Data lawyers and experts have raised alarm over the alleged lack of privacy policies and cookie notices on the homepages of some government agencies, including the Independent National Electoral Commission (INEC), months after President Bola Tinubu directed all ministries and agencies to comply with provisions of the Nigeria Data Protection Commission (NDPC) Act 2023.
Some argue that this is a legal requirement binding on government institutions, demonstrating their commitment to protecting users’ personal data.
Checks by Naijaonpoint showed that the INEC website has no cookie pop-up (cookies are small text files stored on a user’s device by a website to remember information about their activity) and no privacy policy on its homepage, as of the time of this article.
This also applies to several government institutions’ websites checked by Naijaonpoint.
In this exclusive interview with Naijaonpoint, prominent data lawyers and experts shared their views on the legal requirements for website owners.
“No system is perfect, but cookie notices and privacy policies are the minimum. All agencies should review and comply accordingly to promote data protection practices within the country,” he added.
“They help enhance user experience by saving preferences, tracking browsing behavior, and enabling features like login sessions or personalized content,” he added.
“In that sense, there is an obligation on government agencies to have transparent privacy policies and cookie notices conspicuously displayed on their websites. It is a duty dictated by law,” the lawyer added.
Article 7 of the GAID partly provides as follows:
“In order to comply with the provisions of the NDP Act, a data controller or data processor is, among others, expected to:
(k) Publish its organizational privacy policies on its platforms to sensitize data subjects on data processing activities as well as rights and duties in connection therewith.
(l) Provide privacy and cookie notices at the homepage of its website. The cookie notice should give a data subject the opportunity to decline or accept it. A cookie notice must be displayed in such a way that it significantly obstructs the middle, left, or right side of the homepage of a website. Displaying a cookie notice at the bottom of a webpage where it may be ignored or go unnoticed by a data subject is tantamount to lack of transparency in data processing.”