Tuesday, April 16, 2019

Reflections on Nigeria Data Protection Regulation 2019 by Pantami - ITREALMS

When I left the comfort and security of an academic environment to become a public servant in a sector that the President is so passionate about, I was never under the illusion that it would be smooth sail. 

Indeed, Nigeria’s success in Information Technology development and regulation holds the key to her sustainable development, it can be no other way. This is because the nation is blessed with a young and vibrant population of digital natives. So, on my appointment, I went into deep and intensive study of National Information Technology Development Agency (NITDA)’s mandate, stakeholders and vision. 

My study made me realise that to assume we could execute all the mandate, is absolutely impossible in one lifetime. This made the crafting of an actionable plan a priority on my assumption of office, these plan, we believe, is germane for our national development. We agreed to focus on: IT Regulation; Local Content Development; Digital Jobs Creation; Digital Inclusion; Cybersecurity; Government Digital Services Promotion and Development and Capacity building.

Initial steps on IT regulation was met with resistance by internal and external stakeholders. People assumed regulation always meant obstruction and restriction on innovation. It took a while for people to realise our regulatory paradigm was developmental regulation. I would share a story to illustrate this concept. Our Local Content in ICT Guidelines was issued in 2013 with the aim of growing local content in ICT products and services provision. A multinational which had sold software in the country for over 20 years and made millions of dollars in licensing fees, suddenly had an issue with its local support partner and therefore appointed a foreign support partner for its Nigerian clients. NITDA moved in, investigated and ensured other Nigerian companies were evaluated and one was eventually picked to continue the service. This move made the Nigerian clients happy and retained over 200 jobs for Nigeria. This was regulatory enforcement leading to more jobs and keeping more Nigerians happy.

I am happy to report that our modest efforts at NITDA have started yielding bounteous dividends for the nation. Through the active support of Nigerians, NITDA has catalyzed the purchase of indigenous brand of ICT devices, there has been a sales increase by over 400%. While local hosting of data has doubled in value and local software consumption has significantly improved. The cumulative effect of these, is that ICT contribution to GDP in nominal terms reached an unprecedented mark of 13.63% in Q4 of 2018. This, for us is a tip of the iceberg considering the initiatives which are still in the works. One such initiative I am so proud of, is the Nigeria Data Protection Regulation 2019.

The coming into force of the European Union General Data Protection Regulation (EU GDPR) in May 2018 threw the global community into a frenzy of sorts. The GDPR mandates controllers of European citizens data to comply with certain detailed rules and principles or risk incurring a fine of up to 4% of the defaulter’s global turn-over. This situation made many small and medium scale service providers to lose their share of the European market. More importantly, the rate of wanton abuse of the privacy of Nigerian citizens data needed an urgent national response. I therefore constituted a team of young professionals in the Agency, I challenged them to proffer a solution to this problem. This team worked hard and eventually came up with a unique Regulation that has become the cynosure of discerning minds.

Here is a quick glance at the core principles of the NDPR.

a) Lawfulness and Legitimacy: Article 2.1(1a) provides that Personal Data shall be collected and processed in accordance with specific, legitimate and lawful purpose consented to by the Data Subject.

b) Specific Purpose: In addition to Article 2.1(1a) cited above, Article 3.1(7c) mandates the Data Controller to expressly inform the Data Subject of the purpose(s) of the processing for which the Personal Data are intended as well as the legal basis for the processing. This has hitherto been observed in the breach. This, we believe would change as government is poised to stem the tide of brazen breach of people’s right to privacy.

c) Data Minimization: Data Controllers are expected to collect the minimum required data and avoid unnecessary surplusage. Data that is not useful for the Controller ought not to be collected. No data shall be obtained except the specific purpose of collection is made known to the Data Subject. This principle relates also to the principle on purpose of collection. By insisting that the purpose for collecting or further processing of a data set must be communicated to the Data Subject, the regulation has closed the door to a multitude of potential abuses.

d) Accuracy: The NDPR provides that collected and processed Personal Data shall be adequate, accurate and without prejudice to the dignity of human person (Art. 2.1(b)). The NDPR prohibits the abuse or inaccurate representation of personally identifiable data, even if such data where given with due consent. Data Controllers and processors are required to ensure regular update of personal data in their custody to achieve this.

e) Storage and Security: Data Controllers are required to store data only for the period they are reasonably required to so do. The Regulation does not explicitly provide for a time period because that detail, we believe should be left to contract agreement. However, where such is not specified, the dispute redress mechanisms can specify what would constitute sufficient storage period. The Regulation also places the onus of security on the Data Controller and Processor. Art. 2.1(d) provides- personal data shall be secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulations of any kind, damage by rain, fire or exposure to other natural elements.

f) Confidentiality, Integrity and Availability: Article 3 generally enumerates the rights of the data subject. One of the underpinning principles of the NDPR is that data control must comply with basic minimum standards of information security management. The Regulation specifies the role of the Controller and the Data subject in such case.

g) Compliance and Enforcement: One of the novelties of the NDPR is its compliance structure. The Regulation creates a nouveau class of professionals- Data Protection Compliance Organisations (DPCO). A DPCO is any entity duly licensed by NITDA for the purpose of training, auditing, consulting and rendering services and products for the purpose of compliance with this Regulation or any foreign Data Protection Law or Regulation having effect in Nigeria (See Article 1.3 (xiii)). These professional firms would provide requisite training, services and other support to Data Controllers to aid their compliance with the NDPR. I hope to come back to the immense potentials of this arrangement shortly.

