In this episode of Telecoms Clinic@ITREALMS by REMMY NWEKE, he unpacks citizens’ right to know who accesses their identity data, linking Nigeria’s FOI Act with data protection and digital accountability.
Preamble:
Across Nigeria’s digital ecosystem, the intersection of identity management, telecommunications, and data governance has become both a foundation for national security and a field of contention for citizens’ rights.
Across Nigeria’s digital ecosystem, the intersection of identity management, telecommunications, and data governance has become both a foundation for national security and a field of contention for citizens’ rights.
From the compulsory SIM registration and integration of National Identity Numbers (NIN) with telecom accounts, to the rising conversation around the Freedom of Information (FOI) Act and data protection laws, a new question emerges at the heart of Nigeria’s digital society: who truly controls our data, and who has the right to access it? 
For many Nigerians, the experience of data collection begins with necessity; linking SIM cards to NINs, obtaining Bank Verification Numbers (BVNs), registering for voters’ cards, or enrolling in social welfare programmes. Yet, beyond these transactional interactions lies a broader narrative about trust, accountability, and the balance between state surveillance and citizens’ privacy.
The linkage between the FOI Act and the Nigeria Data Protection Regulation (NDPR), now reinforced by the Nigeria Data Protection Act (NDPA 2023), brings this debate to the forefront, urging both government and citizens to rethink what transparency means in a digital age.
SIM registration and NIN integration:
SIM registration in Nigeria dates back to 2011, when the Nigerian Communications Commission (NCC) mandated telecom operators to capture the biometrics and personal details of mobile subscribers.
While the policy aimed to strengthen digital identity and reduce fraud, its implementation raised deep concerns about data protection and access rights. Millions of Nigerians were compelled to submit their biometric information to multiple agencies, often without clear communication on how the data would be stored, shared, or protected.
Building culture of data accountability:
To address these gaps, Nigeria must cultivate a culture of data accountability rooted in openness and respect for individual rights. This requires coordinated efforts on three fronts — policy enforcement, institutional transparency, and citizen empowerment.
First, regulators like the NCC, NIMC, and NDPC must harmonize their data governance policies, ensuring consistent standards across sectors.
Short URLs:
goo.gl,
mcaf.ee,
cli.gs
The linkage between the FOI Act and the Nigeria Data Protection Regulation (NDPR), now reinforced by the Nigeria Data Protection Act (NDPA 2023), brings this debate to the forefront, urging both government and citizens to rethink what transparency means in a digital age.
SIM registration and NIN integration:
SIM registration in Nigeria dates back to 2011, when the Nigerian Communications Commission (NCC) mandated telecom operators to capture the biometrics and personal details of mobile subscribers.
The stated goal was to curb criminal use of mobile phones, improve national security, and create a verifiable database of users. Over a decade later, this policy evolved into the harmonization of SIM registration with the National Identity Number (NIN), overseen by the National Identity Management Commission (NIMC).
While the policy aimed to strengthen digital identity and reduce fraud, its implementation raised deep concerns about data protection and access rights. Millions of Nigerians were compelled to submit their biometric information to multiple agencies, often without clear communication on how the data would be stored, shared, or protected.
In some cases, data duplication occurred, with the same personal details spread across disparate systems — from telecom databases to banks and electoral commissions. This fragmentation not only created inefficiencies but also exposed personal information to potential misuse.
The question thus arises: once citizens’ data enters the system, who ensures its proper use? And when breaches occur, where can citizens turn for redress?
FOI Act: The citizens’ tool for data accountability:
The Freedom of Information Act, signed into law in 2011, was designed to promote transparency and accountability in governance. It grants Nigerians the right to request information from public institutions, compelling them to disclose details about their operations, decisions, and use of public resources.
The question thus arises: once citizens’ data enters the system, who ensures its proper use? And when breaches occur, where can citizens turn for redress?
FOI Act: The citizens’ tool for data accountability:
The Freedom of Information Act, signed into law in 2011, was designed to promote transparency and accountability in governance. It grants Nigerians the right to request information from public institutions, compelling them to disclose details about their operations, decisions, and use of public resources.
In the digital context, the FOI Act becomes a critical tool for demanding clarity on how identity data, including that collected through NIN and SIM registration, is processed and accessed.
Through the FOI Act, citizens, journalists, and civil society organizations can ask vital questions: Which government departments have access to the NIN database? How often is identity data shared with law enforcement or private contractors? What safeguards are in place to prevent unauthorized access or commercial exploitation of citizens’ personal details?
Through the FOI Act, citizens, journalists, and civil society organizations can ask vital questions: Which government departments have access to the NIN database? How often is identity data shared with law enforcement or private contractors? What safeguards are in place to prevent unauthorized access or commercial exploitation of citizens’ personal details?
These questions are not theoretical. They go to the core of democratic accountability in an age when data is both an asset and a weapon.
