Distinguishing the right to data privacy from the ‘traditional’ right to privacy: A conceptual debate

Get Complete Project Material File(s) Now! »

Background

…data protection [data privacy] is also emerging as a distinct human right or fundamental right.1 Nigeria is a country that is making significant strides in terms of the access and usage of information and communication technology (ICT).2 This development, though laudable, poses significant challenges to human rights and fundamental freedoms.3 One such challenge is the incessant (and sometimes inadvertent) violation of the peoples’ right to data privacy. Recently in Nigeria, the activities of various entities with regard to the personal information of individuals, aided by advances in technology, amounted to a violation of data privacy.
Data privacy, basically, is the right of individuals to control the processing of their personal information so that it is used only for the purposes they desire.4 Processing, in this regard, includes various activities performed with regard to their personal information such as its collection, storage and dissemination.5 Indeed, the current ‘information revolution’6 has brought issues of data privacy into the limelight. Data privacy is so crucial today that it has dominated the policy agenda of many international human rights and economic institutions.7 It is, similarly, increasingly attracting the attention of policymakers, academics, national security agencies and legislators all around the world.8 In fact, there have, lately, been strong arguments in support of the fact that the sui generis right has ‘crystallized into a norm of customary international law.’9 Perhaps, this is the reason why Kuner observes that data-privacy- related issues are ‘destined to remain one of the most important regulatory and policy issues of the 21st century’.10 This shows that data privacy is a topic that is difficult to ignore at both national and international levels, especially given the so-called ‘information society’.
The importance of the subject, however, appears not to be appreciated sufficiently in Nigeria. Lately, developing countries like Nigeria are beginning to experience, first-hand, the myriad issues brought about by personal information. Firstly, personal data/information is now an extremely valuable commodity which has been aptly described as the lifeblood and basic currency of the information economy.11 This has made it increasingly sought by various entities without, in many cases, regard to the rights of the individuals who are the subject of the data. Secondly, there is a difficulty in comprehending the exact purpose or value of data privacy in African countries (in general) and Nigeria (in particular).12 According to Makulilo, data privacy in African countries is basically perceived as being confined to economic purposes, and this has been a driving force in enacting data privacy laws across Africa.
This is problematic from the perspective of human rights because an individual’s personal information is an embodiment of, or a facet of, his/her personality since it is capable of telling a story about him/her.14 Understood from this perspective, if our personal information is as good as ourselves in real terms, it ought, then, to be accorded the necessary human rights protection so that sufficient control can be exercised over its processing.15 Neethling’s view is apt in this regard, as he contends that: The threats to individuals brought about by the processing of their personal information (also referred to as the personal information or data processing problem)17 is usually discussed in relation to technological developments,18 although scholars, like Purtova, contend that this problem is also motivated by institutional, market and societal developments.19 Without a doubt, the on-going digitalisation of many African economies, especially that of Nigeria, makes this investigation focused largely on the effects of advances in technology on the data privacy of individuals.
This by no means, however, undermines other developments identified by Purtova. The internet and other ICTs are now inevitable tools in the lives of many people in Nigeria. This view is justified by the fact that Nigeria has one of the highest populations of internet users in the world.20 The Nigerian Minister for communication technology recently stated that the country had recorded a fifty two percent (52%) internet growth rate and a rapid increase in the ‘adoption and use of ICTs to automate some operations and processes of government Ministries, Departments and Agencies.’21 Similarly, Nigeria has recently been described ‘as [a] country with the highest potential for Information and Communication Technology investment on the African continent.’22 Nigeria today records a very heavy presence online in various e-commerce platforms such as online shopping and e-banking.23 In fact, it was recently reported that the country has an estimate of over two million US Dollar worth of e-commerce retail transactions weekly.24 Similarly, a number of governmental services are, in recent times, being offered online with e-government initiatives.
