With the signing of the Nigeria Information Safety Invoice into regulation by President Bola Tinubu on June 12, 2023, information safety actions in Nigeria have taken a brand new flip.
On the heart of this transformation is the regulator, the Nigeria Information Safety Fee (NDPC), which is chargeable for implementing the regulation and guaranteeing that corporations working in Nigeria comply absolutely with its provisions.
Whereas regulators in Europe have imposed multi-million greenback sanctions on multinational companies—significantly huge tech corporations like Meta and TikTok, for information breaches, the Nigerian panorama has remained comparatively calm, regardless of experiences of occasional breaches.
On this unique interview with Nairametrics, the Nationwide Commissioner/CEO of the NDPC, Dr. Vincent Olatunji, explains why Nigeria has not adopted the European strategy in its information safety enforcement.
Dr. Olatunji additionally addresses the latest alleged breach of Nigeria’s Nationwide Identification Quantity (NIN) database and explains why the NDPC favors remediation over public shaming.
Nairametrics: Your group is taking part within the ongoing discourse on Nationwide Id. Are you able to inform us the nexus between the Nationwide ID and information safety?
Dr. Vincent Olatunji: While you’re speaking about your information, all we’re speaking about is identification — that’s, your private information, your private info. It doesn’t matter what you could have put in place in accumulating identities, in case you don’t implement satisfactory safety measures, you might be exposing them to unauthorized entry.
And that will have grave penalties for the Id Administration Fee, or whoever is answerable for identification administration. So, once you’re speaking about identification, on the identical time, you should be fascinated about how one can defend it. That’s the place each meet.
Nairametrics: Not way back, there was an alleged incident of an information breach at NIMC, whereby the Nationwide Identification Quantity (NIN) information of Nigerians was allegedly being offered by some third events who had entry to the database. Your Fee mentioned it was investigating the incident then. What has been the end result?
Dr. Vincent Olatunji: We truly investigated and located that what was put out within the media was not the case. Our methodology is: when there’s an alleged breach, we write to the group involved and perform a radical investigation. And that was what we did.
I truly met with NIMC, and we arrange a workforce. I labored with that workforce to conduct detailed investigations into their operations. What occurred, I imagine, needed to do with points from a few of their brokers. These points have been rectified.
However crucial factor is that if there are non-conformities in any system, our strategy is remediation. We’re working intently with NIMC to make sure that all obligatory measures are put in place, technical measures, in addition to capability constructing for employees to handle the database and every thing else. So, they’ve applied a number of measures to make sure safety.
Nairametrics: Now, speaking about remediation and sanctions, throughout Europe, information safety regulators are imposing heavy fines on huge tech corporations discovered to have breached provisions of the GDPR. The case has not been the identical in Nigeria. Why is that this so?
Dr. Vincent Olatunji: It will depend on the strategy. Our strategy is to not be sensational about breaches.
Once we uncover a breach, we assess: one, the extent of the breach; two, the sensitivity; three, the affect on the info topics; and 4, the variety of information topics affected. We don’t simply go on the market and make bulletins.
You’ll recall that we’ve got made bulletins about investigating sure organisations. Normally, once we examine and discover a breach, if they’re able to adjust to the regulation, what’s the level of creating noise?
Extra importantly, our economic system is fragile, not as sturdy as that of Europe. We’re nonetheless growing. Our work is to boost the convenience of doing enterprise. We wish to develop our ecosystem and economic system, not chase companies away.
It’s solely when a corporation is unwilling to adjust to the regulation that we’re compelled to impose sanctions.
You’ll recall we made an announcement a few {bank}. After they got here again, we informed them the problems we discovered and requested them to remediate. That has been our strategy, and that’s what we encourage.
Should you have a look at the leverage and traction we’ve got gained in deepening privateness in Nigeria, it’s higher than enjoying politics or making noise.
We let organizations see the worth of compliance. This builds belief and confidence of their enterprise and attracts extra alternatives. That’s simpler than pronouncements that would destroy companies.
Companies can collapse from a mere announcement. We solely go that route when the affect could be very extreme.
Nairametrics: Has there been any occasion the place a corporation was not keen to go the best way of remediation and needed to be sanctioned?
Dr. Vincent Olatunji: I might say all of the organizations we’ve got investigated have all the time appealed for remediation. All of them. We sanctioned just one {bank} final 12 months, and so they ultimately got here again to hold out remediation. An important factor is doing what is true. Compliance is a tradition.
Nairametrics: You lately introduced that you just have been investigating TikTok and Truecaller. Have you ever accomplished the investigations, and what are your findings?
Dr. Vincent Olatunji: We’re nonetheless on the investigations. They don’t seem to be but accomplished.
Nairametrics: So, what’s the stage of knowledge safety compliance in Nigeria proper now?
Dr. Vincent Olatunji: It’s a lot better now. For example, once we began, solely about 630 organizations have been registered with us. That quantity rose to 1,777, then to about 2,230.
Final 12 months, because of our strategy, the quantity elevated to 33,000. In the identical 12 months, compliance audits filed rose to 4,820.
Which means our strategy is working. There are nations that began earlier than us, however the stage we’ve attained by way of compliance and registration far exceeds theirs.
Nairametrics: Public establishments management the most important quantity of knowledge within the nation, and also you talked about final 12 months that CEOs of MDAs can be sanctioned for any breach that happens below their management. What’s the stage of compliance with information safety by MDAs proper now?
Dr. Vincent Olatunji: It’s a lot better than once we began. On the time, compliance by MDAs was simply 4%. As of final 12 months, it elevated to twenty%, and this reveals progress. Should you have a look at the budgets of MDAs for this 12 months, lots of them included information safety audits as a significant finances line.
This reveals our consciousness campaigns are working. They now acknowledge compliance as important, this by no means occurred earlier than. Which means persons are keen to conform. They now see the worth in compliance. So, within the public sector, it’s bettering.
Nairametrics: For some companies, sanctions and fines are a part of their income sources. How do you generate income if you’re not sanctioning organizations for breaches?
Nairametrics: If an organization data a breach that impacts clients (the info topics) and undergoes remediation and pays the federal government, who compensates the shoppers, who’re the victims of the breach?
Nairametrics: If an organization data a breach that impacts clients (the info topics) and undergoes remediation and pays the federal government, who compensates the shoppers, who’re the victims of the breach?
Dr. Vincent Olatunji: The purchasers can go to court docket. There are numerous legal guidelines they will depend on.
For example, just a few months in the past, Femi Falana took Meta to court docket over an information privateness subject. A number of others have accomplished the identical. That’s a part of the attention we’re creating.
