By Tolulope Idowu tolulopeid@gmail.com

The recent call by the Nigeria Data Protection Commission (NDPC) for all data controllers and processors to register has raised questions about its legal basis and potential overreach. While Section Section 5(d) of the Nigeria Data Protection 2023 mandates registration for those of “major importance,” the NDPC’s blanket request seems to deviate from this stipulation.

The NDPC’s demand for universal registration raises concerns about exceeding its legal mandate. Section 5(d) of the NDPA clearly outlines the need for registration only for “data controllers and processors of major importance.” However, the NDPC’s public notice omits this qualifier, creating confusion and potentially exceeding its legal authority.

Learning from Other African Data Protection Laws:

Comparative analysis with other African nations reveals a more refined approach to data controller/processor registration. In Kenya, Section 18 of the Data Protection Act 2019 empowers the Data Commissioner to set specific thresholds based on industry, data volume, sensitivity of data, and other relevant criteria. This allows for a more targeted and justifiable registration process. Similarly, Uganda’s Data Protection and Privacy Act 2019 requires registration of “every person, institution or public body collecting or processing personal data,” offering a clear and comprehensive approach. Article 29 & 30 of the Rwandan Law also offers specific details registration requirements for registration as a data controller or processor.

The Need for Clarity and Guidelines:

The lack of clear guidelines regarding “major importance” in the Nigerian context leaves data controllers and processors uncertain about their registration obligations. This ambiguity can lead to confusion, unnecessary compliance burdens, and potential legal challenges.

Recommendations for a More Justified Approach:

To address these concerns, the NDPC should take the following steps:

  • Issue Clear Guidelines: The NDPC should define “major importance” through detailed and publicly available guidelines. These guidelines should consider factors like industry type, data volume, data sensitivity, and potential risk of harm to individuals.
  • Implement Threshold-Based Registration: Similar to Kenya’s approach, the NDPC could establish thresholds for mandatory registration based on pre-defined criteria. This would ensure a more targeted and proportionate approach.
  • Engage with Stakeholders: The NDPC should actively engage with data controllers, processors, and civil society organizations to discuss the registration process, clarify expectations, and address concerns.

Conclusion:

While the NDPC’s goal of data protection is commendable, its current blanket registration call lacks clear legal justification and creates unnecessary burdens. By adopting a more balanced and transparent approach, informed by best practices and stakeholder engagement, the NDPC can achieve its objectives while ensuring compliance with the law and fostering a more predictable regulatory environment.

______________________________________________________________________ [A MUST HAVE] Evidence Act Demystified With Recent And Contemporary Cases And Materials
“Evidence Act: Complete Annotation” by renowned legal experts Sanni & Etti.
Available now for NGN 40,000 at ASC Publications, 10, Boyle Street, Onikan, Lagos. Beside High Court, TBS. Email publications@ayindesanni.com or WhatsApp +2347056667384. Purchase Link: https://paystack.com/buy/evidence-act-complete-annotation ________________________________________________________________________ “Enhance Legal Practice With Authoritative Reports” — Alexander Payne Offers Comprehensive Law Reports, Spanning Over A Century Of Nigerian Jurisprudence

Interested buyers are encouraged to place their orders and enquiries via: 0704 444 4777, 0704 444 4999, 0818 199 9888 Website: www.alexandernigeria.com

_______________________________________________________________________