Both government and commercial services are increasingly rendered with the aid of personal information processing. This significant leap in the application of ICTs in Nigeria increases the availability and ease of the accessibility to personal information with consequences which are sometime dire for human rights and fundamental freedoms.26 The negative effects of the processing of individuals’ personal information sans significant legal protection are no longer in contention. Concerns have been widely expressed regarding these effects.27 Bennett, however, contends that the harm resulting from computerised data processing ‘is not immediately obvious.’28 Roos expresses the fear that personal information being processed may be: inaccurate, incomplete or irrelevant; accessed or disclosed without authorisation; used for purposes other than that for which they were collected or destroyed.29 In a more structured manner, Purtova, relying on Zarsky, analysed the concerns based on the various stages of data processing.30

Table of contents :

• Declaration of originality
• Dedication
• Acknowledgment
• Acronyms and abbreviations
• Abstract
• Table of contents
• Chapter one
  • General introduction
  • 1.1. Background
  • 1.2. Problem statement, objectives and justification of the study
    • 1.2.1. Problem statement
    • 1.2.2. Objectives and justification of the study
  • 1.3. Research questions
  • 1.4. Methodology of the study
  • 1.5. Scope and limitation of the study
  • 1.6. Clarification of terminologies
    • 1.6.1. Data privacy (protection)
    • 1.6.2. Personal data/information
    • 1.6.3. Lesson-drawing
  • 1.7. Literature review
  • 1.8. Structure of the thesis
• Chapter two
  • The emergence and development of the sui generis right to data privacy
  • 2.1. Introduction
  • 2.2. The significance of personal data in the information society
    • 2.2.1. Public sector
    • 2.2.2. Private sector
    • 2.2.3. Individuals or data subjects
  • 2.3. The nature of the challenges to data privacy in the information society
    • 2.3.1. Computers and databases
    • 2.3.2. Internet
    • 2.3.3. Surveillance technologies
    • 2.3.4. Cloud computing
  • 2.4. Historical development of the sui generis right to data privacy
    • 2.4.1. Development of the right to data privacy through national instruments
    • 2.4.2. Development of the right to data privacy through international instruments
    • 2.4.3. Development of the right to data privacy through regional instruments
    • 2.4.4. The influence of other international human rights instruments on the development
  • of the right to data privacy
  • 2.5. Data privacy as a human right or commercial issue?
  • 2.6. Distinguishing the right to data privacy from the ‘traditional’ right to privacy: A
  • conceptual debate
    • 2.6.1. Is the right to data privacy subsumed under the right to privacy?
    • 2.6.2. Problems and limitations in attempts to distinguish both rights
    • 2.6.3. The ‘added-value’ of the right to data privacy in the information society
  • 2.7. Approaches to data privacy protection
    • 2.7.1. Comprehensive approach or government regulatory approach
    • 2.7.2. Self-regulatory approach or industry/market approach
    • 2.7.3. Co-regulatory approach or hybrid approach
    • 2.7.4. Sectoral approach
    • 2.7.5. Privacy by design (PbD)
  • 2.8. Other mechanisms in data privacy protection: An appraisal of Lessig’s theory
    • 2.8.1. Law
    • 2.8.2. Norms
    • 2.8.3. Market
    • 2.8.4. Architecture/code
    • 2.8.5. Lessig’s central argument on effective regulation of personal information
  • processing
  • 2.9. Criticisms of the sui generis right to data privacy: An evaluation of the major arguments
    • 2.9.1. Data privacy has no significance if you have ‘nothing to hide’
    • 2.9.2. Too much focus on informational self-determination is unrealistic
    • 2.9.3. Data privacy negatively affects commerce and market
    • 2.9.4. Data privacy brings about misrepresentation and fraud
    • 2.9.5. Data privacy restricts freedom of information/speech
  • 2.10. Chapter conclusion
