- NIMC, USPF, NITDA to fund project
As part of efforts to deepen data protection in Nigeria, the Federal Government is planning to establish a data protection commission. To that effect, an executive bill has been drafted to be sent to the National Assembly for passage into law.
The commission, when established, is to take over the role currently being played by the National Information Technology Development Agency (NITDA). Recall that NITDA had, last year, introduced Nigeria Data Protection Regulation (NDPR) to safeguard Nigerians’ data in the absence of substantive law.
According to the draft bill, which was posted on the website of the Nigerian Communications Commission (NCC), the primary objective of setting up the commission is to establish and provide an efficient regulatory framework for the protection of personal data, regulate the processing of information relating to data subjects and to safeguard their fundamental rights and freedoms as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999.
On the functions of the commission, which is to be headed by a ‘commissioner’ the bill states: “The commission shall protect the personal data and privacy of data subjects by regulating the processing of personal information; provide the process to obtain, store, process, use or disclose personal information; ensure that data controllers and data processors adhere to the data protection principles as provided for by this Act in order to protect the fundamental rights and freedoms, particularly privacy of natural persons in relation to the processing of their personal data; assist the facilitation of the free flow of personal data through consultation and cooperation with other relevant agencies in compliance with established data security best practices; and act as the supervisory authority, and exercise regulatory powers.”
On offences to be penalised by the commission, the bill states: “A person who knowingly or recklessly — (a) obtains, or discloses personal data to a third party, without the consent of the data controller, (b) after obtaining personal data, retains it without the consent of the data controller commits an offence and is liable on conviction to a fine of not less than N5,000,000.00 (five million naira) or imprisonment for a term not less than one year or both.”
It, however, added that “it is a defense for a person charged with an offence under subsection (1) of this section to prove that the act — (a) was carried out for a legitimate purpose and for the purpose of this section (b) was required or authorised by an enactment, law or by an order of a Court or Tribunal; or (c) was justified as being in the public interest or national security.”
Sub-section 3 of the bill states that “a person who sells personal data, obtained under circumstances described under subsection (1) of this Section, commits an offence and is liable on conviction to a fine of not less than N1,000,000.00 (one million naira) per record or to imprisonment for a term not less than five years concurrently or both.” Sub-section 4 provides that “a person who advertises personal data in a manner that indicates that it was obtained in circumstances described under subsection (1) of this section, commits an offence and is liable on conviction to a fine of not less than N500,000.00 per record or to imprisonment for a term of not less than five years concurrently or both.”
Meanwhile, to fund the operations of the commission, the bill provides that “the commission shall establish and maintain a Fund from which all expenditure incurred by the commission shall be defrayed.”
It adds that the fund shall consist of (a) five per cent deductions from revenue generated from National Identification Number (NIN) and person identity verification services hosted by the National Identity Management Commission (NIMC); revenue generated from the issuance of Drivers’ License services hosted by the Federal Road Safety Commission (FRSC); revenue generated from the issuance of International Passport services hosted by the Nigeria Immigration Service (NIS); revenue generated from the levy of one per cent (one per cent) of the profit before tax of companies and enterprises covered by the National Information Technology Development Agency (NITDA) Act accruable to the National Information Technology Development Fund; Universal Service Provision Fund of the Nigeria Communications Commission (NCC) and Service Wide Vote.”