The National
Information Technology Development Agency (NITDA) has alerted Nigerians on implications
of the soon to be implemented European Union’s General Data Protection Regulation
(GDPR), reports ITRealms.
According to the Director
General/CEO, NITDA, Dr Isa Ali Ibrahim Pantami, they would like to bring to the
attention of Nigerian businesses, especially those that collect, store and
process personal data of European Union (EU) citizens for the provision of
goods and services, and the general public, the implications of the new EU
General Data Protection Regulation (GDPR).
He noted that the regulation adopted on 27
April 2016 and which becomes enforceable from 25 May 2018 “is replacing the
data protection directive of 1995. It applies whether the data controller - an
organization that collects data from EU residents or processor - an organization
that processes data on behalf of data controller such as data centres or the
data subject – the person whose personal data has been collected is based
within or outside any EU member state, if they collect or process personal data
of EU citizens and residents.
“The Agency has realized that this regulation
might have huge impact on Nigerian businesses and/or individuals that use
Information Technologies to collect, store, process and transact on EU citizens
personal data in EU territory or elsewhere. It is in the utmost interest of the
Agency to protect Nigerian businesses from unnecessary exposure to the risks of
this regulation and/or any regulations that might have negative impact on their
businesses as well as the rights of Nigerians that have dual citizenship of any
EU member state.
“NITDA therefore calls on Nigerian
organisations that are controllers and processors of personal data of EU
nationals to note that companies that meet the following criteria must comply:
•
have offices in an EU member state;
•
have no offices in any EU member state but processes
personal data of EU nationals and residents;
•
have more than 250 employees; and
•
have fewer than 250 employees but its data processing
impacts the rights and freedoms of data subjects or occasionally includes
certain types of sensitive personal data.
“The regulation requires that data controllers
and processors must seek consent from data subjects in an intelligible and
easily accessible form, clearly specifying the purpose for the collection. It
also stipulates that consent must be clear and distinguishable from other
matters and presented in a clear and plain language.
“A breach of the regulation can attract a
fine of up to 4% of a company’s annual global turnover or an equivalent of
twenty million euros (€20 million). Furthermore, companies can be fined up to 2
per cent for not having their records in order, not notifying the supervising
authority and data subject about a breach or not conducting impact assessment.
“The regulation also gives data subjects the
right to obtain from the data controller confirmation as to whether or not
personal data concerning them is being processed, where and for what purpose.
They also have the right to transmit data they had previously provided to
another controller. Furthermore, they are entitled to have the data controller
erase their personal data, cease further dissemination of the data, and
potentially have third parties halt processing of the data,” he said.
Therefore, he also said, NITDA is calling on
Nigerian businesses, especially those carrying out online transactions and meet
the GDPR compliance criteria to put in place appropriate measures to observe
the provisions of this regulation to avoid being sanctioned for a liable
breach.
“Organisations are also required to note the
provisions of the NITDA Guidelines on Data Protection, issued in 2013 and
currently being revised. In an effort to make the agency’s rule making process
transparent and industry-focused, the revised guideline will soon be presented
for stakeholder consultation as stipulated in the Rulemaking Process Regulation
of NITDA,” he said.
Uboshe Uboshe & Doris Minimah/GEE
No comments:
Post a Comment