A day after the convocation ceremony of the class of 2022 at the University of Ilorin, the fresh graduates woke up to a text message from the senator representing Kwara Central Senatorial District, Saliu Mustapha, popularly called Turaki, congratulating them on the occasion of their convocation.

The text read: “Dear *******, I congratulate you on your graduation from the prestigious University of Ilorin, I know the future holds even bigger promises for you, and I am excited to celebrate many more milestones with you as you move up the social ladder! With thr compliments of Sen. Saliu Mustapha (Kwara Central“.

Although this seemed like a kind gesture, it revealed the loophole that exists in data privacy and protection in Nigeria.

Nneka (not real name), one of the graduates who received the text message, told FIJ she first thought it was a troll when she received the message, only to realise the message was from the senator when she read through.

“My thought was, how did he get my contact? How did he know I was graduating? Upon further observation, I discovered it was a politician and immediately ignored the message because I felt it was just another weak political stunt to gain points as a politician and garner support for future political aspirations,” said Nneka.

Another graduate, Davida (not real name), told FIJ she assumed it was the school that gave out her information to the senator and was pissed at them for doing so.

“When I got the congratulatory texts in October 2023 at exactly 9:12 am and I saw it was from Turaki, I questioned how he got my contact until I later figured it was a general message sent to all graduating students,” Davida told FIJ.

READ ALSO: ‘Sell Your Bus to Raise Ransom’ — Kidnappers Advise Abuja Resident After Taking His Daughters

According to Samuel Ngwu, a tech lawyer with knowledge on issues bordering on data protection and privacy, this is a case of data mishandling and a violation of the students’ fundamental rights.

Data privacy, according to Cloudian, refers to the strategic and procedural steps undertaken to safeguard the privacy, availability and integrity of sensitive data.

Nigeria has a data protection law called the Nigeria Data Protection Act, which was signed into law by Nigeria’s President Bola Tinubu in 2023 to serve as Nigeria’s legal framework for the protection of personal information.

Despite this existing legislation, issues like data mishandling or the release of personal information of data subjects to third parties, as in the case of graduates of the University of Ilorin receiving text messages from the senator representing Kwara Central, still exist.

FIJ contacted the director of the university’s computer services to inquire if they were aware the university’s graduates received text messages from Turaki a day after their convocation in 2023 and ask if the university released the information about the graduates to the senator. He said the university was unaware of this.

“I can tell you authoritatively that we do not know of such. It is not officially from the university. There is no way the University of Ilorin can give data to any politician,” he said.

SAME WINE, DIFFERENT SKINS

An X user, @ipgieajike, narrated on the social media platform how a staff of the CBT centre who took her 15-year-old daughter to register for the Unified Tertiary Matriculation Examination (UTME) chatted with her after she took her daughter there to get registered.

She used her phone number to set up a profile for her child, and a staff took her number from the system, thinking it belonged to her child and began sending her unsolicited messages on WhatsApp. She wrote:

“Lol. This guy is committing so many criminal offences at once; it’s crazy. He’s still chatting with me. He says he got her number from the system after she registered and left cos he couldn’t help himself. JAMB where are my daughter’s data protection rights?”

Violating her data protection and privacy rights was not the only crime the man, who claimed to be 22 years old, committed. His conversations with her had a sexual undertone.

READ ALSO: Data: Nigeria Falls Behind S/Africa, Ghana, 13 Other African Countries in Solar Energy Production

After JAMB’s investigations, the man who took her number from the system and the man who registered her daughter were both arrested by the police.

WHY THESE ISSUES PERSIST

According to Ngwu, these issues persist for a variety of reasons. The lawyer described data protection as a novel concept that individuals and entities in Nigeria are still trying to understand.

“Most persons do not understand that they have data protection rights, some of which entitle them to take legal action against companies or even petition the National Data Protection Commission (NDPC). Entities are also having issues adjusting to the demands of data protection,” said Ngwu.

“There is also the cultural aspect. Data protection has never been an aspect of our culture. So, it is a bit difficult adapting to the new normal,” he added.

He also attributed this problem to the lack of adequate data protection experts who will properly guide companies on the right path to data protection compliance.

The lawyer also told FIJ that experts had raised issues regarding the enforcement of data protection compliance. “The regulator is understaffed and do not have the bandwidth to hold entities accountable.”

“In summary, a lack of awareness, a paradigm shift in culture, a lack of experts and enforcement are some of the reasons for numerous infringements of data subjects’ rights and provisions of data protection.”

A WAY OUT

Data mishandling does have far-reaching consequences and could put data subjects in danger. It also breeds mistrust between data subjects and entities. Like every societal vice, there is a way out of this problem.

According to a data protection and privacy enthusiast, Olawuyi Raheemah, there is not so much that data subjects can do. “We cannot refuse to give out our personal information to entities such as schools, banks, workplaces and other entities,” said Olawuyi.

“We just have to intensify our efforts. I am sure there are schools who have not heard of data protection, have never heard about how they should handle data and have not realised the repercussions of their mishandling of people’s personal information.

She told FIJ that the way out is to continue to educate and inform people about what data protection is and why it is important.

“As time goes on and more awareness is raised, more companies will fall into line, and as punishment is met out to offenders. This is not only to punish people for doing wrong but also to deter others from acting against the provisions of the act.”

In addition to these, Ngwu, the tech lawyer, proffered strict enforcement of the provisions of the law and collaboration between regulators and stakeholders as a means of curbing data mishandling.