With the signing of the Nigeria Data Protection Bill into law by President Bola Tinubu on June 12, 2023, data protection activities in Nigeria have taken a new turn.
At the center of this transformation is the regulator, the Nigeria Data Protection Commission (NDPC), which is responsible for implementing the law and ensuring that companies operating in Nigeria comply fully with its provisions.
While regulators in Europe have imposed multi-million dollar sanctions on multinational corporations—particularly big tech companies like Meta and TikTok, for data breaches, the Nigerian landscape has remained relatively calm, despite reports of occasional breaches.
In this exclusive interview with Nairametrics, the National Commissioner/CEO of the NDPC, Dr. Vincent Olatunji, explains why Nigeria has not adopted the European approach in its data protection enforcement.
Dr. Olatunji also addresses the recent alleged breach of Nigeria’s National Identification Number (NIN) database and explains why the NDPC favors remediation over public shaming.
Nairametrics: Your organization is participating in the ongoing discourse on National Identity. Can you tell us the nexus between the National ID and data protection?
Dr. Vincent Olatunji: When you’re talking about your data, all we are talking about is identity — that is, your personal data, your personal information. No matter what you have put in place in collecting identities, if you don’t implement adequate protection measures, you are exposing them to unauthorized access.
And that may have grave consequences for the Identity Management Commission, or whoever is in charge of identity management. So, when you’re talking about identity, at the same time, you must be thinking about how to protect it. That is where both meet.
Nairametrics: Not long ago, there was an alleged incident of a data breach at NIMC, whereby the National Identification Number (NIN) data of Nigerians was allegedly being sold by some third parties who had access to the database. Your Commission said it was investigating the incident then. What has been the outcome?
Dr. Vincent Olatunji: We actually investigated and found that what was put out in the media was not the case. Our method is: when there is an alleged breach, we write to the organization concerned and carry out a thorough investigation. And that was what we did.
I actually met with NIMC, and we set up a team. I worked with that team to conduct detailed investigations into their operations. What happened, I believe, had to do with issues from some of their agents. Those issues have been rectified.
But the most important thing is that if there are non-conformities in any system, our approach is remediation. We are working closely with NIMC to ensure that all necessary measures are put in place, technical measures, as well as capacity building for staff to manage the database and everything else. So, they have implemented several measures to ensure security.
Nairametrics: Now, talking about remediation and sanctions, across Europe, data protection regulators are imposing heavy fines on big tech companies found to have breached provisions of the GDPR. The case has not been the same in Nigeria. Why is this so?
Dr. Vincent Olatunji: It depends on the approach. Our approach is not to be sensational about breaches.
When we discover a breach, we assess: one, the extent of the breach; two, the sensitivity; three, the impact on the data subjects; and four, the number of data subjects affected. We don’t just go out there and make announcements.
You’ll recall that we have made announcements about investigating certain organisations. Usually, when we investigate and find a breach, if they are ready to comply with the law, what is the point of making noise?
More importantly, our economy is fragile, not as strong as that of Europe. We are still developing. Our work is to enhance the ease of doing business. We want to grow our ecosystem and economy, not chase businesses away.
It’s only when an organization is unwilling to comply with the law that we are forced to impose sanctions.
You’ll recall we made an announcement about a bank. When they came back, we told them the issues we found and asked them to remediate. That has been our approach, and that’s what we encourage.
If you look at the leverage and traction we have gained in deepening privacy in Nigeria, it’s better than playing politics or making noise.
We let organizations see the value of compliance. This builds trust and confidence in their business and attracts more opportunities. That’s more effective than pronouncements that could destroy businesses.
Businesses can collapse from a mere announcement. We only go that route when the impact is very severe.
Nairametrics: Has there been any instance where an organization was not willing to go the way of remediation and had to be sanctioned?
Dr. Vincent Olatunji: I would say all the organizations we have investigated have always appealed for remediation. All of them. We sanctioned only one bank last year, and they eventually came back to carry out remediation. The most important thing is doing what is right. Compliance is a culture.