However, while the FOI Act provides the legal framework for such inquiries, its enforcement remains inconsistent. Many agencies either ignore requests or hide behind vague claims of “national security” to avoid disclosure. The result is a culture of opacity, where citizens’ personal information is collected en masse but transparency about its use remains elusive.
This regulation was further strengthened by the passage of the Nigeria Data Protection Act (NDPA) 2023, which established the Nigeria Data Protection Commission (NDPC) as the official body overseeing compliance. The NDPA aligns Nigeria with global privacy standards, echoing the principles of the European Union’s GDPR and emphasizing citizens’ rights to know, access, correct, and erase their personal data.
Crucially, the NDPA also imposes penalties on entities that fail to protect personal information, creating a deterrent against reckless data practices. It defines data processing boundaries, mandates impact assessments for sensitive data operations, and encourages data controllers to adopt privacy-by-design frameworks.
Yet, as the NDPA advances, one essential link remains underutilized, the FOI Act. While the NDPA empowers citizens with personal data rights, the FOI Act empowers them to seek systemic accountability. Together, they form a powerful duo: one ensuring personal control over data, the other enforcing institutional transparency.
How FOI and data protection intersect:
The real power of Nigeria’s data rights framework lies in integrating FOI requests with NDPA enforcement. For example, a citizen whose data has been compromised can file an FOI request to determine which agency shared or mishandled it.
However, while the FOI Act provides the legal framework for such inquiries, its enforcement remains inconsistent. Many agencies either ignore requests or hide behind vague claims of “national security” to avoid disclosure. The result is a culture of opacity, where citizens’ personal information is collected en masse but transparency about its use remains elusive.
ALSO READ:
Review of FOI compliance in telecom regulation (2015–2025) by Remmy Nweke - Telecoms Clinic@ITREALMS
NDPR and NDPA: Framework for digital privacy:
The introduction of the Nigeria Data Protection Regulation (NDPR) in 2019 marked a turning point in the country’s data governance landscape. For the first time, Nigeria established a formal regulatory instrument that recognized personal data as a protected right, placing obligations on data controllers and processors to handle information responsibly. The NDPR required organizations, both public and private, to obtain consent before collecting data, ensure secure storage, and notify individuals in case of breaches. This regulation was further strengthened by the passage of the Nigeria Data Protection Act (NDPA) 2023, which established the Nigeria Data Protection Commission (NDPC) as the official body overseeing compliance. The NDPA aligns Nigeria with global privacy standards, echoing the principles of the European Union’s GDPR and emphasizing citizens’ rights to know, access, correct, and erase their personal data.
Crucially, the NDPA also imposes penalties on entities that fail to protect personal information, creating a deterrent against reckless data practices. It defines data processing boundaries, mandates impact assessments for sensitive data operations, and encourages data controllers to adopt privacy-by-design frameworks.
Yet, as the NDPA advances, one essential link remains underutilized, the FOI Act. While the NDPA empowers citizens with personal data rights, the FOI Act empowers them to seek systemic accountability. Together, they form a powerful duo: one ensuring personal control over data, the other enforcing institutional transparency.
How FOI and data protection intersect:
The real power of Nigeria’s data rights framework lies in integrating FOI requests with NDPA enforcement. For example, a citizen whose data has been compromised can file an FOI request to determine which agency shared or mishandled it.
Journalists, for instance, can use FOI to uncover whether telecom companies have handed over subscriber data to third parties without legal authorization. Civil society can leverage FOI to monitor whether the NIMC complies with NDPA provisions when collaborating with private vendors.
Such synergy transforms the FOI Act from a general transparency tool into a practical instrument of data justice. It ensures that privacy is not merely a personal right but a public obligation; binding on every institution that collects or processes citizens’ information.
However, this integration demands awareness and institutional readiness. Public bodies must recognize that data protection is not a privilege but a constitutional extension of the right to dignity and information.
Such synergy transforms the FOI Act from a general transparency tool into a practical instrument of data justice. It ensures that privacy is not merely a personal right but a public obligation; binding on every institution that collects or processes citizens’ information.
However, this integration demands awareness and institutional readiness. Public bodies must recognize that data protection is not a privilege but a constitutional extension of the right to dignity and information.
Equally, citizens must learn to exercise their FOI and NDPA rights confidently, knowing that access to information is the foundation of accountability.
Data access and right to know:
A common misconception is that privacy and transparency exist in opposition. In reality, they are complementary forces. Privacy ensures control over personal data, while transparency ensures that those who hold data are accountable. Citizens’ right to know who accesses their identity data and why is central to building a trustworthy digital ecosystem.
For instance, when law enforcement agencies request subscriber information from telecom operators, citizens deserve to know under what legal authority such requests are made.