• Chapter three
  • The legal framework for the protection of data privacy in Nigeria: Issues and
  • challenges
  • 3.1. Introduction
  • 3.2. The Nigerian society in the digital age
  • 3.3. Contemporary issues on data processing in Nigeria: Challenges for the right to data
  • privacy
  • 3.3.1. Public data controllers
  • 3.3.2. Private data controllers
  • 3.4. The legal regime of data privacy in Nigeria: Issues and challenges
  • 3.4.1. Constitutional protection of data privacy in Nigeria
  • 3.4.2. Protection of data privacy in the African Charter on Human and Peoples’ Rights
  • (ACHPR)
  • 3.4.3. Common law protection of data privacy in Nigeria
  • 3.4.4. Analysis of the constitutional and common law protection of data privacy
  • 3.5. Legislative protection of data privacy in Nigeria (sectoral and other laws)
    • 3.5.1. Freedom of Information Act (FOIA)
    • 3.5.2. The National Health Act
    • 3.5.3. Statistics Act
    • 3.5.4. Cybercrime (Prevention, Prohibition etc) Act
    • 3.5.5. Analysis of the sectoral regime on data privacy protection
  • 3.6. Institutions relevant to data privacy protection in Nigeria: Issues and challenges
    • 3.6.1. Nigerian Communications Commission (NCC)
    • 3.6.2. National Information Technology Development Agency (NITDA)
    • 3.6.3. National Identity Management Commission (NIMC)
    • 3.6.4. Other Institutions
    • 3.6.5. The Courts
  • 3.7. Review of legislative efforts on data privacy protection in Nigeria: An analysis of the
  • challenges for effective protection of personal data
    • 3.7.1. Data Protection Bill
    • 3.7.2. A critique of the Data Protection Bill
    • 3.7.3. Personal Information and Data Protection Bill
    • 3.7.4. A critique of the Personal Information and Data Protection Bill
  • 3.8. Regional and sub-regional initiatives on the protection of data privacy and the extent of
  • influences in Nigeria
  • 3.8.1. African Union’s (AU) initiatives: African Union Convention on Cyber-security and
  • Personal Data Protection
  • 3.8.2. Influence of the AU Convention on Cyber-security and Personal Data Protection on
  • data privacy protection in Nigeria
  • 3.8.3. Economic Community of West African States’ (ECOWAS) initiatives
  • 3.8.4. Influence of the ECOWAS Supplementary Act on data privacy protection in Nigeria
  • 3.9. Impediments to adequate data privacy protection in Nigeria
    • 3.9.1. Legal framework for data privacy protection and related issues
    • 3.9.2. Lack of commitment by the Nigerian government
    • 3.9.3. Low level of awareness
    • 3.9.4. Technological backwardness and infrastructural deficits
    • 3.9.5. Poor human rights track record of Nigeria
    • 3.9.6. Data (privacy) protection and the African culture
    • 3.9.7. Security challenge
  • 3.10. Chapter conclusion
• Chapter four
  • An analysis of the legal framework for the protection of data privacy in Canada:
  • Lessons for Nigeria
  • 4.1. Introduction
  • 4.2. The nature and challenge of data processing in Canada: Any similarity with Nigeria?
  • 4.3. The conceptual basis and approach to data privacy protection in Canada
  • 4.4. The legal framework for data privacy in Canada
  • 4.4.1. Constitutional protection of data privacy
  • 4.4.2. Statutory protection of data privacy
  • 4.5. An analysis of the oversight and enforcement structure of data privacy laws in Canada
  • 4.5.1. The Canadian Privacy Commissioner: Nature, functions and role
  • 4.5.2. The role of the courts
  • 4.5.3. A critique of the enforcement and oversight structure
  • 4.6. Canada and international data privacy regimes: Extent of influences?
  • 4.7. The European Union Commission’s ‘adequacy’ finding on data (privacy) protection in
  • Canada
  • 4.8. Proposals for legislative reforms of data privacy laws in Canada
  • 4.9. Chapter conclusion: The art of lesson-drawing from Canada?
• Chapter five
  • An analysis of the legal framework for the protection of data privacy in South
  • Africa: Lessons for Nigeria
  • 5.1. Introduction
  • 5.2. The nature and challenge of data processing in South Africa: Any similarity with Nigeria?
