On 31 May 2023, the Governor of the Central Bank of Nigeria (CBN) in exercising powers granted under the Banks and Other Financial Institutions Act 2020 (the Act) issued the Central Bank of Nigeria (Customer Due Diligence) Regulations 2023 (the CDD Regulations). One of the objectives of the Regulations is to provide additional customer due diligence (CDD) measures to enable Financial Institutions (FIs) to comply with the Money Laundering (Prevention and Prohibition) Act 2022, Terrorism (Prevention and Prohibition) Act 2022, CBN (Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing of Weapons of Mass Destruction in Financial Institutions) Regulations 2022 and international best practices.

The CDD Regulations require FIs to among other things, obtain the social media handle of customers for the purpose of identification. In this article, I argue why this requirement imposed on FIs by the CDD Regulations potentially violates the Data Protection Act 2023 (DPA).

What exactly is customer due diligence
According to the CBN Guidance Note on Anti-Money Laundering and Combatting the Financing of Terrorism for Other Financial Institutions 2022 (the Guidance Note), CDD ‘involves customer identification, information gathering, and monitoring’. Under the CDD Regulations, FIs are required by regulation 5 (1) to carry out CDD in the following circumstances: when business relationships are established; when carrying out transactions above the CBN designated threshold; carrying out occasional transactions that are wire transfers; when there is suspicion of money laundering, terrorist financing, proliferation financing; or when there are doubts as to the veracity or adequacy of previously obtained customer identification data.

Among other things, the CDD measures to be implemented by a FI must include the means for customer identification and verification of customer identity. Customer for the purpose of this article refers to only natural persons that are customers of a FI, thus one of the key elements of CDD is customer identification and verification through credible evidence such as original and valid identification issued by government agencies.

Are social media handles personal data
As an initial matter, the DPA is triggered every time personal data is processed. The simple act of collecting, storing or retrieving personal data constitutes a data processing operation. Personal data on the other hand is defined by the DPA as:

any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual.

Online identifier as used in this definition is a phrase borrowed from the General Data Protection Regulations (GDPR) regulating data protection in the European Union. Recital 30 of the GDPR clarifies that ‘[n]atural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags’. According to the Information Commissioner’s Office (ICO), the data protection authority in the United Kingdom, social media handles may be personal data because their use may leave traces which, when combined with unique identifiers and other information received by servers, may be used to create profiles of individuals and identify them.

For illustration, the ICO explains that:

An individual’s social media ‘handle’ or username, which may seem anonymous or nonsensical, is still sufficient to identify them as it uniquely identifies that individual. The username is personal data if it distinguishes one individual from another regardless of whether it is possible to link the ‘online’ identity with a ‘real world’ named individual.

Having established that social media handles are indeed personal data, I now turn to how their collection by FIs as part of CDD measures is violatory of the DPA.

Excessive personal data collection is contrary to the principles of personal data processing
Under the DPA, one of the principles of data personal data protection provided in section 24 (1) (c) is to ensure that the personal data processed is ‘adequate, relevant and limited to the minimum necessary for the purposes for which the personal data was collected or further processed’. This principle is otherwise referred to as data minimisation under the GDPR and in most jurisdictions with a data protection framework. This principle (and others provided for in section 24 of the DPA) must be complied with whenever personal data is processed irrespective of the lawful base, unless such data processing operation is exempt from the application of the DPA.

Data minimisation means that data controllers and processors must only collect and process personal data that is directly relevant to the specific purpose pursued by the processing operation. Thus, data controllers and processors must ensure not to obtain more personal data than is necessary from the data subject (in this case the customers) in relation to the purpose the data processing operation seeks to accomplish. Under the CDD Regulations, the purpose of collecting personal data from customers by FIs is for identification and verification of a customer’s identity.

For the purpose of identifying customers, regulation 6 (a) of the CDD Regulations requires FIs to in addition to collecting the social media handles of customers, also collect the following types of personal data: legal name; permanent address (full physical address); residential address (where the customer can be located); telephone number; e-mail address; Bank Verification Number (BVN); Tax Identification Number (TIN); and an official personal identification number or other unique identifier contained in an unexpired document issued by a government agency, that bears a name, photograph and signature of the customer such as a passport, national identification card, residence permit, social security records or drivers’ license.

