The Journey towards the Nigeria Data Protection Act 2023, by Isa Ali Pantami

The Journey towards the Nigeria Data Protection Act 2023, by Isa Ali Pantami

The Nigeria Data Protection Act 2023 was signed into Law by His Excellency, President Bola Ahmed Tinubu, GCFR on the 12th of June 2023.  The Law effectively positions Nigeria to take its pride of place in the comity of nations in the very important aspect of data protection and data privacy.

The Nigeria Data Protection Regulation, 2019

In this article, I will discuss the timeline and catalogue the series of events that have led to the signing of the Data Protection Bill.    The first landmark event took place on the 25th of January 2019 when, as the Director-General and Chief Executive Officer (CEO) of the National Information Technology Development Agency (NITDA), I signed the Nigeria Data Protection Regulation (NDPR).  This was a subsidiary legislation that derived its powers from the NITDA Act 2007, with specific reference to Section 6.

Prior to the signing of the NDPR 2019, Nigeria had no policy instrument that focused on supporting data privacy and data protection in the country.  Issues bordering around data protection were marginally mentioned in Section 37 of the 1999 Constitution, as amended which says “The privacy of citizens, their homes, correspondences, telephone conversations and telegraphic communications are hereby guaranteed and protected.” It was also briefly mentioned in the laws of the National Identity Management Commission (NIMC), National Human Rights Commission (NHRC) and a few others, but none had data protection as its primary focus.

On assumption of office as the CEO of NITDA in October 2016, I realised that there was a huge gap in the area of data protection.  This, as well as my strong interest in datafication and my conviction that it would serve as a catalyst for Nigeria’s effective participation in the Fourth Industrial Revolution, (4IR} informed my decision to lay a strong emphasis on Information Technology Law at NITDA, as well as partner with leading universities in Nigeria to establish a course on Information Technology Law.  This approach enabled us to develop the requisite capacity for developing our indigenous version of the European Union’s General Data Protection Regulation (GDPR) and a number of African countries eventually partnered with us to study and adapt the NDPR in their countries.

In just 2 years of the implementation of the NDPR, a novel sub-sector of the economy was created, Seven Thousand Six Hundred and Eighty (7,680) Nigerians were employed. Nigeria was appointed as the Vice Chair of the Data Protection Laws Harmonization Working Group at the African Union (AU)and was the only country in Africa to publish a data protection report in two years.

Establishment of the Nigeria Data Protection Parastatals

To further consolidate the gains made through the NDPR 2019, I sent a memo to the former President, His Excellency President Muhammadu Buhari, GCFR, on the 13th of January 2022 citing “an urgent need to establish an institution as a government that will focus on data protection and privacy for the country.  An independent Authority is a pre-requisite for international acceptance of Nigeria’s data protection law. The Adequacy referential of the European Union’s Article 29 Working Party; Convention 108 on the Automatic Processing of Personal Information; the European Union General Data Protection Regulation (EU-GDPR) and Association of Southeast Asian Nations (ASEAN) all prescribe this standard.”

The institution would be an offshoot of NITDA, the Agency that developed and was implementing the NDPR 2019 at the time. Furthermore, I recommended that Dr Vincent Olatunji, the then Director, eGovernment Development and Regulations Department and Chairman of the Nigeria Data Protection Regulation (NDPR) Implementation Committee at NITDA, serve as the  pioneer National Commissioner/CEO of the new institution.  The proposed institution was to be called the Nigeria Data Protection Bureau (NDPB).  The prayers in that memo were approved and President Muhhamadu Buhari appointed Dr Vincent Olatunji as the CEO of the NDPB for an initial term of five (5) years.

The NDPB started operations immediately, on the 4th of February 2022.  Part of the remit of the NDPB included the mandate to galvanise all stakeholders for the drafting of a National Data Protection Bill that will ultimately transform the National Data Protection Bureau into the National Data Protection Commission (NDPC). Section 7 of the Nigeria Data Protection Act 2023, makes the Commission independent whilst section 64 makes the Commission the successor of the NDPB. Thus by virtue of section 64, NDPB automatically becomes NDPC.

Presentation of the Nigeria Data Protection Bill to the Federal Executive Council ( FEC)

As part of the process of ensuring that Nigeria has a principal legislation for enabling data protection and privacy, a draft data protection bill was developed after several stakeholder engagements, comprising institutions and individuals in both the public and private sectors.  I presented the draft bill at the Federal Executive Council (FEC) on the 25th of January, 2023.  After a very robust discussion at the Council and a few amendments, the draft bill was approved.  Three (3) Senior Advocates of Nigeria, who were also members of the Federal Executive Council, made contributions that significantly enhanced the draft bill and most importantly, converted the Bureau’s status to a commission.

Transmission of the Enhanced and Approved Bill to the National Assembly

Following the approval of the draft bill, the Council mandated me to liaise with the Attorney-General of the Federation and Honourable Minister of Justice to forward the bill to the National Assembly as an Executive Bill for passage in both chambers of the National Assembly.  Following the transmission of the bill to the National Assembly, I also had several engagements with the National Assembly to promote the bill and give clarity where required.

Approval by Both Chambers of the National Assembly

The draft bill was independently reviewed by both the Senate and the House of Representatives, after the letter of transmission of the Executive Bill from the President was read in both Chambers on the 4th of April, 2023.  After comprehensive deliberations in both Chambers, the Senate passed the Bill on the 3rd of May 2023 and the House passed it on the 23rd of May 2023.

Signing into Law by President Bola Ahmed Tinubu

His Excellency, President Bola Ahmed Tinubu GCFR assented to the harmonised bill on the 12th of June 2023.  The fact that the journey between the transmission of the Executive Bill to the National Assembly and the signing into law by Mr. President took just 70 days is a testament to the fact that the Bill was given the pride of place that it deserves in our digital economy journey as a country.

The signing of the Nigeria Data Protection Act 2023, along with the Nigeria Startup Act 2022, both of which I had the unique privilege of midwifing, are very critical and have created a very good foundation for the development of a robust digital economy and a sustainable knowledge – based economy.  I would like to extend my hearty commendations to President Bola Ahmed Tinubu GCFR and the former President Muhammadu Buhari GCFR for their invaluable support towards the signing of the Nigeria Data Protection Act 2023. I am confident that these laws will accelerate the digitalisation of the different sectors of the Nigerian economy and history will be kind to all those that played a role in the process.

_Professor Isa Ali Ibrahim (Pantami) CON, former Minister of Communication and Digital Economy is Professor of Cybersecurity, Federal University of Technology Owerri, Imo State_
July 3, 2023