NIN is your main identity and without NIN, you cannot do anything in Nigeria— Dr Vincent Olatunji, National Commissioner/CEO, NDPC

The Top 20 series continue and it is the turn of the national commissioner and chief executive officer of the National Data Protection Commission (NDPC), Dr Vincent Olatunji. He said without the National Identity Number (NIN) Nigerians would not be able to carry out transactions, and a few other issues. Excerpt.

The national commissioner and chief executive officer of the National Data Protection Commission, Dr Vincent Olatunji said 

 From the Nigeria Data Protection Bureau (NDPB) to the implementation of the Nigeria Data Protection Regulation (NIPR) issued by NITDA, and now here. What is the story?

Thank you very much. You are aware that the issue of protecting our privacy in the area of our data is a major issue globally. That is why countries, continents and organizations are implementing measures to ensure proper protection of it’s personal data, ensuring that data subjects are collected, processed, shared, stored and managed safely and securely within the available laws and jurisdiction. Since 1948, it has been one of the human rights that your data is your right to protect you. At the African Union (AU) convention, cybersecurity and personal data protection were a major foundation. In Nigeria, the law took effect in 2018 under the Nigeria Information Technology and Development Agency (NITDA) Act. The Act empowers NITDA to issue subsidiary legislation and is as powerful as the law itself. So, the Nigeria Data Protection Regulation came in 2019 through NITDA on January 25, 2019.

The five different regulations came on the same day. But the most effective is NDPR. What led to this was a committee set up to ensure proper implementation of the regulation. I chaired the committee. Within two and a half years, we made some tractions. That was because we adopted the PPP model. We recommended to the former minister of Communication and Digital Economy that when you have a working regulation, the next step is to create an independent supervisor or authority. This will ensure the proper implementation of such laws. So, the minister raised a memo to the former president who graciously approved the creation of the Nigeria Data Protection Bureau. This was to ensure proper implementation of the NDPR, to ensure that wherever Nigerians are their data is protected, and to ensure the global competitiveness of our businesses. The next task was to ensure the enactment of the principal legislation for data protection. To involve everybody, we passed it to the Federal Executive Council for input. That was on January 25, 2023. Eventually, the FEC approved it as a national policy for personal data protection.

On April 3, the National Assembly received it as an Executive Bill by the former president. On May 26, both houses passed the concurrent bill. This is an unprecedented step in Nigeria. The former president received the bill on May 26 and he could not sign it before he left. Many Nigerians were worried. We presented it to President Bola Ahmed Tinubu (GCFR). We explained to the president this is the bedrock of every economy globally, and he graciously assented to it on June 12, 2023. We have a data protection law for Nigeria and the law created the Nigerian Data Protection Commission (NDPC). It transitioned from the bureau to the commission. This has changed the perception of other Data Protection Authorities (DPAs) in terms of doing business with Nigeria.

What is the mandate of the Bureau?

Our mandate is to regulate the processes of the personal data of Nigerians. When you collect data from data subjects, how do you collect that data in the area of their consent? What is the lawful basis for the collection of these data? In terms of lawfulness, transparency, and fairness, in terms of “Are you collecting this data for their vital interest or public interest or even for contractual purpose or legitimate interest of the data subjects?” These are what we need to oversee to ensure that data controllers or data processors, that are collecting data of Nigerians, we need to ensure that they do so within this basis. In the area of principles of data collection, why are you collecting data, for what purpose, limitation, storage limitation, data security, and storage of the data? The law covers these. We need to oversee this too.
Then the part of data controllers and data processors. Data processors are those who collect data on behalf of data controllers. Data controllers are those who determine the way and manner your data is used. They need to establish measures to ensure your data is secured.

So, we oversee the kind of measures they put in place – technical and organisational measures, which include privacy policies of their staff, the calibre of staff in charge of data protection, what level of understanding they have, what capacity they have, what data governance structure do they have? These are the organizational measures.
In terms of technical measures, we are concerned about what type of software are they deploying, what type of security measures have they incorporated into this software and in terms of sharing data, what type of exclusion method they have. These measures must be in place. We are working toward eliminating unauthorised access to the data of Nigerians. When you have unauthorised access to somebody’s data, you may use it maliciously. You may commit a crime. We are like the police of personal data in Nigeria. Like the Nigerian police, when it comes to personal data crime, you look at the Nigerian Data Protection Commission. There are so many powers we have under the mandate. Power to launch an investigation against any company, power to fine and issue penalties, power to sue etc.

Are NDPB, NDPR and NDPC the same? What are their functions?

Our function includes creating awareness. Data subjects should know their rights. For instance, they have the right to know when somebody is collecting their data. They have the right to rectify their data. They have the right to portability and, the right to refuse profiling if it is automatic processing. The obligations of data controllers and processors to their data subjects. They owe us the duty of care. Accountability to ensure that our data with them is secure and safe and the way and manner of their process is in line with the law that we have in Nigeria now and that is the Nigerian Data Protection Act of 2023. 

Why do we have our data with FRSC, FIRS, NIMC, banks, and immigration among others? How are these data harmonised?

 The government is already addressing this area. I am aware that there is a committee in charge of data harmonisation in Nigeria. With what we have achieved with NIMC, the number of identities they had in their database was about 39 million. But when they were moved to the Ministry of Communications and Digital Economy within two and a half years, they crossed the 100 million bar. I think they are doing about 101 million now. That is almost 50% if we are about 200 million people. So, that is the main identity we have in Nigeria. The NIN is your main identity in Nigeria now and it has gotten to the level that without NIN you cannot do anything. But the good thing is that an average Nigerian of transactional age has an identity now. So, gradually we are getting to the level that all you need is your NIN.

How do you seek redress in case of data breach either as an individual or an organisation?

 Now for any data breach that occurs, the data controllers or data processors can discover it and, the onus is on them to inform the data subject and to inform the commission within 72 hours. If they do not do that, it is even a breach on its own. Even if they do not have all the issues surrounding the breach, mitigation should commence immediately.  Then they need to look at the impact, the number of data subjects affected, the impact on them, is it serious, mild, high risk,  low or medium. Then, the controller should inform the commission of what type of measures are in place to curtail a breach. Then the data subjects themselves can discover this by reporting to their data controller or data processor and the commission when they discover a breach has taken place. In addition, there are tools to detect breaches. That is what we are looking at in our broad map.

In terms of expertise, Nigeria does not have up to 5,000 certified data experts. Whereas data controllers and data processors are about 500,000. What the law says is that if you are a data controller of major importance you should have an elected DPO. So, we need about 500,000 and we only have 5000. We need to build capacity in the areas of expertise, cooperation, funding and sustainability because funding is a major issue for DPAs across the globe.