Inflamed by a conflux of factors such as rapid advancements in globalized digital networks, the ever-heightening dependence on financial platforms, and the expansion of sophisticated information and communication technologies (ICTs), modern societies have become deeply entangled in a complex network of personal data exchanges.
As such, an epoch of unprecedented datafication has been ushered in.
The complex data-based ecosystem necessitates the storage, processing and transmission of personal information, piercing through every facet of individuals’ lives – from daily transactions to participation in the political sphere, to engagement with diverse sectors like energy, entertainment, fintech and healthcare etc.
There are, however, grave risks such as fraud, data breach, abuse, manipulation, corruption, compromise, as well as loss and theft of information, associated with the aforementioned use of personal data.
It has, therefore, become extremely crucial for there to be the safekeeping of a person(s) or organisation’s information in the possession and control of a Data Controller.
Nigeria considers its electric power industry to be on par with its national security.
This means that the power industry is not left out from being in the vanguard of digital and technological advancements, as they strive to continually break the barriers of innovation.
The (renewable) electricity industry, for instance, is going through a significant technological revolution, whereby households and organizations are being digitally connected to renewable energy systems.
This is aimed at increasing and easing up the way in which natural resources are used by way of technology, as opposed to relying on conventional fossil fuels.
The ineludible use of technology in the power industries would, therefore, automatically give rise to the processing of data.
Consequently, this leads to the dire need to protect the said personal data/information from the negative ramifications connected to personal data breaches and unauthorized access to personal data within this dynamic technological environment.
Thus, data protection and privacy have become fundamental to the safeguarding of energy consumers’ (data subjects’) personal information to such an extent that there is the prevention and protection of the occurrence of the risks attached to the processing and transfer of data.
Effective data protection can be attained by developing and putting into practice, solid data security protocols in addition to inviolable data protection regulations – designed to address the risks connected to personal data processing activities.
This article explicates the connection between technology, privacy, and data protection in Nigeria’s electricity industry. It also analyzes the pertinence of sound data privacy practices in the electricity sector, and how the relevant data protection regulatory frameworks, when adhered to judiciously, can attenuate the risks connected to the industry’s inexorable use of technology.
I. What is Data Privacy and Protection?
Personal data is considered by section 65 of the Nigeria Data Protection Act 2023 to be any information that directly or indirectly identifies an individual. Privacy rights, in Nigeria, are recognized as constitutional rights – as they guarantee and protect the citizens’ privacy – including their household; phone, email or telegraphic communications.
Personal data is considered by section 65 of the Nigeria Data Protection Act 2023 to be any information that directly or indirectly identifies an individual. Privacy rights, in Nigeria, are recognized as constitutional rights – as they guarantee and protect the citizens’ privacy – including their household; phone, email or telegraphic communications.
For example, in the case of Bi-Courtney Aviation Services V Kelani (2021), it was held by the Court of Appeal that a person’s image forms an integral part of their ‘right to privacy’ as enshrined within section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as Amended) (the CFRN).
Following on from the above, the protection of data, i.e., ‘Data Protection’ can be defined as the process of safeguarding important data/information from corruption, theft, compromise or loss (data breaches), and supplying the tools or resources necessary to restore the data to a functioning state in the event that something happens that makes it unavailable or unsuitable.
The principle of data protection mandates every organization to process and be in control of sensitive (personal) information – whether digitally or otherwise, to ensure the information is appropriately protected.
This principle is predicated on the rights and proclivity of individuals to decide on the degree to which they disclose their personal information to others.
II. Laws Governing Data Privacy and Protection in Nigeria
Data protection regulations were created in response to the dangers associated with the processing of personal data and the imperative to safeguard individuals’ or organizations’ critical and confidential information.
Furthermore, data protection regulations mandate the deployment of data security techniques that safeguard personal data from unauthorized access, theft or loss. The relevant laws governing data protection and privacy activities in Nigeria are the:
Organizations in the electricity industry are mandated to adhere to the above-listed laws regarding the protection of the (personal and sensitive) data they control and process.
Failure to comply with the regulations could lead to the imposition of sanctions, fines, business disruptions brought on by investigations, jail terms for principal officers of organizations, and so on.
It is, therefore, beneficial for organizations carrying out operations in the sector to comply with data protection regulations as it would help with the mitigation of risks like security breaches and data losses.
Also, organizations that mismanage data and fail to take cognizance of the said laws could expose themselves to license revocations, damaged reputation, loss of customers, regulatory penalties, associated losses and legal liabilities.
The Nigerian Data Protection Commission regards the electric power sector as strategically significant to the economy – akin to national security, and organizations or service providers within the sector that process personal data are regarded as Data Controllers and Data processors of Major Importance (DCMIs and DPMIs).
According to the Nigeria Data Protection Commission’s Guidance Notice on the ‘Registration of Data Controllers and Data Processors of Major Importance (DCMIs and DPMIs)’ issued on the 14th of February 2024 by the Nigeria Data Protection Commission (NDPC), DCMIs and DPMIs are companies that operate, offer services or handle personal data in the electric power industry.
DCMIs and DPMIs are considered to have “particular value or significance to the economy, society or security of Nigeria”.
Thus, companies in the electric/power industry as DPMIs and DCMIs, do not only have a legal duty to comply with data protection regulations but also a critical responsibility to ensure that personal data entrusted to their care is conscientiously protected.
This would foster trust and confidence in stakeholders of the industry and facilitate the successful implementation of technology-driven electricity initiatives.
Therefore, the robust safeguarding of information is paramount for electricity companies as they transition into data-driven businesses that use both personal and electricity data as tools for energy efficiency mechanisms.
One of the primary objectives of the energy industry is to successfully achieve the decarbonization of the industry by way of transitioning from the use of carbon-intensive fossil fuel energy to renewable energy options.
This is aimed at curtailing greenhouse gas (GHG) emissions and achieving zero fossil carbon existence.
Such energy decarbonization efforts in recent years have been heavily impelled by advances in digital technology. The power sector is primarily herded by technology – which is a tool necessary for the decarbonization, efficacy and productivity of the said industry.
As more electricity companies leverage technology, new security and personal data breach risks arise. As such, a proactive viewpoint and understanding of the practice of data protection is needed if the energy sector is to continue its digital transformation.
Only when such safeguards of personal data are in place can the advantages of digitalization be fully harvested and enjoyed.
I. The Importance of Privacy and Data Protection in the Electricity Industry
As a matter of course, an electricity organization’s sensitive data such as its intellectual assets, employee/management information, as well as trade secrets, are at the core of its competitive advantage and success.