On enforcement the NDPR classified Controllers into large and small categories. Those who process data of more than 10,000 data subjects are liable to forfeit 2% of their Annual Gross Revenue (AGR) while those handling less than 10,000, would lose up to 1% of their AGR. The NDPR would both bark and it would bite errant data controllers.

One of my greatest sources of joy on the Regulation is the job creation potential. Over 1.5 million businesses and non-governmental organizations would need to file Data Audit Report on or before 15th March of every year. Each of these reports must bear a Verification Statement, sign and seal of a Licensed DPCO. If each DPCO provides service for an average of 50 Data Controllers, we would need over 300,000 professionals to meet this need. Imagine the jobs our young people can generate and sustain through this service alone. Because this is not public procurement, we have made the entry barrier high enough to admit only serious-minded people and low enough to allow Start-ups to engage without undue intimidation.

This, for us is the beginning of a new era and we crave the support of all Nigerians to support and sustain this effort. We also look forward to receiving constructive comments, opinions and technical observation to ensure that this Regulation is optimally implemented for the betterment of our dear nation and people.

*Contributed by Dr Isa Ali Ibrahim (Pantami), Director General/CEO National Information Technology Development Agency (NITDA).
*JOIN our alert's group | Share stories with us | Advert placement: WhatsApp | SMS: +2348033592762 *Twitter: @ITREALMS *Email: itrealms.dsa@gmail.com*

18 comments:

markson said...

Excellent Information Systems Ltd. is an ISO 9001:2008 guaranteed supplier of Mac, Linux, Novell and Windows information recuperation administrations, has denoted its place in this particular field.ExcelR Data Science Courses

Data Science Institute In Banglore said...

I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
Data Science Institute in Bangalore

CloudLearn ERP said...

Great writing! You have a flair for informational writing. Your content has impressed me beyond words. I have a lot of admiration for your writing. Thank you for all your valuable input on this topic. Best Data Science training in Mumbai

Data Science training in Mumbai

data science said...

I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon #Artificial Intelligence course in Malaysia | #Artificial Intelligence training in Malaysia | #Ai course | #Ai Training

Gaurav said...

It is perfect time to make some plans for the future and it is time to be happy. I've read this post and if I could I desire to suggest you some interesting things or suggestions. Perhaps you could write next articles referring to this article. I want to read more things about it!
360DigiTMG data science training in indore

Data Science pune said...

Such a very useful article. Very interesting to read this article. I would like to thank you for the efforts you had made for writing this awesome article.
Data Science Course in Pune
Data Science Training in Pune

Data Science Institute In Banglore said...

I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
Data Science Certification in Bangalore

DataScience Datascience said...

Gangaur Realtech is a professionally managed organisation specializing in real estate services where integrated services are provided by professionals to its clients seeking increased value by owning, occupying or investing in real estate.
Data Science Course in Bangalore

DataScience Datascience said...

I am impressed by the information that you have on this blog. It shows how well you understand this subject.
Data Science Training in Bangalore

Data Analytics Pune said...

I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
Data Analytics Course in Pune
Data Analytics Training in Pune

Business Analytics Course said...

I am impressed by the information that you have on this blog. It shows how well you understand this subject.
Business Analytics Course in Pune
Business Analytics Training in Pune

360DigiTMG Aurangabad said...

360DigiTMG is one of the best places to learn data science training in aurangabad. I have joined this course for a limited period of time but i think its worth it .And specially the way topic s are explained from the basics to the ultimate level its eventually became easy for everyone . Thank you so much for sharing us the knowledge and experience.

Anirban Ghosh said...

Your article is very informative. It's a welcome change from other supposed informational content. Your points are unique and original in my opinion. I agree with many of your points.
SAP training in Kolkata
SAP training Kolkata
Best SAP training in Kolkata
SAP course in Kolkata
SAP training institute Kolkata

Data Science training - 360DigiTMG said...

Outstanding blog appreciating your endless efforts in coming up with an extraordinary content. Which perhaps motivates the readers to feel excited in grasping the subject easily. This obviously makes every readers to thank the blogger and hope the similar creative content in future too.

360DigiTMG Data Analytics Course

abid said...

I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well. In fact your creative writing abilities has inspired me to start my own Blog Engine blog now. Really the blogging is spreading its wings rapidly. Your write up is a fine example of it.
360digitmg

Machine Learning Course in Raipur - 360DigiTMG said...

Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such an amazing content for all the curious readers who are very keen of being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in future too.

360DigiTMG Tableau Course

Business Analytics Course said...

Superbly written article, if all bloggers offered the same content as you, the internet would be a much better place ...

Business Analytics Course in Bangalore

Data Analytics Course said...

Wonderful illustrated information. Thank you. It will certainly be very useful for my future projects. I would love to see more articles on the same topic!

Data Analytics Course in Bangalore