Nairametrics: You recently announced that you were investigating TikTok and Truecaller. Have you completed the investigations, and what are your findings?
Dr. Vincent Olatunji: We are still on the investigations. They are not yet completed.
Nairametrics: So, what is the level of data protection compliance in Nigeria right now?
Dr. Vincent Olatunji: It is much better now. For instance, when we started, only about 630 organizations were registered with us. That number rose to 1,777, then to about 2,230.
Last year, due to our approach, the number increased to 33,000. In the same year, compliance audits filed rose to 4,820.
That means our approach is working. There are countries that started before us, but the level we’ve attained in terms of compliance and registration far exceeds theirs.
Nairametrics: Public institutions control the largest amount of data in the country, and you mentioned last year that CEOs of MDAs would be sanctioned for any breach that occurs under their leadership. What is the level of compliance with data protection by MDAs right now?
Dr. Vincent Olatunji: It’s much better than when we started. At the time, compliance by MDAs was just 4%. As of last year, it increased to 20%, and this shows progress. If you look at the budgets of MDAs for this year, many of them included data protection audits as a major budget line.
This shows our awareness campaigns are working. They now recognize compliance as essential, this never happened before. That means people are willing to comply. They now see the value in compliance. So, in the public sector, it’s improving.
Nairametrics: For some agencies, sanctions and fines are part of their revenue sources. How do you generate revenue if you are not sanctioning organizations for breaches?
Dr. Vincent Olatunji: We have the power to sanction any recalcitrant organization that refuses to comply.
And even with remediation, those seeking it must pay. For example, if the initial fine is N500 million, we might say, “Pay N100 million, and do A, B, C, D” in terms of compliance. That money goes to the government, not to any individual.
Nairametrics: If a company records a breach that affects customers (the data subjects) and undergoes remediation and pays the government, who compensates the customers, who are the victims of the breach?
Dr. Vincent Olatunji: The customers can go to court. There are many laws they can rely on.
For instance, a few months ago, Femi Falana took Meta to court over a data privacy issue. Several others have done the same. That’s part of the awareness we are creating.
Data subjects now know they have rights and can take data controllers to court if their data is mismanaged.
We’ve now started asking some organizations to compensate the data subjects, and it has happened on two occasions.
We instruct them to compensate, but the negotiation on the amount is between the data subject and the data controller.
Nairametrics: Since you started this data protection crusade, especially after the NDPA was signed into law on June 12, 2023, what would you say has been your biggest challenge on the job?
Dr. Vincent Olatunji: Number one is funding — this is a major challenge for most data protection regulators globally.
The second is recruitment, training, and retention of skilled personnel. This sector requires highly skilled people who understand the law and know what to do.
It takes a lot. Sometimes we train people, and before you know it, they’ve left the country. Several of our staff have done so after we’ve trained them to a point where they are dependable.
Awareness is also a challenge. Many people don’t know their rights. Data controllers don’t know their obligations, and they are facing human capital shortages too.
We are saying data controllers must engage DPOs, but we don’t have enough certified DPOs in Nigeria. That’s why we are building capacity and certifying more people. Again, companies should see this as essential. Hiring DPOs should be considered part of their operational expenditure.
For example, if a bank doesn’t want to hire a DPO, it should understand the implications. It’s better to spend money on a DPO who will support your customers and ensure compliance than to pay fines.
Even for ministries and departments where the improvement process is slower, we are advising them to retrain existing staff to become DPOs. That’s part of what we are doing.
Nairametrics: From your estimate, how many DPOs do we have in Nigeria right now?
Dr. Vincent Olatunji: They fall into two categories. Some are practicing as DPOs but are not certified, although they know the job. Others are certified.
So, plus or minus, we have over 10,000 certified DPOs now. But those working in the ecosystem are more than 23,000.
