NINAS NEWS Edwin Tech  

Yes, You Have Rights Over Your Data, But Only To An Extent • Techpoint Africa – Techpoint Africa

Privacy Roundtable
by | Oct 21, 2021
Share this article:
Scrolling through Twitter a few days ago, something caught my eye. It started a chain of reactions culminating in a midnight call and a new story idea for this month’s Privacy Roundtable.
On Friday, October 15, 2021, we sent out a tweet asking readers to fill a form for a story on why they do not care about privacy. As you might have already guessed, today’s article has gone off on a tangent. And for this, I apologise to everyone. We will talk about it in next month’s edition.
While you are here, please populate the form with your answers.
For today’s story, our focus would be on data privacy rights and possible exceptions. I paint a picture in the following paragraphs that guides this article’s narrative.  

Advertisement

googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-1622540237923-0’); });

Ada is a 24-year-old graduate with a theatre arts degree. If there’s one thing she loves, it’s talking to her friends on the phone. She could spend the whole day doing that. Perhaps, that’s why she’s unemployed. 
A few days ago, she saw a trending post on Twitter about this new fintech app that allows you to send money as airtime to anyone with a tag. Expectedly, she jumped on the train because she always needs airtime since she spends all day talking on the phone.
Like most of us, without reading the terms and conditions or the company’s privacy policy, Ada downloads and installs the app and chooses the tag ‘adda’. Of course, she immediately sends this to her friends and asks them to download the app so they can send her airtime anytime.
Today, though, Ada has a problem. While trying to send her airtime, her friend mistakenly sent it to a user with a similar but slightly different tag; this user has an underscore (_) at the end of theirs.
Ada is distraught and decides she wants to change her tag to something unique but still identifiable by her friends. She goes on the app and tries to change her tag but is told she cannot. Now, she’s angry. Why can’t she change her tag? It’s hers, after all.
Under the Nigeria Data Protection Regulation 2019, a data subject has several rights over the use of their personal data. These include the right to transparent information relating to the processing of data and prior information before data processing.
It also includes the right to erasure, rectification and restriction of data, and the right to move your data to another platform, among several others. 
Ada has the right to know extensively how her personal information is being handled and when it is handled. She can also choose to delete, correct, or restrict access to that data. If she wishes to move her personal information on that particular app to another with similar functions, she can do that too.

Advertisement

googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-1622575703072-0’); });

But it’s not as cut and dried as this, and this brings me to the idea behind this story.
A Twitter thread caught my eye two days ago; it went something like this,
“You can’t change your Abeg tag or your name on the Abeg App. You can’t also delete your account on the app. 
“This is in breach of the Nigerian Data Protection Regulations which protects the right of a data subject to rectification and erasure of their personal data.”
You can't change your Abeg tag or your name on the Abeg App. You can't also delete your account on the app.

