DATA PROTECTION : AN OVERVIEW OF THE ROLE OF STATE AND NON-STATE ACTORS by STEPHEN AGADA

Introduction:

In 2017, The Economist published a bold statement claiming that the world’s most valuable resource is no longer oil, but data At instant sight of this statement, there’s a tendency to argue and discredit it. But with an enlightened and statistical view, it will be discovered that a majority of the most valued companies in the world deal with data. Top five of these companies include Microsoft, Facebook, Apple, Amazon and Alphabet Inc. (the parent company of Google).

The amount of data we produce every day is so mind-boggling that according to Forbes, there are 2.5 quintillion bytes of data created each day. The internet and smartphones have contributed significantly to making data more valuable, available and abundant.

With the growing adoption of the internet and access to data in this digital age, it is imperative that laws and regulations be put in place to properly control and secure the information being shared online, as this information and data can both be used for beneficial purposes and be vulnerable to improper usage. It is as a result of this, countries around the globe now prioritize data protection and ensure it’s at the forefront of their agenda.

As part of a collective effort, State and Non-State Actors are saddled with certain roles they must play in ensuring the protection of data and information. Therefore, the objective of this paper is to review the role of State and Non-State Actors in data protection.

Ensuring Data Protection: What Role Do The State And Non-State Actors Play?

State Actors been the governments of various countries in the world, have an important role to play in data protection. They play their role through legislation and policies. Only 66% of countries in the world have legislation in force, while an additional 10% have draft legislation. African countries are behind this global trend, with only 52 percent having data protection legislation in force. For example, in Ghana, data protection is regulated under the Data Protection Act, 2012 (DPA) together with Article 18(2) of the 1992 Constitution, which provides citizens with a fundamental right to privacy.

In 2019, Kenya passed Kenya’s Data Protection Act (DPA), which is the primary legislation governing the collection and processing of personal data in Kenya. In South Africa, the Protection of Personal Information Act 4 of 2013 (POPIA) is the comprehensive data protection legislation enacted to give effect to the constitutional right to privacy, whilst balancing this against competing rights and interests, particularly the right of access to information.
In Nigeria, there has been no principal Act on data protection. The principal data protection regulation in Nigeria is the Nigeria Data Protection Regulation 2019 (“NDPR”) which is a subsidiary legislation issued pursuant to the National Information Technology Development Agency Act 2007. Some of the sector-specific legislation that also affects data protection in Nigeria are the Official Secrets Act 1962, the Nigerian Communications Commission Lawful Interception of Communications Regulations, 2019, etc. The agency responsible for the enforcement of data protection regulations and for the administration of all related data protection matters in Nigeria is The Nigeria Data Protection Bureau (“NDPB”) . There are also other sector specific regulatory agencies like the Nigerian Communications Commission(NCC) and the Central Bank of Nigeria (CBN) which provide services relating to the protection of data.

Data protection is a wake-up call to all other entities that are not State-owned, as they are not left out. In fact, with top 5 of the most valuable companies in the world dealing with data , it shows that a bulk of the data and personal information of people are in the hands of Non-state actors. And so they have a more important role to play in fostering data protection.
In the European Union (EU), the General Data Protection Regulation (GDPR) is also applicable to non-state actors whether the organization data subjects are in or outside the EU. Each non-state actor must incorporate the guiding principles of data processing prior to data collection, based on article 5 of the GDPR, which places emphasis on the principles of fairness and transparency.

In South Africa, the POPIA regulates the manner in which personal information may be processed by non-state actors through the establishment of minimum threshold conditions that are in line with international standards. It also provides persons with rights and remedies to protect their personal information from data breaches by non-state actors through the establishment of an Information Regulator to enforce the provisions of the Act.

In Nigeria, the NDPR is applicable to anyone or entity that collects, stores, uses, or shares the data of the citizens of Nigeria. Although yet to be decided is a suit instituted in 2020 by the Incorporated Trustees of Laws and Rights Awareness Initiative against Zoom Video Communications Inc for non-compliance of Zoom’s privacy policy with the NDPR.
In tandem with the EU GDPR, after the Facebook incident with Cambridge Analytica, it has now created a data policy that describes what information they collect and how it is used and shared. With Non-State actors highly prone to cyber attacks which can result in the compromise, corruption, or loss of their data, they have a role to play in ensuring every data identified with them are classified and measures like Multi-Factor Authentication, regular renewal of passwords and strong password policy, review user access, etc are put in place to ensure the protection of the information of their data subjects.
Recommendations:

1. Sensitization is needed to make people aware of their rights. The essence of regulation is in doubt if the citizens are unaware of the said regulation.
2. Creation and adoption of principal laws on data protection in countries all over the globe.
3. A robust enforcement framework primed to give teeth to the provisions of these legislations should also be put in place.
4. All Non-State Actors with the personal information of individuals are to ensure such information is processed in compliance with the legislation and regulations in place in each countries in the world.
5. The obligation to notify the regulatory authority and data subjects in the event of a breach must prescribe specific and certain time frames.
   Conclusion:
   As the concept of data protection continues to evolve, the necessity abounds for its adoption in countries all over the world. There has been the creation and adoption of data protection legislations in developed countries in the world who prioritize data protection. However, certain developing countries and Africa in particular needs to do better as the concept of data protection still looks like a façade in certain countries in the continent. State and Non-State actors in countries without data protection legislations are to make collective efforts in ensuring laws on data protection are enacted and enforced. This will go a long way in making data protection become a reality, and its realization sustained.

