.