While these personal data are required to be collected by FIs to enable the proper identification of customers, it is respectfully submitted that they are excessive in relation to the purpose of the processing operation and potentially violate the data minimisation principle in the DPA. As a matter of fact, only the BVN, TIN and/or official unexpired identity document issued by a government agency is required to properly identify the customer, anything more than this would be excessive data processing. In terms of verifying such official documents when provided by customers, the principle of regularity may be relied upon absent any compelling evidence challenging the validity of these documents. Thus, it goes without saying that data collection in this case is excessive and therefore unnecessary in light of the purpose of the collection since a customer’s identification and verification can easily be accomplished by excluding certain other types of personal data mentioned in the CDD Regulations.

Conversely speaking, another question is whether a FI has the technological means to verify a customer’s identity through a social media account. While another third party may be able to do so, this is unlikely to be the case for FIs considering the technical resources available to them. It is also unlikely that such a third party would be willing to disclose the identity of an individual associated with a social media account, at the request of the FI in the absence of proper authorisation under the applicable law or data protection legislation. In other words, social media handles serve no customer identification purpose as they cannot enable a FI to ascertain the identity of the individual behind that social media account.

When assessing what personal data may be collected to accomplish the purpose pursued by the processing operation, data controllers and processors are also minded to consider the adverse impact of the means of processing as well as verifying whether an alternative or less intrusive means of processing is available and has fewer adverse effects on the data subject. While the collection of social media handles may seem reasonable to the CBN, it does pose a significant privacy risk since social media handles are now considered to be an extension of the private sphere of an individual. And any processing in this regard would be deemed to be quite invasive. An example of this is when the Agencia Española de Protección de Datos (AEPD), the Spanish data protection authority, in an administrative determination ruled that the use of biometric data (fingerprints in this case) for access control by students on the premises was excessive when a less intrusive alternative like the use of identity cards would have served the same purpose.

In addition, legitimate concern exists that the disclosure of social media handles pursuant to the CDD Regulations could have a chilling effect on social media use by interfering with freedom of expression, especially if that social media handle is active and/or has massive followership. This chilling effect is a significant impediment to the fundamental rights and freedom of the data subject which the DPA seeks to safeguard in section 1(a). As I have stated elsewhere, the necessity of the personal data collected and its proportionality in relation to the purpose pursued by the processing operation must be taken into consideration by a data controller in its assessment of what personal data may be collected.

Conclusion
While the extant Nigerian Data Protection Regulations 2019 (NDPR) issued by National Information Technology Development Agency (NITDA) which predates the DPA saw minimal enforcement, probably due to stakeholders’ concerns questioning its legal basis. The DPA on the other hand is an Act of the legislature that derives legitimacy from the constitutional power of the National Assembly to make laws. On this basis, it becomes pertinent to mention that where a conflict exists between an Act of the National Assembly such as the DPA and a subsidiary legislation such as the CCD Regulations, the law is that a subsidiary legislation cannot over-rule the law, see Akanni v. Odejide (2004) All FWLR pt. 218 pg. 827 at 853; Kennedy v. INEC (2009) 1 N.W.L.R (Pt. 1123). Thus, the aspect of the CCD Regulations that infringes the data minimisation principle of the DPA can be declared null and void if challenged in court.

In any case, identity verification is a delicate matter that essentially involves the disclosure and dissemination of personal data which in turn triggers the DPA. While note should be taken that the main argument made in this article is that collecting social media handles in accordance with the CDD Regulations serves no customer identification and/or verification purposes and as such violates the data processing principle of data minimisation under the DPA. However, no assumption should be made that other requirements in the CDD Regulations do not implicate other provisions of the DPA such as purpose specification, lawful bases, transparency and information provisions and the obligation to conduct a data privacy impact assessment, the extent of which can only be determined after a comprehensive data protection analysis of the CDD measures to be implemented by FIs.

