Nigeria Data Protection Act 2023: Relevant Provisions For Health Care Delivery In Nigeria – Data Protection

1. Introduction

The Nigeria Data Protection Act 2023 (NDPA) was signed into law
in Nigeria. The Act provides for the protection of personal data.
It is the first law enacted to address specifically the protection
of personal data in Nigeria after repeated attempts by past
administrations to enact legislation on data protection. These
attempts led to the issuance of the Nigeria Data Protection
Regulations 2019 by the National Information Technology Development
Agency. Although only subsidiary legislation, the Nigeria Data
Protection Regulations laid the basic foundation for protecting
personal data in an era where protecting personal data has become
more critical.

The Nigeria Data Protection Act seeks to ensure uniformity in
the processing of personal data, while also safeguarding the
fundamental human rights, freedoms, and interests of data subjects
as provided for under the 1999 Constitution, and providing remedies
for breach of data.¹

The Act has implications for different sectors of the economy.
One key sector to consider is the health sector. The health sector
is composed of myriad actors who deal with a variety of data, such
as collectors and processors. These include public and private
hospitals, pharmacies, laboratories, public health insurance
schemes, health maintenance organisations, and clinical research
organisations. It also includes government agencies such as the
National Public Health Institute or surveillance agencies working
as part of the government, health regulatory bodies, and
professional health regulatory agencies. Furthermore, it includes
digital healthcare businesses providing electronic medical records
(EMR) solutions, telemedicine virtual consulting platforms, and
other services. Each of these entities has many opportunities for
collection, use, processing, and storage of data. Each of these has
obligations with respect to the protection of personal data. It is
therefore critical to identify and understand the implications of
the Acton the operations of these actors. This will not only help
clarify roles and responsibilities but ultimately improve health
outcomes while protecting patient/user information.

2. Overview of the Nigeria Data Protection
Act

Interestingly, the Nigeria Data Protection Act does not repeal
the Nigeria Data Protection Regulation 2019 (NDPR). Section 64
(2)(f) provides an avenue for the continuing existence of the NDPR,
expressly providing that all regulations, rules, etc, made by the
Nigeria Information Technology Agency or the Nigeria Data
Protection Bureau on data protection continue to remain in effect
until they have been repealed. Though the Nigeria Data Protection
Regulations 2019 remain in force, where there are inconsistencies
between the provisions of the Act and the Regulations, the Act
shall take precedence.² This goes without saying that
provisions of the NDPR that are not inconsistent with the
provisions of the Act remain applicable and
enforceable.³

The Act also makes provisions relating to the processing of
personal data, principles of processing personal data, rights of
data subjects,⁴ the appointment of data protection
officers ⁵, and data privacy impact assessment in cases
where the processing of personal data will likely result in a
breach of personal data of data subjects, etc.⁶ Data
controllers/ processors are required to establish a lawful basis
for processing personal data, some of the lawful bases provided by
the Act include: When the data subject has given and not withdrawn
consent, For compliance with a legal obligation to which a data
controller/processor is subject,⁷ For the performance of
a task carried out in the public interest.⁸ Data
controllers/processors are also required to process personal data
following laid down principles for processing personal data, some
of these include the requirement that: The data must be processed
in a fair, lawful transparent manner; The data collected must be
for a legitimate purpose, and should not be processed in any manner
incompatible to that purpose; The processing of the data must be
adequate, relevant and limited to the minimum necessary,
etc⁹

3. Selected Relevant Provisions of the NDPA on
Health

The Act makes specific provisions for personal data processing
in relation to public health and health care. We set out some of
these provisions below.

i. Exemption from obligations under Part (V) of the
Act, of Data Processed During Pubic Health Emergencies by Competent
Authorities.

The NDPA provides for certain exemptions from the lawful basis
governing the processing of data. Key amongst them is data
processed by competent authorities for the purpose of prevention or
control of national public health emergencies,¹⁰ such as
the COVID-19 pandemic, or the epidemics of Lassa Fever and Cholera
faced almost yearly in Nigeria. The competent authority is defined
under the interpretation section to mean “Government of the
Federal Republic of Nigeria or any Foreign Government, or any State
government, statutory authority, government authority, institution,
agency, department, board, commission, or organization within or
outside Nigeria exercising either executive, legislative, judicial,
investigative, regulatory, or administrative
functions.”¹¹ This would include agencies such as
the Nigeria Centre for Disease Control and Prevention which, in the
exercise of its mandate and under the provisions of the Act, can
lawfully process data free from certain obligations under Part V of
the Act. Some of the obligations exempted include; The burden of
proof placed on data controllers when there is a question, as
regards whether consent was freely or intentionally
given,¹² The requirement to undertake a data privacy
impact assessment, where the processing of personal data will
likely result in a high risk to the rights and freedom of data
subject,¹³ The requirement to obtain consent from a
parent or legal guardian of children under the age of 18
years,¹⁴ The right of data subject.¹⁵

Processing of personal data by competent authorities in times of
public health emergencies is however subject to certain
restrictions, which the competent authority must comply with. These
include; Section 24 which deals with (Principles of Personal Data
Processing), Section 25 which deals with (Lawful Basics of Personal
Data Processing), Section 32 which deals with (Data Protection
Officers)and Section 40 which deals with (Personal Data Breaches).
These sections will apply to the processing of personal data by
competent authorities. For example, a lawful basis for processing
personal data must be established. Such lawful basis for processing
personal data during public health emergencies may include grounds
of public interest. The competent authority is also required to
appoint a data protection officer, and in line with section 40
report any personal data breaches to the Commission within 72 hours
of becoming aware of the breach.

