Is There Any Legal Protection for the Personal Data of a Tourist in Nigeria?
INTRODUCTION
The National Information Technology Development Agency on 25th January 2019 issued the NDPR and further issued NDPR Framework 2020 to regulate the manner in which personal data is processed. The essence of the regulation is to ensure that personal data is processed fairly at all time. NDPRIn Europe, the applicable instrument on data privacy and protection is the General Data Protection Regulation, (GDPR)2018. GDPR applies to anybody “in the Union” (Europe). Conversely, under the NDPR, Article 1.2(b) of the NDPR provides that the Regulation “applies to natural person residing in Nigeria or residing outside Nigeria who are citizens of Nigeria.
WHAT DOES IT MEAN TO RESIDE IN NIGERIA?
The NDPR and NDPR Framework limits the class of non-Nigeria it applies to only those residing in Nigeria. In other words, it is not enough to be in Nigeria, rather such individual must be residing in Nigeria in order to fall under the contemplation of the NDPR and NDPR Framework. The word “residing” is a continuing verb for the word residence (noun). Neither the NDPR nor the Framework defined “residence”. Thus, reliance must be made to both primary and secondary legal literature to decipher the meaning. According to Black’s Law Dictionary 10 ed. Residence means (1) the act or fact of living in a given place for some time (a year’s residence). (2) The place where one actually lives, as distinguished from a domicile. Further in the case of Omotunde v Omotunde, (2000) LPELR-10914, the Court of Appeal defined residence as being bodily present as an inhabitant in a given place. Also, in DASHE & ORS v. JATAU & ORS (2016) LPELR-40180(CA) "A "resident" means inter alia, persons "2. Dwelling in a place other than one's home on a long-term basis... 1. A person who lives in a particular place. 2. A person who has a home in a particular place. In sense 2, a resident is not necessarily either a citizen or a domiciliary." See Black's Law Dictionary (supra) page 1424." Per JOSEPH TINE TUR, JCA (Pp 40 - 41 Paras E - A) . Also, Section 5(2) of the Nigeria Immigration Rule 2017 provides that resident permit granted shall last for two(2)years. It suffices to say that a residence is someone who must stay for two(2)years atleast in Nigeria.
WHO IS A TOURIST?
In Attorney General of Federation v Attorney General of Lagos State (2013) LPELR-20974 the Supreme Court defined a tourist as a person who is travelling or visiting a place for pleasure. According to the Nigeria Visa Policy (NVP) 2020, tourist visa only allows a person to stay in Nigeria for no more than three (3) months (90 days). The question then is does being in Nigeria for 90 days amount to residing and if not, can it be said that the NDPR and NDPR Framework applies to tourist. The provision of NDPR is clear that the regulation applies only to non-Nigerians residing in Nigeria and for all intent and purposes does not extend to non-Nigerians that are not resident in Nigeria. The court in Omotunde cited above refers to residence as an inhabitant in a given place and in Ecodrill stated that such person must at least be in Nigeria for 183 days. A tourist has just 90 days to stay in Nigeria and therefore does not fall under the contemplation of the NDPR and NDPR Framework. The Court of Appeal in the case of Incorporated Trustee of Digital Right Lawyers Initiative v. National Identity Management Commission (2021) LPELR-55623 seem to have given tacit approval to this position when it stated that provisions of NDPR derives NDPR force from section 37 of 1999 Constitution of the Federal Republic of Nigeria as amended. The holding of the court is excerpted below
“on the relationship between the NDPR, 2019 and Section 37 of the CFRN, 1999, it is pertinent for me to state that the CFRN, 1999 makes provisions in Chapter IV guaranteeing the various fundamental rights of the citizens. But as I stated earlier, the nature and scope of those rights and even their limitations, are in most instances furthered by other statutes, regulations or other legal instruments. It is in this instance that the NDPR, 2019 must be construed as providing one of such legal instruments that protects or safeguards the right to "privacy of citizens" as it relates to the protection of their personal information or data, which the trial Court had rightly adjudged at page 89 of the Record to be part of the privacy right guaranteed by Section 37 of the CFRN, 1999. Apart from the provisions of Article 2.9 of the NDPR, 2019 quoted above, which specifically linked the NDPR, 2019 to the fundamental rights guaranteed in Chapter IV of CFRN, 2019, a further look at the provisions of the NDPR, 2019 tends to reinforce this position. In Article 1.2 relating to the scope of the Regulation, it is stated in paragraph (c) that "this Regulation shall not operate to deny any Nigerian or any natural person the privacy rights he is entitled to under the law, regulation, policy, contract for the time being in force in Nigeria or in any foreign jurisdiction." From the foregoing therefore, I have hesitation in holding that personal data protection as provided in the National Data Protection Regulations generally falls under the fundamental right to privacy which is guaranteed by Section 37 of the CFRN, 1999…”
Therefore, it will be plausible to argue that if section 37 is the fulcrum upon which the NDPR stands and section 37 only protects privacy of citizens of Nigeria, NDPR cannot be seen or heard to expand the scope of section 37 of the 1999 Constitution. In the case of Din v. Fed. A. G, (1988)4NWLR (PT87)147 the court held that subsidiary legislations derive their validity and authority from substantive laws. Also, in Shell (Nig) Exploration and Production Co Ltd v. NOSDRA (2021) LPELR-5306(CA) the court held that: “...A subsidiary legislation must be consistent with the principal legislation from which it derives its life otherwise such subsidiary legislation is a nullity to the extent of the inconsistency“
Flowing from the above, an extended and compelling argument is made here that NDPR does not apply to both tourists and to even non-Nigerians residing in Nigeria by extension.
Conclusion
NDPR by the application of NDPR scope does not cover personal data of tourists in Nigeria since tourist do not reside in Nigeria. Also, following the decision of the court in DRLI v NIMC cited above, the scope of NDPR does not apply to non-Nigerians residing in Nigeria. Regrettably, this will create a gap in the protection of personal data of tourists and non-Nigerians which will impact there fundamental rights and freedom. The legislature is enjoined to close this gap in the Data Protection Bill, 2020 pending before the legislature. But till then, tourists and non-Nigerians may rely on sectoral laws providing for protection of privacy and personal data such as the National Identity Management Commission Act, 2007, Freedom of Information Act, 2011, National Health Act, 2014, Central Bank of Nigeria Consumer Protection Framework, Credit Reporting Act, 2017 among others.
Article provided by INPLP member: Uche Val Obi SAN (Alliance Law Firm, Nigeria)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)