It, therefore, becomes important for organisations that regularly process personal data and/or implement identity verification processes to ensure compliance with the DPA in every aspect. As of the time of this writing, there has also been a public uproar against the collection of social media handles by FIs in compliance with the CDD Regulations. In particular, the Socio-Economic Rights and Accountability Project (SERAP), a civil society organisation that regularly engages in public interest litigations has written to the CBN asking it to ‘immediately delete the patently unlawful provisions in the Central Bank of Nigeria (Customer Due Diligence) Regulations directing banks to obtain information on customers’ social media handles for the purpose of identification’. It would be interesting to see the final conclusion of this matter and whether this would be the first test of the enforcement bite of the DPA to protect the rights and freedoms of data subjects in Nigeria.

Chukwuyere Ebere Izuogu

On Tuesday 4 April 2023, the President of the Federal Republic of Nigeria delivered the Nigerian Data Protection Bill 2023 (“the Bill”) to the Senate and House of Representatives chambers of the National Assembly for their consideration. At the Senate, the Bill is numbered SB. 1114 while it is numbered HB. 2203 at the House of Representatives. The Bill has had a chequered history from when it was first presented for public comments as a draft document by the Honourable Minister of Communications and Digital Economy (“the Minister”) in 2020 and subsequently in 2022. Now, the document is formally before the National Assembly and can be officially referred to as a Bill.

The Bill in its explanatory memorandum seeks to provide a legal framework for the protection of personal information and establish the Nigerian Data Protection Commission (“the Commission”) for the regulation of the processing of personal information, and for related matters. On Wednesday 5 April 2023, the Bill was read for the first time at both the Senate and House of Representatives. On Thursday 6 April 2023, the Bill was read for a second time at the House and committed to the House Committee of the Whole. In this note, I highlight some of the pertinent provisions of the Bill and what they mean in practice for covered organisations. I also highlight the likely next steps in the legislative history of the Bill until presidential assent.

Scope of the Bill

Clause 2 of the Bill sets out the material scope of the Bill. According to this provision, the Bill shall apply where the:

1. data controller or data processor is domiciled in, resident in, or operates in Nigeria;
2. data processing operation occurs within Nigeria; or
3. data controller and processor not being domiciled, resident or operating in Nigeria, process the personal data of a data subject in Nigeria.

The Bill defines a data controller as ‘an individual, private entity, public commission or agency or anybody who or which, alone or jointly with others, determines the purposes and means of the processing of personal data’ while a processor is defined as ‘an individual, private entity, public authority or any other body, who or which processes personal data on behalf of or at the direction of a data controller or another data processor’.

Clause 3 exempts particular processing operations, some of which are the processing of personal data carried out by one or more persons solely for personal or household purposes. Other processing operation exempted are those carried out by a ‘competent authority’ for the purposes of prevention, investigation, detection, prosecution, or adjudication of a criminal offence or the execution of a criminal penalty, or as is necessary for national security. The definition of competent authority in the Bill is so broad that it spans all the arms of government at all levels of government in Nigeria.

Definition of personal data and sensitive personal data

The Bill defines personal data to mean ‘any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual’. From this definition, it is not clear whether the use of individual refers to both living and deceased individuals. In addition, the explanatory memorandum refers to ‘personal information’ while the Bill makes copious references to ‘personal data’ which it defines. Therefore, it is unclear whether personal information and personal data mean the same thing.

Sensitive personal data is defined to mean personal data relating to an individual’s genetic and biometric data, race or ethnic origin, religious or similar beliefs, health status, sex life, political opinions or affiliations, trade union memberships or other information as may be prescribed by the Commission.

Principles of data processing

Clause 19 of the Bill sets out the principles governing the processing of personal data and these are the main responsibilities of covered organisations. In other words, these key principles serve as the conditions that must cumulatively be complied with every time personal data is processed. Under the Bill, these principles are;

1. lawfulness, fairness and transparency which essentially means that personal data must be processed only if a legal ground exists, and must be in a fair and transparent manner with respect to the individual whose personal data is processed;
2. collected for specific, explicit and legitimate purposes, and not be further processed in a way incompatible with these purposes. Data processing is specific if the purpose is sufficiently defined, it is explicit if sufficiently unambiguous and clearly expressed and legitimate where it complies with legal provisions;
3. adequate, relevant, and limited to the minimum necessary for the purpose pursued by the processing operation. Essentially this means that the data collected must be necessary and proportional to accomplish the purpose of the processing;
4. retained for no longer than necessary;
5. accurate, complete, not misleading and where necessary kept up to date having regard to the purpose of the processing; and
6. processed in a manner that ensures appropriate security of the personal data.

