The Nigeria Data Protection Commission, NDPC, says compliance to data protection laws by the electoral body and political parties would enhance Nigeria’s global reputation and democratic credentials.
In an interview with Voice of Nigeria, in Abuja, Nigeria’s capital, the National Commissioner, NDPC, Dr. Vincent Olatunji emphasised the need for the Independent National Electoral Commission, INEC and Political Parties in the country to prioritize the data protection and privacy of electorates and party members.
To this end, Dr Olatunji said this can be achieved by creating awareness and compliance to the Nigeria Data Protect Act, NDP2023.
He stressed that this would ensure a secure, credible, and trustworthy electoral process which is the international best practice for electoral data protection.
With the adoption of information and communication technologies in Nigeria, the electoral process has served a solution, but has also raised new issues, such as data privacy breach matters during the 2023 general election.
In light of this, the National Commissioner, NDPC, said since INEC handles sensitive personal data, protecting this data maintains citizens’ confidentiality and prevents identity theft.
“All of us are data subjects; INEC is a data controller. INEC must process data within the laws provided in the Nigeria Data Protection Act. Any data leakage here can lead to a lot of issues, with INEC being a data controller of major importance in Nigeria to avoid legal and reputational consequences.
“Apart from the National Identity Management Commission, INEC has a larger database of Nigerians but the most important thing is that INEC has the personal information of Nigerians of voting age, including their biometrics, which are sensitive. So it’s very important for INEC and political parties to put in place public safeguards.
“For the data subjects, who are the voters, it is important to know what they do with their information. It gives more credibility to the process, because everybody in the database has given consent to collect their personal data, and for them to know what such information will be used for,” he explained.
According to the NDPC Boss this would prevent bias and discrimination and build voter confidence in protecting electorates’ privacy and data builds confidence in the electoral process, encouraging participation, reducing apathy promoting equality and inclusivity.
Aside data breach, one of the major emerging risks of an electronic voting system is that of cyber security attacks, hence, Dr Olatunji stressed the need to install necessary controls to ensure that cyber security risks and privacy concerns are mitigated in a voting system.
With collection and use of data for canvassing political support during campaign on digital platforms such as social media, National Commissioner noted that this has brought to the fore the need to protect the right to privacy and ensure a transparent, ethical, and lawful ecosystem when processing personal data.
“The Nigeria Data Protection Act (NPC) enacted in 2023 aims to regulate the processing of personal data and empowers citizens to protect their personal data in the electoral process. The Act further sets out obligations for entities processing personal data for electoral purposes, including the localization of this data in Nigeria.
“It enhances the integrity of elections and democracy by safeguarding the collection and processing of all personal data involved in electoral processes. This includes voter registration, inspection of the Register of Voters, recruitment of members by political parties, and political campaigning, all of which must be undertaken in accordance with the provisions of the Data protection laws in the country,” Olatunji emphasised.
This aligns with the recommendation in 2020 by the Kofi Anan Commission on Elections and Democracy in the Digital Age “In a relevant public authorities must accept their responsibility to protect electoral integrity. Most importantly, laws and regulations for political campaigning and advertising must be adapted to the digital age.”
He recalled that the commission had a meeting with INEC Chairman, Professor Mahmood Yakubu to ensure the proper protection of personal data of Nigerian citizens in INEC’s database noting that Prof Yukubu is personally driving it to ensure that they possess the data within the provisions of the Nigerian Data Protection Act.
Highlighted the potential consequences of non-compliance, Olatunji stated that these include reputational damage, financial loss, and even death in extreme cases.
He outlined what INEC is required to do in the area of compliance, including having a privacy policy, appointing a Data Protection Officer (DPO) at the headquarters and state levels, and engaging a Data Protection Compliance Organisation, among other measures.
He added that the NDPC will conduct free training for INEC members of Staff and appointed DPOs, as anyone can be the weakest link in data breaches.
Olatunji said political parties also have a role to ensure that their members’ are knowledgeable on NDP Act 2023, to this end “we will be engaging political parties on compliance, awareness and migrating digitally which will give the political parties and their members a lot of value to understand data protection,” the NDPC Boss assured.
As the data protection authority in Nigeria continues to establish itself and the public gains greater awareness and understanding of the body and the act, he added that the Nigeria Data Protection Act would have a larger impact in subsequent elections, including adequate implementation of data protection principles.
According to industry experts the NDP ACT 2023 is the overarching legislation on data protection in Nigeria and serves as an apt tool to address violations of individuals’ rights to privacy that were prevalent in the 2023 Nigeria general elections.
