Nigeria Takes on AI: New Data Protection Laws on the Horizon

The Nigeria Data Protection Commission (NDPC) has announced plans to implement crucial adjustments to the Nigeria Data Protection Act (NDPA) 2023. This strategic review aims to specifically address the rapid advancements in emerging technologies, including artificial intelligence (AI), robotics, and advanced computing. The announcement, made by Dr. Vincent Olatunji, the National Commissioner of NDPC, on Friday in Abuja, coincided with the three-year commemoration of the NDPA's enactment, which was signed into law by President Bola Tinubu on June 12, 2023.

The original NDPA 2023 established a comprehensive legal framework designed to safeguard the personal information of individuals residing or conducting business within Nigeria. It also officially mandated the NDPC as an independent regulatory body tasked with overseeing data privacy matters. However, Dr. Olatunji highlighted the pressing need for this review, explaining that significant technological shifts since the Act's inception have rendered some of its provisions outdated and in urgent need of an update.

"We are in the era of emerging technologies. At that time, we could only make general references to emerging technologies, but today we can specifically mention Artificial Intelligence, robotics and big data," Olatunji stated. He further elaborated that during the initial drafting of the Act, the technological ecosystem was less advanced, which precluded specific considerations for these now prevalent technologies, leading to a broader, more general legal text. "Ten years ago, nobody was talking about AI the way we are now, but today it has become central to virtually every aspect of digital transformation. We need to be more specific about what constitutes emerging technologies and provide examples because the technologies keep evolving,” he added.

Moving forward, the NDPC aims for the revised Act to transition from vague references to concrete, actionable provisions regarding emerging technologies. This focused approach is essential to align the NDPA with Nigeria's ambitious goals for an all-encompassing digital economy. Olatunji also underscored that digital footprints and other privacy-related contexts demand continuous regulatory attention and review to effectively keep pace with the dynamic nature of technological advancements.

Beyond its role in establishing data regulation and usage, the NDPA 2023 also repealed and replaced the older Nigeria Data Protection Regulations (NDPR) of 2019. In the context of integrating AI into the Act, Dr. Olatunji firmly emphasized the indispensable role of human oversight. He stressed that human control must remain central to the deployment and operation of AI systems, cautioning against delegating all responsibilities to artificial intelligence.

Looking ahead, the NDPC boss projected significant growth for Nigeria's data privacy ecosystem over the next five years. He explained that the commission is diligently cultivating a robust culture of privacy, which in turn is attracting international investors by positioning Nigeria as a reliable and ready destination for digital business. Olatunji proudly noted that Nigeria’s commitment to conducting regular reviews of its data protection laws distinguishes it from many other countries still operating under frameworks signed over a decade ago. "I see growth, development, awareness and greater trust in the ecosystem. Compliance will become a necessity rather than an option. The rights, freedoms and interests of Nigerians and legal residents will be adequately protected,” he concluded, reiterating the commission's pledge to periodically review the NDPA to prevent its obsolescence amidst rapidly emerging digital technologies.