The National Information Technology Development Agency (NITDA), directed all Public Institutions holding or processing personal data to securely digitize all personal databases within 60 days.
Similarly, all public institutions have been asked to maintain the highest level of information security to guarantee confidentiality, integrity, availability and resilience of all databases within their control.
According to new directives from the NITDA contained in the Guideline for Management of Personal Data by Public Institutions in Nigeria, 2020 issued by Agency, all public institutions and any entity co-owned by the Government are required to process all personal data of Nigerians and Data Subjects in Nigeria in line with best practices and in conformity with the highest standards.
In a statement issued by the Head, Corporate Affairs and External Relations of NITDA, Mrs. Hadiza Umar, the guidelines are issued as supplementary regulation to the Nigeria Data Protection Regulation (NDPR), 2019.
NITDA said that the guidelines reinforce the implementation of the NDPR adding that all the principles and provisions of the NDPR remain valid and applicable to all Nigerians including public institutions.
While emphasizing the issue of trust in private data processing, NITDA noted “It takes cognisance of the fact that some public sector data processing may be founded on Vital or Public interest.
“This position of trust therefore requires public data controllers and processors to apply the highest ethical and professional standards in processing such data.”
The new guidelines also mandates the use of secure technology and automated processes for personal data by Public Institutions, in line with the requirements of the National Digital Economy Policy and Strategy, championed by Dr. Isa Pantami, the Minister of Communications and Digital Economy.
The statement described the NITDA’s issuance of a public-sector specific guidelines as another trailblazing effort made in consonance with the emerging global data regulatory models.
“NITDA recognizes the need for collaboration in some cases between the public and private sector to tackle emergencies or other state-led interventions for the benefit of citizens”, said the statement.
The guideline provides a strict framework for these types of collaborations to ensure that the privacy of Nigerians is not unduly infringed.
The COVID-19 pandemic, for example, has brought up the need for more personal data use to limit the spread of the virus.
The statement reads: “While we recognise the existence of constitutional limitations on privacy rights in the interest of public health and safety, yet such limitations must be based on defined frameworks. NITDA therefore implores all concerned parties to comply strictly with the requirements of these Guidelines and seek professional guidance from licensed Data Protection Compliance Organisations (DPCO) for the purpose of compliance.”
NITDA promised not to relent in its surveillance to ensure adequate compliance with the NDPR and these guidelines.
“The Agency shall not hesitate to invoke the punitive sanctions provided in the NITDA Act 2007 and NDPR in the event of breach or abuse of personal data of Nigerians” said the statement.