Guest post: Exploring data privacy in Nigeria: Incorporated trustees of laws and rights awareness initiative v Nigerian Communications Commission

As readers may be aware, The IPKat also covers privacy and confidentiality issues and so, is pleased to host the following guest contribution by Katfriend Bibitayo Emmanuel Ojo (DataPro Limited) on the struggles between data privacy rights of citizens and government's duties around national security. This Kat has, elsewhere previously explored the IP connection to technology and national security.

Over to Bibitayo:

The digital age has ushered in an era of unprecedented data collection and processing. This, while offering undeniable benefits, also raises critical concerns regarding the protection of individual privacy. In Nigeria, the recent judgment delivered by the Federal High Court in the case of Incorporated Trustees of Laws and Rights Awareness Initiative v Nigerian Communications Commission (NCC) sheds light on this complex relationship between data privacy and the interests of the state.

Background: A Clash of Rights  

The Incorporated Trustees of Laws and Rights Awareness Initiative filed a suit against the Nigerian Communications Commission (NCC) challenging the legality of Regulation 8(2)(a) and (c) of the Nigerian Communications (Enforcement Process etc) Regulations 2019 (the Regulations). This regulation empowers relevant authorities to request "basic information" of telephone subscribers from service providers without obtaining a court order. The Applicant argued that this provision violated the fundamental right to privacy guaranteed under Section 37 of the Constitution of Federal Republic of Nigeria. The NCC, on the other hand, defended the Regulation as a necessary tool for law enforcement agencies in their fight against crime.

Legal framework: Navigating the labyrinth
The legal battleground for this case lay at the intersection of two key legal provisions:

i. Section 37 of the Nigerian Constitution: This section enshrines the right to privacy for all citizens. Thus, the call recording falls under this scope of right and as such privacy of communication is inviolable. This right is not absolute, however, and can be restricted under specific circumstances as outlined in Section 45 of the Constitution, which allows for limitations on fundamental rights in the interest of public safety, public order or morality.

ii. Regulation 8(2)(a) and (c) of the Nigerian Communications (Enforcement Process etc) Regulations 2019: This regulation grants relevant authorities access to subscribers' "basic information" upon written request and without a court order. The definition of "basic information" within the Regulations potentially encompasses a range of personal data such as subscriber names, addresses, and call logs.

Court's reasoning: Balancing act or missed opportunity?
The Court's judgment hinged on a literal interpretation of the legal framework. It dismissed the preliminary objections raised by the NCC regarding its legal standing, paving the way for a substantive examination of the privacy concerns. However, the court ultimately threw its weight behind the NCC, concluding that the Regulation did not violate the right to privacy as enshrined in the Constitution. The court's reasoning can be broken down into three key points:

...we must secure the nation...

i. Literal interpretation of the Regulation: The court adhered to a strict interpretation of Regulation 8(2)(a) and (c), emphasizing the clear and unambiguous wording that grants access to "basic information" without a court order.
ii. Legitimate interest: The court acknowledged the State's legitimate interest in crime prevention and national security. It viewed the ability to access subscriber information as a valuable tool for law enforcement agencies to investigate criminal activity.
iii. Limitations on rights: The court recognized the limitations on fundamental rights outlined in Section 45 of the Constitution. In this case, the court deemed the infringement on privacy rights justifiable in light of the public interest served by the regulation.

Critique and missed opportunities: A broader look at data privacy

While the court's adherence to a literal interpretation and avoidance of technicalities are commendable, the judgment raises certain concerns such as:
Limited focus on data privacy: The judgment primarily focused on the conflict between individual privacy rights and State interests in national security. It failed to comprehensively address the broader principles of data protection enshrined in the recently enacted Nigeria Data Protection Act (NDPA) as it relates to processing of personal data by data controllers. According to Section 24 of the NDPA, a data controller or data processor shall ensure that personal data is: (a) processed in a fair, lawful, and transparent manner; (b) collected for specified, explicit, and legitimate purposes (c) adequate, relevant, and limited to the minimum necessary for the purposes for which the personal data was collected or further processed (d) retained for not longer than is necessary (e) accurate, complete, not misleading (f) processed in a manner that ensures appropriate security of personal data.
Uncertainties in data access: The judgment remains ambiguous regarding the precise scope of "basic information" accessible by authorities under the Regulation. This lack of clarity creates uncertainty for both subscribers and service providers when it comes to data privacy compliance.
Chilling effect: The ease of access to subscriber information under the Regulation might create a chilling effect on freedom of expression, particularly for individuals who rely on private communication for sensitive topics like political activism or reporting on government misconduct.

Impact on data privacy landscape: A double-edged sword

The court's judgment presents a complex scenario for the data privacy landscape in Nigeria. Granting access to "basic information" without a court order raises a red flag for individual privacy, especially since the definition of "basic information" within the regulation points to personal data which is to be protected. This could lead to arbitrary surveillance by government agencies and potential misuse of personal data.

Similarly, considering the interest of the public, the judgement acknowledges the legitimate public interest in crime prevention and law enforcement activities. Access to call data for investigations can be crucial in tackling criminal activity and ensuring public safety.

Moving forward: Striking a balance

The present case highlights the ongoing tension between individual privacy rights and national security concerns in the digital age. Here are some key considerations for navigating this complex landscape:

Harmonizing legislation: A crucial step lies in ensuring greater harmony between the Nigerian Communications (Enforcement Process etc.) Regulations and the Nigeria Data Protection Act. This could involve amending the regulations to require a court order for accessing subscriber information, with exceptions for emergency situations. Additionally, the NDPA's provisions regarding data minimization and purpose limitation could be more explicitly incorporated into the regulations.
Data minimisation and transparency: Telecommunications companies, as data controllers, should implement robust data minimisation practices, ensuring they only collect and store "basic information" as defined by the regulations and the NDPA. Furthermore, it is crucial that subscribers are clearly informed about what data is collected, how it is used, and with whom it is shared.
Judicial interpretation with data privacy in mind: Future court cases involving data privacy should consider both the Regulations and the NDPA in their interpretations. Judges should be equipped with an understanding of data protection principles and their application in the digital age.
Public awareness and advocacy: Raising public awareness about data privacy rights and promoting responsible data collection practices are essential. Civil society organisations and advocacy groups can play a role in educating the public and holding government accountable for upholding data protection standards.

Conclusion: A continuous journey
The decision in Incorporated trustees of laws and rights awareness initiative v. NCC serves as a springboard for a more understanding of data privacy in Nigeria. Striking a balance between national security and individual privacy necessitates a multi-pronged approach. This includes harmonizing legislation, fostering judicial awareness, and promoting public engagement. As technology continues to evolve, so too must the legal framework and societal discourse surrounding data privacy in Nigeria. This journey towards a more secure and privacy-conscious digital space requires ongoing dialogue, collaboration, and a commitment to upholding fundamental rights in the digital age.