DATA SUBJECT RIGHTS IN NIGERIA
Introduction
A data subject is a person whose personal information is being collected, processed, or stored
by an organization or entity. This can include customers, employees, website users, or any
individual whose personal data is being handled by an organization.
Data Subject Rights (DSR) are the legal rights created by data protection laws that individuals
possess over their data usage. They guarantee individuals' control over the processing of their
data. These rights are found under Part VI of the Nigeria Data Protection Act.
([Link]
nigeria-data-protection-act-empowering-individuals-in-the-digital-age)
In Nigeria, the rights of data subjects, or individuals whose personal data is processed, are
protected under the Nigerian Data Protection Regulation (NDPR). Enacted in 2019 by the
National Information Technology Development Agency (NITDA), the NDPR seeks to safeguard
the privacy of citizens in a rapidly digitizing world. This regulation outlines specific rights that
data subjects have over their personal information, addressing how it can be collected,
processed, stored, and shared. However, the enforcement of these rights presents several
challenges, leaving many Nigerians unaware or unable to exercise their data protection rights
effectively.
Rights of Data Subject Under the NDPR
Part VI of the NDPA and Part 3 of the NDPR states the rights of data subjects.
Right To Be Informed
Data subjects have the right to know what data is being collected, why it is being collected, and
how it will be used. A data controller must provide information about the processing of a data
subject's personal data in a clear, transparent, concise, and easily understandable manner, using
plain language. The information can be provided in writing or electronically, where appropriate,
in accordance with Section 34(1) of the Nigerian Data Protection Act (NDPA) and Section 3.1(1)
of the Nigerian Data Protection Regulation (NDPR).
Right To Access
Data subjects have the right to access their personal data held by data
controllers(organizations). They also have the right to transfer this data to another data
controller without any obstruction from the original data controller. This is outlined in Section 34
of the Nigerian Data Protection Act (NDPA) and Section 3.1(14) of the Nigerian Data Protection
Regulation (NDPR).
Right To Object
Data subjects have the right to withdraw their consent to the processing of their personal data
at any time. Additionally, they can object to the processing of their personal data for marketing
purposes by the data controller. This right is provided under Section 36 of the Nigerian Data
Protection Act (NDPA) and Section 2.8 of the Nigerian Data Protection Regulation (NDPR).
Right To Rectification
A data subject has the right to be informed by the data controller about the rectification of their
personal [Link] errors are found, data subjects can demand rectification to ensure their
personal information is correct and up to date. Sections 34(1)(a)(v) and 34(1)(c) of the Nigerian
Data Protection Act (NDPA) and Section 3.1(13) of the Nigerian Data Protection Regulation
(NDPR).
Right To Erasure (The Right To Be Forgotten)
A data subject also has the right to request the erasure of their personal data. Under certain
conditions, individuals can request the deletion of their personal data. This right is particularly
relevant when the data is no longer necessary for the purposes for which it was collected or if
the data subject withdraws consent.
Sections 34(1)(d) and 34(2) of the NDPA and Section 3.1(13) of the NDPR.
Case
In Khelili v. Switzerland, the applicant successfully challenged the inaccurate recording of her
occupation as "prostitute."
In Peter Nowak v. Data Protection Commissioner, the right to rectification was addressed.
In Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González
(ECLI:EU:C:2014:317), the case focused on the right to erasure.
Problems Nigerians Face In Using This Rights
1. Digital Literacy
The level of digital literacy in Nigeria remains low, particularly in rural areas. This creates a gap
in understanding how personal data is collected and used, and individuals may not be aware of
how to exercise their rights under the NDPR.
Moreover, the public's awareness of data privacy rights remains low, which exacerbates these
systematic challenges. Many data subjects are unaware of their rights, and data collectors, both
in the private and public sectors, frequently fail to follow ethical guidelines regarding consent
and data sharing.
2. Judicial and Legislative Gaps
The judicial interpretation of data privacy rights also varies. Some courts have recognized data
privacy as a fundamental right under the Constitution, while others have treated it merely as a
regulatory concern. This lack of consistency makes it difficult for data subjects to seek legal
recourse, and there are few legal precedents on data protection issues.
3. Non-Compliance and Weak Enforcement
Although the NDPR has been in place since 2019, compliance has been slow. For example,
many organizations have yet to appoint data protection officers as required. In some cases,
government agencies themselves have violated the NDPR, such as when the Nigeria
Immigration Service shared personal passport information on social media without consent.
Despite such incidents, enforcement remains weak, with little to no penalties imposed.
4. Inadequacy of the NDPR and Other Legislations:
Despite the NDPR being a significant step towards data protection, it has notable shortcomings.
The regulation primarily focuses on protecting the data of natural persons, leaving institutions
and businesses vulnerable to data breaches without adequate recourse. Furthermore, it only
protects electronic data, failing to account for physical data like surveys or cheques. This
narrow scope has led to criticisms that the NDPR may soon become outdated unless its scope
is widened.
Ways To Improve Enforcement
1. Public Awareness Campaigns:
NITDA and other stakeholders should conduct extensive public awareness campaigns to
educate citizens about their data protection rights and how to exercise them. This can be done
through social media, traditional media, and community outreach programs.
2. Principal Legislation on Data Protection:
Nigeria is one of the few African countries without a principal data protection law, relying
instead on the Nigerian Data Protection Regulation (NDPR), a subsidiary legislation. The need
for a comprehensive Data Protection Act is critical to provide a solid legal framework with
stronger enforcement mechanisms.
3. Administrative Redress Mechanism: The absence of a constituted Administrative Redress
Panel (ARP) leaves data subjects without an accessible internal mechanism to address
breaches of their rights. Establishing this body would provide an alternative to costly and time-
consuming court processes.
4. Academic Intervention: The academic gap in data protection knowledge has hindered the
growth of this field in Nigeria. Introducing data protection as a dedicated course in universities
and increasing research in this area will be vital to developing expertise and awareness, which
will foster the country’s capacity to handle data protection issues.
Conclusion
While the Nigerian Data Protection Regulation (NDPR) represents an important step towards
safeguarding data subject rights, challenges in digital literacy, weak enforcement, and legislative
gaps continue to undermine its effectiveness. To address these issues, Nigeria must prioritize
the implementation of public awareness campaigns, establish a principal Data Protection Act,
and create an administrative redress mechanism for accessible dispute resolution. Additionally,
enhancing academic research and education in data protection will strengthen the country's
capacity to protect data subjects' rights and ensure that personal information is handled
responsibly in an increasingly digital society.