Data access and right to know:
A common misconception is that privacy and transparency exist in opposition. In reality, they are complementary forces. Privacy ensures control over personal data, while transparency ensures that those who hold data are accountable. Citizens’ right to know who accesses their identity data and why is central to building a trustworthy digital ecosystem.
For instance, when law enforcement agencies request subscriber information from telecom operators, citizens deserve to know under what legal authority such requests are made.
When identity databases are shared across ministries, there should be publicly available data-sharing agreements outlining purpose, duration, and safeguards. Hence, FOI Act provides the legal pathway to obtain such documentation.
Moreover, transparency fosters public trust; When citizens see that data is used responsibly, for improving service delivery, national planning, or security, they are more likely to cooperate. Conversely, when secrecy surrounds data use, suspicion grows, and compliance falters.
Challenges to transparency and privacy enforcement:
Despite the existence of these frameworks, several obstacles hinder effective implementation. Bureaucratic resistance remains high, as many agencies view FOI requests as intrusive rather than as instruments of accountability.
Moreover, transparency fosters public trust; When citizens see that data is used responsibly, for improving service delivery, national planning, or security, they are more likely to cooperate. Conversely, when secrecy surrounds data use, suspicion grows, and compliance falters.
Challenges to transparency and privacy enforcement:
Despite the existence of these frameworks, several obstacles hinder effective implementation. Bureaucratic resistance remains high, as many agencies view FOI requests as intrusive rather than as instruments of accountability.
In some cases, poor record-keeping makes it difficult for agencies to provide timely or complete responses. Additionally, low public awareness of both FOI and NDPA rights limits citizen participation.
There is also the technological challenge of data security. With increasing reports of cyberattacks on government portals and identity databases, the risk of unauthorized data exposure is significant.
There is also the technological challenge of data security. With increasing reports of cyberattacks on government portals and identity databases, the risk of unauthorized data exposure is significant.
Without adequate encryption, access control, and audit mechanisms, sensitive information, including biometric identifiers, could fall into the wrong hands.
Another concern is the blurred boundary between public and private data handlers. Telecom operators, fintech firms, and identity verification services now hold vast amounts of personal data, often operating in hybrid arrangements with government agencies.
Another concern is the blurred boundary between public and private data handlers. Telecom operators, fintech firms, and identity verification services now hold vast amounts of personal data, often operating in hybrid arrangements with government agencies.
Ensuring that all parties adhere to the same data protection standards is crucial for system integrity.
ALSO READ:
PTDF joins FOI Hall of Shame - ITREALMS
To address these gaps, Nigeria must cultivate a culture of data accountability rooted in openness and respect for individual rights. This requires coordinated efforts on three fronts — policy enforcement, institutional transparency, and citizen empowerment.
First, regulators like the NCC, NIMC, and NDPC must harmonize their data governance policies, ensuring consistent standards across sectors.
Second, public institutions must proactively disclose their data-sharing practices and privacy impact assessments, reducing the need for reactive FOI requests.
Third, citizens and the media must continue to use FOI and NDPA mechanisms to demand explanations, challenge unlawful data practices, and push for stronger safeguards.
Civil society organizations, particularly those focused on digital rights and freedom of expression, play a vital role in this ecosystem. By providing legal assistance, conducting public education campaigns, and publishing investigative reports, they can hold both government and corporations accountable.
Civil society organizations, particularly those focused on digital rights and freedom of expression, play a vital role in this ecosystem. By providing legal assistance, conducting public education campaigns, and publishing investigative reports, they can hold both government and corporations accountable.
Looking ahead:
As Nigeria’s digital economy expands, personal data will only grow in value, as an economic resource, a political instrument, and a tool of social control.
As Nigeria’s digital economy expands, personal data will only grow in value, as an economic resource, a political instrument, and a tool of social control.
Balancing these interests requires more than laws; it requires an informed and vigilant citizenry. The FOI Act and the NDPA offer the legal scaffolding, but enforcement depends on participation.
The next frontier lies in integrating data transparency into national development frameworks, from smart city projects and digital ID systems to cybersecurity strategies. As more services move online, data protection must be embedded not as an afterthought but as a core design principle.
The next frontier lies in integrating data transparency into national development frameworks, from smart city projects and digital ID systems to cybersecurity strategies. As more services move online, data protection must be embedded not as an afterthought but as a core design principle.
And as citizens, we must continually ask: Who collects my data? Why do they need it? How is it stored? Who else can access it? The answers to these questions define the strength of our democracy in the digital age.
The right to know who accesses one’s identity data, eventually, is not just a matter of privacy; it is a matter of power.
When citizens understand and exercise their data rights, they reclaim agency over their digital selves, thus ensuring that technology serves humanity, not the other way around.
The right to know who accesses one’s identity data, eventually, is not just a matter of privacy; it is a matter of power.
When citizens understand and exercise their data rights, they reclaim agency over their digital selves, thus ensuring that technology serves humanity, not the other way around.
No comments:
Post a Comment