Alright, the online privacy conversation has gone on long enough and it seems one or two things are moving forward in this respect. Techpoint reported in March that our very own IT ‘oracle’ the Nigerian Information Technology Development Agency (NITDA) has put forward its framework for data protection and accountability measures for the handling of data. This framework is called the Nigerian Data Protection Regulation 2019 (NDPR) which practically states how data-handlers (companies, businesses, organizations .et al) will take responsible action with publicly acquired data – think filling off/online forms, answering surveys, internal messaging systems etc. Within the NDPR, there will be details on how the regular internet user can take control of their data i.e. through direct requests to data-handlers on what data is being held and how this data is used. There will also be clauses defining what a data-handler can/cannot do with data acquired as well as penalties connected to breaching the ‘trust’.
Taking the rose-colored lens off, the NDPR carries too much of a similarity with the European General Data Protection Regulation 2016 (GDPR) first of all in name, so one wonders whether the congrats are in order for switching out the acronym’s first letter or keeping the last three exact. Second, it is highly unlikely that any real adjustments have been made with full consideration of the new environment this NDPR is meant to serve, this tentative assertion stands because the fine and penalty structures are essentially the same as the GDPR when a data-handler is found in breach of the data-protection clauses. Grounds for data-use consent and authorization granted to the public are the same as well, even the terminology (data-controller, data-subject) seem to stem from the GDPR. Considering the socio-cultural differences or lack there off between the jurisdictions of these two frameworks, a ‘copy-paste’ one-size-fits-all approach hardly seems like the holistic way of approaching an issue as volatile as digital privacy. This is an ongoing development in what seems like a step in the right direction, meaning a close eye is to be kept on where every foot is placed. For one, data-handlers -existing or new- are expected to sensitize users in record time on their data protection policies.
The framework gives organizations (both public and private) in the country, that control personal data, three months after the release of the NDPR to publicize their respective data protection policies which shall be in compliance with the regulation. – Techpoint
Anyone keeping up with this can expect to be flooded with legal assurances from tech-based businesses saying “we are in compliance with NDPR directives”, “we are adjusting processes to comply with the NDPR” and every variation of such. Making one wonder whether this just covers ‘them’ while living ‘us’ safely swaddled in the blanket of vagueness that is the *DPR. This is when we will see the presence or absence of enforcement…so, a coin toss?