The Nigeria Data Protection Bureau (NDPB), the newest Nigerian government digital agency, was birthed on February 4, 2022, following President Muhammadu Buhari’s approval of its establishment. Stating its statutory functions, the official press release that announced the establishment of the NDPB said it would “…be responsible for consolidating the gains of the Nigeria Data Protection Regulation (NDPR) and supporting the process for the development of a primary legislation for data protection and privacy.” The NDPB was established to play an ancillary role to the National Information Technology Development Agency (NITDA), which had been solely saddled with the responsibility of ensuring data privacy regulation and compliance in Nigeria, long before the former was established. Now, the NDPB has been given the mandate to enforce compliance with the provisions of the Nigeria Data Protection Regulations 2019 (NDPR).
The Dialogue on Data and Development (DDD) Team* of the Centre for the Study of Economies of Africa (CSEA) engaged Dr Vincent Olatunji, the NDPB’s pioneer National Commissioner, with a view to finding out about such efforts which the agency, despite its comparatively young age, has since been making to secure a prominent place for Nigeria in the African digital space. In this conversation with the DDD team, he expressed implicit confidence about how the agency is currently fine-tuning well-coordinated plans for the biggest data governance drive in Africa [Excerpts].
Given the experience of NITDA and other agencies around digital economy, what unique role is the Nigeria Data Protection Bureau out to play?
Data privacy and protection occupy a unique place in every facet of our lives and livelihoods. This fact is attested to by Section 37 of the 1999 Constitution of the Federal Republic of Nigeria. This is under fundamental rights. Nigeria Data Protection Bureau (the Bureau), being the institution that is mandated to safeguard the data-related aspect of privacy, plays a very unique role. Other agencies have their roles in the broader socio-economic development of the country. In this regard, there are data controllers who determine the purpose for which data are being used in carrying out their important statutory mandate.
Here at the Bureau, however, we regulate the data processing activities of all data controllers both in the public and in the private sector. Since this is Data Age, the work of this Bureau is essential in ensuring the following: the rights of natural persons to data privacy; safe conduct for transactions involving the exchange of Personal Data; integrity of personal data, global competitiveness of businesses in Nigeria and the accountability of all persons and authorities in data processing activities.
Research has shown that data governance in Africa is confronting human capacity, financial and technical gaps. Is the story different in your institution? If yes, how did you achieve this? If no, is there any idea to both national and regional as to how to mitigate them?
As a new establishment, we have the opportunity to determine our roadmap and action plan at this formative stage. The roadmap is going through our quality assurance process, but we already have our eyes on the fundamentals which are rooted in the Nigeria Constitution, the National Digital Economy Policy & Strategy (NDEPS) as well as the Nigeria Data Protection Regulation (NDPR). Relative to these goals, we cannot say there is a significant gap. Meanwhile, we are lucky to benefit from the visionary support of the President who, in his wisdom, deemed it appropriate to approve of the creation of the Bureau in times like this. The pioneer Honourable Minister of Communications and Digital Economy, Prof. Isa Ali Ibrahim Pantami, has been tremendously supportive every step of the way. Also, we are lucky to have developed from the National Information Technology Development Agency (NITDA). NITDA has been highly supportive, and so is the National Identity Management Commission (NIMC). We have also received support from the Nigeria Communications Commission. Apart from the statutory bodies, we are also enjoying the support of the ID4D Team in Nigeria. The ID4D draws support from the World Bank, European Investment Bank and French Development Agency. Similarly, many private-sector organizations have also been supportive in the area of capacity building.
Privacy, being a human right issue, naturally attracts public-spirited organizations and individuals. Once you demonstrate a clear understanding of this concept and the willingness to give it institutional expression, you will get the support you need to get things done gradually. However, we are not ignorant of what lies ahead or the task before us. So, we are putting measures in place to ensure that that the work of the Bureau is not hampered by financial and technical gaps. We must also admit that the issue of finance is not quite peculiar to Africa. Data Protection Authorities all over the world do not have all that they need to promote data privacy and protection.
What are the national and global data protection challenges that the Bureau is trying to fix?
There are a number of data protection challenges, both at the national and global levels, which the Bureau is currently fixing. For us, the first challenge is data literacy. Data subjects must first know their rights before they can prevent low-level breaches. They must also enforce their rights at a higher level. Apart from that, we also have the challenge of data localization. There is no consensus on the issue of data localization. For us as a country, however, data localization is one of the most effective policies through which a country can guarantee its sovereignty and security. We are not oblivious of the implication of this policy for our existing infrastructure. So, we are determined to address this issue in line with the first pillar of the National Digital Economy Policy and Strategy, which is Developmental Regulation. Whatever we do, our objective is to ensure that, through regulation, we are able to stimulate the development of what we desire. We are making sure our economy and national security are not at risk, as we engage with the global marketplace in terms of cross-border data transfer.
