In today’s digital world, where large volumes of data are being generated, stored, and processed online, privacy and data protection have become a top priority for many countries, businesses, and individuals alike.
On 14 June 2023, President Bola Ahmed Tinubu signed the Nigeria Data Protection Act, 2023 into law. This Act provides a legal framework for safeguarding personal information and implementing data protection in Nigeria.
The Nigerian Data Protection Act (NDPA) gives individuals substantial control over the use of their personal data and thus made it mandatory for organizations to recognise and adhere to these provisions. Every organization is mandated by law to respect the rights of data subjects and provide an enabling environment for them to exercise those rights freely.
WHO IS A DATA SUBJECT/ DATA CONTROLLER AND DATA PROCESSOR.
A data subject is any person who can be identified, directly or indirectly, via an identifier such as a name, an ID number, location data, or via factors specific to the person’s physical, physiological, genetic, mental, economic, cultural or social identity.
A data controller is the one who determines the purposes for which and the means by which personal data is processed. For instance if company AB limited decides ‘why’ and ‘how’ the personal data of its staff should be processed, then company AB limited is the data controller while the staff are the data subjects.
A data processor on the other hand processes personal data on behalf of the controller only. The data processor is usually a third party external to the company. A very good example is when a company engages an HMO to provide medical facilities to its staff. In this instance the company is the Data Controller while the HMO is the Data Processor.
RIGHTS OF DATA SUBJECT UNDER THE NIGERIA DATA PROTECTION ACT.
1. RIGHT TO BE INFORMED:
A data controller who wants to use personal data of a data subject must inform the subjects about the processing and its extent timeously. This means that companies, institutions, or individuals must tell the data subjects what they are processing and the purpose for such processing in a clear, concise, transparent, and intelligible manner. Companies fulfill this obligation by having Privacy statements on their website or even displayed conspicuously in their offices.
2. RIGHT OF ACCESS:
A data subject has a right to access their data and obtain a copy of their personal data, and other supplementary information from an organization processing personal data. This may or may not include payment of a fee depending on the circumstances of the case provided such access will not infringe on the right of others. Examples of this is when a student requests for his transcript from the university or when an individual approaches his/her bank for a bank statement.
3. RIGHT TO RECTIFICATION OF PERSONAL DATA.
This means the right to correct inaccurate personal data as well as the ability to complete or supplement it. Individuals have the right to have personal data rectified. An instance is when a woman who just got married requests the bank to change her surname to her spouse’s name.
4. RIGHT TO ERASURE OR DELETION.
This is also known as the ‘right to be forgotten”. This right applies when the personal data are no longer necessary in relation to the purpose for which they were collected. This gives individuals (data subjects) the right to ask organizations to delete their personal data. This right is not absolute and only applies in circumstances such as where:
- When the personal data is no longer necessary for the purpose for which it was collected.
- When the individual withdraws their consent for processing their data, there is no other legal basis for continuing to process it.
- When the individual objects to the processing of their data, and there are no overriding legitimate grounds for the processing.
- When the personal data has been unlawfully processed.
- When the personal data has to be erased in order to comply with a legal obligation.
An example of this is when an individual requests that his /her social media account be deleted. the user decides to delete their account and requests that all their personal data be erased from the platform’s databases.
5. RIGHT TO RESTRICTION OF PROCESSING:
This means that an individual can limit the way an organization uses their data. This is an alternative to requesting the erasure of their data. Individuals have the right to restrict the processing of their personal data where they have a particular reason for wanting the restriction.
6. RIGHT TO WITHDRAW CONSENT.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
7. RIGHT TO OBJECT TO PROCESSING OF PERSONAL DATA
The right of an individual or data subject to object to the processing of their personal data or information in certain circumstances. The data subject has the general right to object to the processing of their data, particularly for the purpose of marketing and the data controller has the responsibility of providing a free mechanism for the objection. Section 36 of the NDPA provides that a Data Subject is entitled to object to the processing of his/her Personal Data.
8. RIGHT NOT TO BE SUBJECTED TO AUTOMATED DECISION MAKING
Automated decision making’ means a decision based solely on automated processing by automated means without any human effort, see section 65 of the NDPA. For instance when an employer uses an Applicant Tracking System (ATS) to screen job applicants and the system is configured to automatically accept or reject applications without human intervention. The employer in this instance is engaging in automated decision-making.
The data protection Act states that an individual (data subject) has the right not to be subject to a decision based solely on automated means.
The Act, however, requires a data controller, prior to processing of data, to inform the data subject of the existence of automated decision making.
This right does not however apply in the following circumstance where the decision is:
a) where it is necessary for entering into or the performance of a contract between the data subject and a data controller;
b) authorized by a written law, which establishes suitable measures to safeguard the fundamental rights and freedoms and the interests of the data subject.
9. RIGHT TO DATA PORTABILITY.
The right to data portability allows the data subject to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability. For example when the data subject moves their phone contact to a gmail account linked to the phone without affecting its usage on both the phone and the email.
10. RIGHT TO LODGE A COMPLAINT.
Where a data subject is dissatisfied with the decision, action, or inaction of a data controller or data processor, the data subject have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) for remedial action. Data subjects may also institute civil proceedings for damages against a data controller or data processor for any wrong or loss suffered by a data subject as a result of the violation of the Act. The data subject has the right to receive compensation for any breach of any of the rights provided by law.
Disclaimer: The content of this article is intended to provide a general guide only and should note be substituted for legal advice. We are available to provide legal advice when they arise..
For advert enquiries call 0813 776 2516.
Send your press release and articles to: hannah@thelegalpreneur.com.ng