ii. The requirement For Registration of Data
Controllers of Major importance

The Act introduces a certain class of data controllers and data
processors different from normal data controllers (DC) and data
processors (DP) named “Data Controllers of Major Importance
and Data Processors of Major Importance”¹⁶ (DCMIs
and DPMIs). The DCMIs and DPMIs are required to register with the
Commission¹⁷ and are subject to stricter fines than
those imposed on regular DCs and DPs. DCMIs and DPMIs are subject
to a fine of over10,000,000 or 2% of their annual gross revenue in
the preceding financial year, whichever is higher,¹⁸
while DCs and DPs are subject to a fine of over 2,000,000or 2% of
their annual gross revenue in the preceding financial year,
whichever is higher.¹⁹ The fine kicks in when they are
adjudged by the Commission to have violated the Act or any
subsidiary legislation. Regulations fall under subsidiary
legislation which data controllers and data processors should avoid
breaching.

Data Controllers of Major Importance and Data Processors of
Major Importance are not fully defined, with the Act creating room
for the Commission to do so by regulation.²⁰ The
Commission in February 2024, clarified who constitutes ‘data
controllers of major importance and data processors of major
importance through a Guidance Notice. According to the Guidance
Notice,²¹ a data controller or data controller will be
deemed to be of major importance if it (a) processes the personal
data of more than 200 (Two- Hundred) data subjects within the span
of six months, or (b) carries out ICT services through the use of
any digital device having storage capacity, and belonging to
another individual, or (c) processes personal data either as an
organization or a service provider in the Financial, Communication,
Health, Education, Insurance, Export sectors etc.²² Data
Controllers or Processors who are under a fiduciary duty with a
data subject for which the duty of keeping confidential information
is crucial are also regarded as Data Controllers or Processors of
Major Importance.²³

Reviewing the Guidance Notice, it seems fairly clear that most
if not all healthcare stakeholders are likely to fall under data
controllers of major importance (DCMIs) or data processors of major
importance (DPMIs). At any rate, the majority of healthcare
stakeholders will fall under (c) as organizations or service
providers in the health sector who process personal data.
Healthcare providers like telehealth companies, digital health
businesses, hospitals, and other stakeholders like health insurance
companies, among other healthcare entities, are required to
register as DCMIs or DPMIs.²⁴

Furthermore, the Guidance provides for registration by DCMIs and
DPMIs, and to aid the registration process, classifies DCMIs and
DPMIs into three categories ²⁵ namely: Major Data
Processing Ultra Level (MDP-UHL), Major Data Processing- Extra High
Level (MDP-EHL), Major Data Processing-Ordinary High Level
(MDPOHL). Insurance companies which will include health insurance
companies may be classified as Major Data Processing Ultra High
Level (MDP-UHL) and are required to pay a non-refundable fee of
N250,000 (Two Hundred and Fifty Thousand Naira) for
registration.²⁶ The Ministry of Health as a ministry of
the government, hospitals providing tertiary or secondary medical
services are classified as Major Data Processing-Extra High Level
(MDP-EHL) and are required to pay a nonrefundable fee of N100,000
(One Hundred Thousand) for registration.²⁷

Primary Health Centres are classified as Major Data Processing
-Ordinary High Level (MDP-OHL) and are required to pay a
non-refundable fee of N10,000 (Ten Thousand Naira) for
registration.²⁸ DCMI’s and DPMI’s in line with
section 44(1) of the Act²⁹and the guidance notice are
required to register on or before the 30th of June
2024³⁰ failing which shall be deemed a default under the
Act and liable to a penalty stipulated under the Act. ³¹
The penalties have been highlighted in this Article.

To view the full article please click
here.

Footnotes

1 Section 1 of the NDPA.

2 Section 63 of the NDPA

3 The provisions of the NDPR as it relates to the
qualities of a DPO (though not mandatory) remains
applicable

4 Section 34-38 of the NDPA

5 Section 32 of the NDPA

6 Section 28 of the NDPA

7 Court Order, for instance can fall under this
ground

8 Section 25 of the NDPA

9 Section 24 of the NDPA

10 Section 3(2)b of the NDPA

11 Section 65 of the NDPA

12 Section 26 of the NDPA

13 Section 28 of the NDPA

14 Section 31 of the NDPA

15 Section 34-38 of the NDPA

16 Section 44(1) of the NDPA

17 The Act requires the DCMIs and DPMIs to register with
the Commission within 6 months after the commencement of the Act or
on becoming a data controller of major importance or processor of
major importance

18 Section 48(3)(a) and (4) of the NDPA

19 Section 48 3(b) and (5) of the NDPAi

20 The Act defines data controller or data processors of
major importance to be ” data controller or data processors of
major importance domiciled, resident in, or operating in Nigeria
and processes or intends to process personal data of more than such
number of data subjects who are within Nigeria, as the Commission
may prescribe, or such other classes of data controllers or data
processors that is processing personal data of particular value or
significance to the economy, society or security of Nigeria as the
Commission may designate”. See Section 65 of the
Act

21 paragraph 1 of the Guidance Notice

22 https://ndpc.gov.ng/Files/registration.pdf

23 ibid Nigeria

24 ibid

25 Paragraph 2 of the Guidance Notice

26 Paragraph 3(1)(a) of the Guidance Notice

27 Paragraph 3(1)(c) of the Guidance Notice

28 Paragraph 3(1)(e) of the Guidance Notice

29 Act requires DCMI’s and DMPI’s to register
within 6 months of the commencement of the Act or within
6

months of becoming a DCMIs or DPMis

30 Paragraph 3(2) of the Guidance Notice

31 Paragraph 3(3) of the Guidance Notice

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.