  • 5.3. The conceptual basis and approach to data privacy protection in South Africa
  • 5.4. The legal framework for the protection of data privacy in South Africa
  • 5.4.1. Protection of data privacy under the South African Constitution
  • 5.4.2. Statutory protection of data privacy: The Protection of Personal Information Act
  • (POPIA)
  • 5.5. An analysis of the (proposed) oversight and enforcement structure of data privacy law in
  • South Africa
  • 5.5.1. The Information Regulator
  • 5.5.2 The Courts
  • 5.6. Insights from selected topic areas in the POPIA
    • 5.6.1. Direct marketing and unsolicited electronic communication (spam)
    • 5.6.2. Automated Decision Making/ Profiling
    • 5.6.3. The right to be forgotten or delete?
  • 5.7. General critique of the regime of POPIA: Prospects and challenges for effective realisation
  • of the right to data privacy in South Africa
  • 5.8. South Africa and international/regional data privacy regimes: Extent of influences?
• 5.9. Chapter conclusion: Lessons from an ‘African’ data privacy regime
• Chapter six
  • Prospects for improving data privacy regimes: A proposal for a ‘rights-based’
  • approach (in Nigeria)
  • 6.1. Introduction
  • 6.2. An analysis of a rights-based approach to data privacy protection
    • 6.2.1. An explanation of a rights-based approach
    • 6.2.2. The need for a rights-based approach to data privacy protection in African
    • countries
  • 6.2.3. Arguments against a rights-based approach to data privacy protection
  • 6.3. The role of the constitution (Bill of Rights) in data privacy protection
  • 6.4. Statutory protection of data privacy and the rights-based approach: Preliminary
  • considerations
  • 6.4.1. The law-making process
  • 6.4.2. Purposes/objectives of the law
  • 6.4.3. The scope of the law: An evaluation of Schwartz and Solove’s proposal and the
  • rights-based approach
  • 6.4.4. Exemptions and exclusions from the scope of the law
  • 6.5. The fair information principles (FIPs), rights of data subjects and the rights-based
  • approach
    • 6.5.1. Some preliminary comments on the FIPs
    • 6.5.2. Increasingly detailed and specific obligations on data controllers
    • 6.5.3. More subjective rights for data subjects
    • 6.5.4. ‘Reasonable’ obligation of data subjects
    • 6.5.5. Consent and rights-based approach to data privacy
  • 6.6. Data Protection Authorities (DPAs) as a vehicle for advancing a right-based approach to
  • data privacy protection
  • 6.7. Data privacy protection through non-legal mechanisms (‘new-technologies’): Applying
  • Lessig’s theory
    • 6.7.1. Relevance of the debates on regulation by technology to Nigeria
    • 6.7.2. Human rights-based arguments against regulation by technology
    • 6.7.3. Technology-neutral vs. technology-specific instruments/legislation
  • 6.8. The rights-based approach and data privacy issues in Nigeria: Some reflections
  • 6.9. Chapter conclusion
• Chapter seven
  • Summary, recommendations and conclusion
  • 7.1. Summary
  • 7.2. Recommendations
    • 7.2.1. The need for data privacy to be recognised as a human right and to be
    • constitutionally entrenched
    • 7.2.2. The need for an explicit ‘rights-based’ data privacy law
    • 7.2.3. The need for a dedicated and ‘independent’ data protection agency/authority
    • (DPA)
    • 7.2.4. The crucial role of other (human rights) institutions in Nigeria
    • 7.2.5. The need for active interaction between the data privacy regime in Nigeria and
    • international data privacy regimes
    • 7.2.6. The need to adopt and implement regional and sub-regional data privacy
    • instruments: Monist vs. dualist approaches
    • 7.2.7. The need for a proactive and ‘activist’ judicial system
    • 7.2.8. The need to improve the level of awareness on data privacy in Nigeria
    • 7.2.9. The need to boost scholarship and level of research on data privacy in Nigeria
  • 7.3. Conclusion

GET THE COMPLETE PROJECT
THE LEGAL PROTECTION OF DATA PRIVACY IN NIGERIA: LESSONS FROM CANADA AND SOUTH AFRICA