This is in breach of the Nigerian Data Protection Regulations which protects the right of a data subject to rectification and erasure of their personal data.
This Twitter user, a lawyer with the handle, @Oluwanonso_Esq, then proceeded to share a screenshot of the conversation between him and an Abeg Customer Service Agent, Lù, on the startup’s Instagram account. 
Lù told him that he could not change his Abeg tag.
Two questions come to mind. Is this usual with fintechs? Is there truly a problem here?
I currently have several fintech apps on my phone. So, I decided to do a little investigation using the ones I could access.
Using Roqqu, Cowrywise, Risevest, Piggyvest, Accrue, and Barter as case studies, I tried to find answers.
To better understand if this was indeed a problem, I spoke with Nigerian lawyer, Motunrayo Ope-Ogunseitan, to get a general idea of possible defences in a similar scenario.
She said there might be different reasons why a company would not allow an individual to change their data on its platform. The first is what she called the “Startup Syndrome.” This means the company is probably not paying attention to complying with the NDPR and is basically trying to get going as soon as possible.
The other reason she gave was that there might be a legitimate defence to such an action. Why? All laws have exceptions. A good example is the right to freedom of movement as contained in the Nigerian Constitution and the abrogation of that right in a state of emergency or when a crime is committed.
“My best bet would probably be that such companies would say, ‘Oh, we cannot allow you to frequently go on the app and delete your personal data or amend it because it may compromise the interests of other people.’”
But she also said this defence would need to be looked at on a case by case basis as all companies might not be able to rely on the same defence.
“The idea of the startup app might be philanthropic, to give or provide for people who are in need. So imagine a situation where I get some money, I change my profile details, and I enter another giveaway and keep amassing a lot of money when the money is actually supposed to reach as many people as possible.
“Or a scenario where someone credits my verified account with a huge sum of money to assist with sharing it and I just delete my account or deactivate and go offline. Given the nature of the app, considering the fact that it’s largely a financial platform, you shouldn’t just allow people to modify their data. There’s a higher standard of care involved.”
But she advised companies to communicate these decisions to users.
Another thing she referred to is the golden rule of interpretation in law. This rule states that a law could be interpreted to show the spirit or the intent of the law rather than a literal interpretation.
“In as much as it provides for these rights, they don’t necessarily tell the companies how to achieve it. The laws don’t say the right to rectification of data by the data subject must be done on the platform by the individual, or it must be achieved immediately. 
“As a platform provider, I can say, ‘Oh yes, you have a right, but you just can’t do it yourself and randomly.’ And that’s why a lot of companies just say, ‘You have a right to delete your data, amend your data. To exercise any of these rights, please contact us by email.’ They won’t necessarily allow you to just do it directly on the platform.”
Essentially, while the right still exists, it cannot be exercised haphazardly.
The NDPR provides for situations that might be regarded as the lawful processing of a data subject’s data. Article 2.2 of the Regulations says at least one of the following must have occurred:
Like we explained here, a data controller is any person, organisation, or body that receives and controls an individual’s data. The data controller determines the purpose and means of data processing. 
Combining Motunrayo’s words and the provisions of the NDPR, if the company provides a way to ensure the right is exercised or falls under the exceptions listed in Article 2.2, the data subject’s rights have not been tampered with.
Using Ada’s scenario, if the startup has an option to contact the company’s support person for help to rectify her tag, then her rights as a data subject are still being protected.
Or you could think of it this way. Facebook only allows you to change your name once every 90 days. While you still have the right to rectify your data, it just takes longer.
Yesterday, October 20, 2021, Abeg replied to @Oluwanonso_Esq’s tweet.
“Hi Nonso, thank you for stating your concerns, however, it is possible to change your Abeg tag and delete your Abeg account by contacting our support team at hello@abeg.app.
“These measures were put in place for security reasons for the initial rollout.
“We’re making some adjustments and all users will be able to deactivate and change their names without having to reach customer service.”
Hi Nonso, thank you for stating your concerns however, it is possible to change your Abegtag and delete your abeg account by contacting our support team at hello@abeg.app.

These measures were put in place for security reasons for the initial rollout.
This can also be seen on Abeg’s website in the FAQ section.
So why did the customer support agent on Instagram tell Nonso he couldn’t change his tag? Did they mean to say only on the app? I don’t know.
But what I do know is that it has prompted a very important discussion on data rights and how they can be abrogated.
Writer, Humanoid, Forever she/her, Lover of words.
Share this article:
Techpoint Build 2021 is here! Be part of the largest gathering of innovators, startup founders, thinkers, programmers, policymakers, and investors in West Africa. Register free now.
Hmmm, not bad. Point is not many lawyers not to mention laymen are really aware that there are laws on data protection in Nigeria. In fact, Nigerian data protection laws are still mainly derived from regulations made by the Minister and not the legislature. With time, this and more are likely to change probably with a landmark case on the issue that will really draw attention to it.
If you value the work we do at Techpoint Africa and would like to help ensure that the core of our journalism remains free and independent, please consider these 5 ways to support us
Today on #TechpointDigest, @OnomeOneyibo discusses eNaira launching today, #InternationalStutteringAwarenessDay, and crypto thefts in 2020
Today on #TechpointDigest, @jermah4 discusses @AltSchoolAfrica by @TalentQL, Privacy Roundtable on @Techpointdotng, @biz301software for SMEs, and Brass $1.7m funding.
Few months after the launch of ‘Pipeline by TalentQL’ to train senior developers, tech talent startup, @TalentQL, launches AltSchool Africa to help complete newbies gain tech skills and earn a university certificate.
Techpoint Awards 2021 will focus on startups and investors operating in Nigeria and active from January 2021 to date. Nominations are now open to the public. Make your entries before the deadline.
by | Oct 21, 2021
by | Oct 11, 2021
by | Oct 5, 2021
by | Oct 1, 2021
by | Sep 28, 2021
by | Sep 16, 2021
by | Sep 15, 2021
by | Sep 15, 2021

Get it directly in your inbox!

Get it directly in your inbox!

Get it directly in your inbox!

Get it directly in your inbox!

source

Leave A Comment