What digital economy-related innovation is the agency trying to bring to fore?
As we have stated earlier, this is the Data Age. It means digital economy is the medium through which lives and livelihoods can thrive sustainably. This cannot happen without trust on the part of data subjects. We are bringing in innovations that will inspire data-subject trust for digital economy. Through the implementation of the Nigeria Data Protection Regulation (NDPR) for instance, we certified and licensed the Data Protection Compliance Organizations (DPCOs). The DPCOs are helping data controllers in compliance process. At the moment, we fine tuning our plans for the biggest data governance drive in Africa. World Development Report 2021 that is entitled‘Data for Better Lives’, published by World Bank, identified three core principles for any social contract for data. They are: Value, Trust and Equity. So, we are cognizant of these three core principles in coming up with our innovation for data governance.
What are really the challenges which militate against the thriving of the Nigeria Digital Market?
Indeed, if we critically interrogate what we may refer to as challenges, we will discover that they are opportunities for investment. For instance, if we talk of infrastructure, there is an opportunity for investment infrastructure. A free-market economy such as ours only has to worry about the time it takes to deepen the knowledge-based economy, as well as increase the knowledge on the part of the workforce and on the part of consumers. Once a critical mass is determined to expand the horizon of our knowledge, what we refer to as challenges will turn to opportunities in the mind of the knowledgeable.
How does the Bureau go about creating awareness as well as sensitizing the public on the need for digital adoption, inclusion, privacy rights and effective data governance framework in the country?
We are using various awareness strategies such organizing working visits to data controllers and ensuring our active presence on social media platforms. We are on Facebook, Twitter and Instagram. We also organize capacity building programmes. Just recently, we organized a data privacy and protection training for Nigeria Television Authority. More activities are coming which will involve schools and other public organizations.
How does the Bureau want to work with both regional and global institutions? What challenges does it anticipate in this respect?
The Bureau will be working to sustain and to deepen what has been achieved, in the last 3 years, through the implementation of the NDPR. You will recall that Nigeria participates in the Common Thread Network (a network of the data protection authorities of Commonwealth nations). Interestingly, the country is currently a full member of the Network of African Data Protection Authorities (NADPA). Nigeria currently holds the position of Vice-Chair, of the Africa Union’s Policy and Regulatory Initiative for Digital Africa (PRIDA). All these are platforms through which we can advance the cause of data privacy and protection, not only in Nigeria but also around the world. If your data is safe in your country you need to be sure that your trading partners also have an adequate level of data protection. Otherwise, the whole idea will suffer avoidable setbacks. The biggest challenge in this area is getting the commitment of everyone to, at least, take significant measures towards ensuring data protection.
What steps do you think African regional institutions can take to put the continent on the global digital economy?
Three steps are actually needed. The first step is for them to re-engineer regional digital economy framework just like the European Union (EU) did. Africa’s population is about 1.4 billion data subjects strong. This is a huge market for big data. Effective collaboration in terms of regulation can change the rule of the game globally. The second step is for them to invest in people. Digital economy is otherwise known as knowledge-based economy. In effect, we need to invest in human capital development. India, for instance, is a choice destination for data processing. Africa is even closer to the home of the big data processors and controllers than India is. A significant number of our youths literally trek, swim or paddle to Europe. With the requisite knowledge, they can work for the same companies and people they are risking their lives and dignity to get across to physically. The third step is for them to embrace the need to invest in infrastructure. The importance of these three areas cannot be gainsaid if we are to make a bold appearance on the global digital economy map.
Kindly discuss the pathway for Nigeria to develop model data governance framework in Africa.
Recall we earlier cited a World Development Report 2021 which harped on Value, Trust and Equity. To achieve this, we are putting measures in place to hold data controllers accountable on the principles of data processing. We are ensuring that data are processed lawfully and legitimately, and that data controllers are mindful of purpose limitation, data minimization, data security, data integrity, and storage limitation. Our approach to this is to have a developmental framework on data protection. A critical component of this framework is a Data Protection Act. We are working on the bill now. In order to make this a model, we are bringing stakeholders together through focus group discussion, policy dialogue and validation workshop. We are also strengthening our public private partnership compliance model. The DPCOs is being studied by data protection organization. Soon, we will unveil our data governance networking innovations. These are few in a continuum of measure we are taking in order to become a paragon of excellence in data governance in Africa.
- The Dialogue on Data and Development (DDD) Team of the Centre for the Study of Economies of Africa (CSEA) is led by Adedeji Adeniran (Ph.D.), and other members that include Sone Osakwe, Drusilla David, Kashema Bahago and Kunle Balogun.