Authored By: Lawson Boladuro Joan
Lead City University
ABSTRACT
The enactment of the Nigeria Data Protection Act 2023 (NDPA) marks a significant development in the country’s approach to personal data protection, replacing the earlier Nigerian Data Protection Regulation (NDPR) 2019. Among the rights granted to data subjects, the right to rectification stands out as crucial for ensuring personal data accuracy and privacy. This article explores the scope, challenges, and enforcement of the right to rectification under the NDPA, drawing comparisons with international standards such as the EU’s General Data Protection Regulation (GDPR), and suggests reforms for effective implementation.
INTRODUCTION
The Nigeria Data Protection Act 2023[1]represents a critical turning point by providing a more comprehensive legal framework for safeguarding personal data. Among its key features is the right to rectification, allowing data subjects to require correction or deletion of inaccurate or incomplete personal data. This right is essential to uphold data accuracy and protect individuals from harm caused by erroneous information.
OVERVIEW OF THE RIGHT TO RECTIFICATION UNDER THE NIGERIAN DATA PROTECTION ACT
The NDPA, passed into law on 12 June 2023, is Nigeria’s first primary data protection legislation. Part VI of the Act[2] outlines the rights of data subjects, including the right to rectification.
The principle of data accuracy underpins this right, mandating data controllers and processors to ensure personal data are accurate and updated.[3]
This aligns with international norms, notably the GDPR. Under the NDPA, rectification extends beyond correcting factual errors to ensuring data completeness. If correction may not be feasible, inaccurate data must be erased to prevent retention of misleading personal records.[4]
SCOPE AND NATURE OF RECTIFIABLE DATA
The NDPA ensures that rectification is not restricted to obvious factual errors but covers a broad spectrum of personal data types. This includes names, dates of birth, contact information, identification details, and employment records. Additionally, opinions[5], comments, or descriptions about a data subject held by controllers may be rectified if they misrepresent or harm the individual’s reputation or decision-making.
LEGAL PRECEDENTS
Judicial interpretation of the right to rectification[6] in Nigeria is still developing.
However, landmark cases like Digital Rights Lawyers Initiative v National Identity Management Commission affirmed that rectification requests should generally be processing free of charge unless deemed excessive.
For example, in Khelili v Switzerland,[7]the misrecording of an applicant’s occupation was successfully challenged due to reputational harm.
Similarly, the right to rectification was interpreted in B.B v France [8] concerning gender recognition, where refusal to amend personal data violated rights under the European Convention on Human Rights.
CHALLENGES IN IMPLEMENTATION
Despite the strong legal framework, the NDPA[9] faces challenges in enforcing the right to rectification. Key issues include a lack of clear procedural guidelines and timelines, and limited awareness among data subjects, especially in rural areas.Moreover, judicial expertise in data protection law remains limited thereby causing slow and uneven rulings.
CONCLUSION AND RECOMMENDATIONS
The right to rectification under the NDPA is vital to protecting personal data accuracy and privacy in Nigeria. Strengthening procedural clarity, raising awareness, enhancing enforcement mechanisms, and judicial capacity building are necessary to realize the right’s full potential.
BIBLIOGRAPHY
Olumide, B,Casebook on Data Protection (Noetico Repertum Inc. 2020).
[1] Nigeria Data Protection Act 2023.
[2] Ibid, s 34–38.
[3] Nigeria Data Protection Act 2023, s15(2)(e).
[4] Nigeria Data Protection Act, s 34(1)(d).
[5] Peter Nowak v Data Protection Commissioner [2017] (Case C-434/16) where the court ruled that an examination candidate has a right to request the rectification or erasure of examination information, but only in specific circumstances.
[6] [2021] LPELR-55623(CA)
[7] (2011) ECHR 195 (18 October 2011)
[8] Olumide Babalola, Casebook on Data Protection (1st edn, Noetico Repertum Inc. 2020).
[9] Nigeria Data Protection Act 2023.
