Nigeria’s weak data protection guardrails may undermine the recent directive by Central Bank of Nigeria (CBN) to banks, fintech firms, and other payment service providers to store payment transaction data generated within the country local servers.
CBN said that the new rule will start from January 1, 2027, as part of new measures to strengthen oversight of the fast-growing digital payments ecosystem.
This will also provide the country greater control over critical data infrastructure, allowing authorities to easily access records, conduct audits, enforce compliance, and investigate, especially in cases where criminal offenses are involved, reducing delays often caused by intermediation between local and foreign entities.
Apart from data sovereignty, the CBN added that moving transaction records from foreign servers will help drive investments in local data centers and cloud storage capacity.
Though reliable estimates are hard to come by, it is believed that Nigeria loses over N60 billion in hosting data in foreign servers.
But a coalition of civil society organizations (CSOs), has raised concerns over safety measures in place to protect data of Nigerians, despite having data protection laws in place.
The coalition, comprising Media Rights Agenda, Paradigm Initiative, Digital Rights Lawyers Initiative, and Accountability Lab Nigeria, among others, released the “Protected From the State, Not By It: Nigeria’s Data Protection Crisis Is a Crisis of Implementation,” where they criticized regulators’ failure to effectively enforce data protection laws, which led to rising cases of digital fraud and rampant illegal sale of sensitive information.
There have been leaks of sensitive voter, financial, and personal records.
For instance, there was alleged unauthorized access to the Continuous Voter Registration (CVR) database of the Independent National Electoral Commission (INEC) during a nationwide CVR exercise.
INEC earlier released the preliminary findings of its investigation into the matter, saying that it found no external breach of its systems and that the personal information of over 90 million registered voters was not compromised.
Despite this, CSOs argued that the incident underscored the lack of oversight, adding that it showed that while data privacy laws are in place, sensitive information can be easily moved from a secure government database and into the hands of private political entities.
The coalition also pointed out regulators’ failure to conduct human rights impact assessments on public surveillance systems before related programs were deployed, urging the government to act on these issues by subjecting public institutions to the same compliance requirements as private organizations.
“This is the asymmetry at the heart of the crisis: citizens are under-protected from data abuse and over-exposed to state monitoring and punishment,” the CSOs stated.
Additional report by coingeek
