Data privacy rights are rights that relates to the privacy of your personal data such as your name, date of birth, phone number, email address, etc. The right to data privacy is an important one and it is constitutionally guaranteed in Nigeria. Thus, obligation is imposed on anyone in lawful possession of your data to safeguard, protect and ensure that your data is only processed lawfully.
The essence of this article is to provide information on how you can enforce your rights to data privacy when the rights are being breached, about to be breached or after they have been breached.
Data Privacy and Protection in Nigeria
The Nigerian Data Protection Regulation 2019 (NDPR) regulates the processing of data in Nigeria. The NDPR seeks to protect data subjects and ensure that their data is only processed lawfully. Lawful processing of personal data entails that the data subject has given his consent freely to the processing of his data. The data of a data subject may also be processed lawful under some circumstances such as when it is needed to enforce a contract or to ensure compliance with legal obligation.[i] Thus, a data processed without a lawful basis is an unlawful processing of data which the NDPR does not allow.
Some of the data safety and protection measures that a data controller must fulfil include that the data of data subjects should be adequately secured, it should not be stored longer that it is needed, the data subject can request the deletion of his data, a further processing of data requires new consent, etc.
In a simple term, data controllers are persons in possession of your data such as your name, date of birth, email address, phone number, etc. and they include your bank, employer, school and other companies or institutions in possession of your personal data. Data subject on the other hand, is any person whose data is in the control of a data controller.
Enforcement of Data Privacy Rights in Nigeria
Data privacy rights can be enforced in Nigeria when they are being breached, about to be breached or after they have been breached. The right to data privacy is a constitutionally guaranteed right in section 37 of the 1999 Constitution of the Federal Republic of Nigeria. The right to privacy is a fundamental right in Nigeria by virtue of section 37 of the 1999 Constitution of the Federal Republic of Nigeria.
Enforcement of the right to data privacy as a fundamental right in Nigeria involves taking application to a High Court for the enforcement of fundamental right to privacy.[ii] The application would be prepared, filed and argued at the High Court by your data privacy lawyer. Upon the success of the application for the enforcement of your fundamental right to data privacy, the court may make an order that:
- The breach or violation of your right to data privacy should be remedied.
- The breach or violation of your right to data should be discontinued
- You should be paid monetary compensation for the breach of your data privacy rights.
Thus, the 1999 Constitution and the NDPR guarantee your data protection by making provisions for the enforcement and the security and safety measures to be adopted in the protection of the data of all data subjects in Nigeria.
Recent Occurrences on Data Privacy in Nigeria
In recent times, the data privacy of Nigerian citizens had been violated by many institutions such as banks and micro-moneylenders who have access to some of their private information such as name, date of birth, phone numbers, email address, phone contacts, etc. One of such occurrences is the unilateral opening of a second domiciliary account for a bank customer by United Bank for Africa Plc (UBA) without the knowledge, request, consent or authorisation of the bank customer. Upon the success of the bank customer’s application for the enforcement of his fundamental right to data privacy, the court ordered UBA to close down the second domiciliary account and to pay the customer the sum of Two Million Naira for violating his right to data privacy.[iii]
In another occurrence, the court held that the sending of unsolicited emails is a breach of right to privacy. The emails were sent to the email address of a data subject whose email address was used by another person for the opening of a bank account and upon taking steps to ensure the said email address is removed from the bank account the email address, the bank as a data controller failed to remove the email address and continued sending the unsolicited emails.
The courts have held that the “privacy of citizens” covers a wide range of issues and it is expected that the court will continue to pronounce on them as they arise.
Conclusion
The right to data privacy is a constitutionally guaranteed right in Nigeria. The right to data privacy is enforceable in court as a fundamental right in Nigeria. Data subjects should seek the enforcement of their right to data privacy when the right is breached or violated. Data controllers are expected to only process the data of data subjects lawfully, with the data subject’s consent and within the ambit of the law as any data breach, violation or infraction may open them up to data privacy enforcement actions.
This article is written by the Data Protection and Dispute Resolution Teams of Mandel Solicitors to provide general legal guidance and not to replace specialist legal advice.
[i] Article 2.2 of the Nigerian Data Protection Regulation (NDPR) 2019
[ii] Section 46 of the 1999 Constitution of the Federal Republic of Nigeria
[iii] Chiebuka Nworah v. United Bank for Africa Plc