The Economist, ‘The world’s most valuable resource is no longer oil, but data (The Economist , 6 May 2017)

https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data accessed 31 October 2022
Oturu D, “Nigeria: An Overview Of Big Data And Data Protection In Nigeria” (Mondaq)

https://www.mondaq.com/nigeria/privacy-protection/799404/an-overview-of-big-data-and-data-protection-in-nigeria accessed October 31, 2022
Marr B, “How Much Data Do We Create Every Day? The Mind-Blowing Stats Everyone Should Read” (Forbes) https://www.google.com/amp/s/www.forbes.com/sites/bernardmarr/2018/05/21/how-much-data-do-we-create-every-day-the-mind-blowing-stats-everyone-should-read/amp/ accessed October 31, 2022

International Network of Privacy Law Professionals , “AN EXTENSIVE ARTICLE ON DATA PRIVACY AND DATA PROTECTION LAW IN NIGERIA” (INPLP) https://inplp.com/latest-news/article/an-extensive-article-on-data-privacy-and-data-protection-law-in-nigeria/ accessed October 31, 2022

Omaplex , “THE IMPACT OF REGULATIONS ON DATA PROTECTION IN NIGERIA” (Omaplex Law Firm) https://omaplex.com.ng/the-impact-of-regulations-on-data-protection-in-nigeria/print/ accessed November 2, 2022

Mackenzie J, “Data Security and Privacy Laws Develop across Africa” (Baker McKenzie) https://www.bakermckenzie.com/en/newsroom/2022/04/data-security-and-privacy-laws-across-africa accessed November 4, 2022
Ibid
“Data Protection in Africa: A Look at OGP Member Progress” (Open Government Partnership, OGP)

https://www.opengovpartnership.org/documents/data-protection-in-africa-a-look-at-ogp-member-progress/ accessed November 4, 2022
“Data Security and Privacy Laws Develop across Africa” (MODERN GHANA)

https://www.modernghana.com/news/1154839/data-security-and-privacy-laws-develop-across-afri.html accessed November 4, 2022
“Data Protection in South Africa” (MichaelPage) https://www.michaelpageafrica.com/advice/management-advice/development-and-retention/data-protection-south-africa#:~:text=The%20Protection%20of%20Personal%20Information,right%20of%20access%20to%20information accessed November 4, 2022
Jumoke Lambo and Chisom Okolie , “Data Protection Laws and Regulations Nigeria 2022” (ICLG.com)

https://www.google.com/amp/s/iclg.com/practice-areas/data-protection-laws-and-regulations/nigeria/amp accessed November 2, 2022
Ibid
“DATA PROTECTION LAWS OF THE WORLD” (DLA, Piper) https://www.dlapiperdataprotection.com/index.html?t=authority&c=NG#:~:text=The%20National%20Information%20Technology%20Development,to%20the%20protection%20of%20data. accessed November 2, 2022
Oturu ( n 2)

Gazi, T. “Data to the rescue: how humanitarian aid NGOs should collect information based on the GDPR.” Int J Humanitarian Action 5, 9 (2020). https://doi.org/10.1186/s41018-020-00078-0 accessed November 4, 2022
Ibid
Johnstone S, “The ‘Download’ on Personal Information: The Protection of Personal Information Act and Municipalities” (LOCAL GOVERNMENT BULLETIN)

https://dullahomarinstitute.org.za/multilevel-govt/local-government-bulletin/archives/volume-16-issue-2-june-2021/the-2018download2019-on-personal-information-the-protection-of-personal-information-act-and-municipalities accessed November 4, 2022
Ibid
“Nigeria – Data Protection Overview” (DataGuidance) https://www.dataguidance.com/notes/nigeria-data-protection-overview accessed November 4, 2022
Ibid
Confessore N, “Cambridge Analytica and Facebook: The Scandal and the Fallout So Far” (The New York Times) https://www.google.com/amp/s/www.nytimes.com/2018/04/04/us/politics/cambridge-analytica-scandal-fallout.amp.html accessed November 4, 2022
Cavanagh C, “Why Is Data Privacy So Important For Media Companies In 2019” (Reuters) https://www.reutersagency.com/en/reuters-community/why-is-data-privacy-so-important-for-media-companies-in-2019/ accessed November 2, 2022
Onyiuke T, “How to Strengthen Nigeria’s Data Protection Regulation” (PUNCH) https://www.google.com/amp/s/punchng.com/how-to-strengthen-nigerias-data-protection-regulation/%3famp. accessed November 3, 2022
INPLP (N 4)
OGP (n 7)