Lawful basis of personal data processing

Clause 20 sets out the conditions that must be satisfied for the processing of personal data to be lawful and thus not prohibited. Unlike the data protection principles which cumulatively apply, it is sufficient if at least one of the lawful basis can be identified to legitimise a data processing operation. These conditions are; consent of the data subject; the processing is necessary for the performance of a contract, the processing is necessary for compliance with a legal obligation; the processing is necessary to protect the vital interest of the data subject or other person; the processing is necessary for performance of a task carried out in public interest or in the exercise of official authority vested in the data controller or processor; the processing is necessary for the purpose of legitimate interest pursued by the data controller or processor, or by a third party to whom the data is disclosed.

Data protection impact assessment

Clause 23 (4) of the Bill states that a data protection impact assessment (DPIA) is a process designed to identify the risks and impacts of an envisaged data processing operation. A data controller is required by clause 23 (1) to conduct a DPIA prior to a processing operation, in every circumstance where the processing of personal data may likely result in a high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context and purposes. In this regard, I note that the trigger for a DPIA under the Bill differs from that under the Nigerian Data Protection Regulations 2019 (NDPR) issued by the National Information Technology Development Agency (NITDA) where it is required that a DPIA must be conducted in data processing operations involving the ‘intense’ use of personal data.

Appointment of data protection officers

Clause 27 requires data controllers to designate a data protection officer (DPO) who shall be a person of expert knowledge of data protection law and practices having the ability to carry out the tasks prescribed by the Bill. The DPO may be an employee of the data controller or engaged by a service contract.

Rights of the data subjects

The Bill enshrines in clauses 29, 31-33 the various rights of data subjects to be observed and respected by covered organisations and these rights are; right to obtain certain information from the data controller without constraint or unreasonable delay; to withdraw consent; to object to certain type of processing operations; right not to be subject to a decision based on automated processing of personal data including profiling which produces legal or similar significant effects concerning the data subject; and right to data portability. In setting out the rights of the data subject, I note that the rights to correction, erasure and restriction of processing are not stand-alone rights but rather are listed under the type of information a data subject has the right to request from the data controller.

Cross-border transfers of personal data

Clause 36 (1) (a) of the Bill provides that personal data shall not be transferred from Nigeria to another country unless the recipient of the personal data is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanisms that affords an adequate level of protection with respect to the personal data. In this regard I note the following; first, the concept of transfer is not defined so it is not clear whether it also includes accessing personal data physically located in Nigeria by a recipient that is physically outside of Nigeria. Second, the scope of this provision is restricted to only transfers to another country and does not include transfers made to another territory or an international organisation. Thirdly, ‘adequate level of protection’ as used in other data protection frameworks applies to only laws, and not to binding corporate rules, contractual clauses, and codes of conduct. Lastly, it is unclear, the exact breadth of contractual clauses contemplated as being subject to a contractual clause is not the same thing as being a party to the contract containing the contractual clauses.

Clause 38 also provides other grounds that can legitimise the transfer of personal data outside of Nigeria and they are; consent of the data subject; ‘transfer is necessary for the performance of a contract to which a data subject is a party to…’; transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and a third party; transfer is for the sole benefit of a data subject; transfer is necessary or important for reasons of public interest; transfer is necessary for the establishment, exercise or defence of legal claims; or transfer is necessary to protect the vital interests of the data subject or of another person.

Registration of data controllers and processors

Clause 39 provides that data controllers and processors of ‘major importance’ are required to register with the Commission within six months after the commencement of the Bill (when enacted) or upon becoming a data controller or processor of major importance. Clause 40 provides that the Commission may prescribe registration fees or levies to be paid by data controllers and processors of major importance.

Enforcement Authority

Clause 4 (1) establishes the Commission. Clause 6 (a) empowers the Commission to oversee the implementation of the provisions of the Bill. Accordingly, clause 41 authorises the Commission to investigate any complaint arising from the provision of the Bill. In conducting an investigation, the Commission has a lot of tools at its disposal such as powers to order a person to attend for oral examination, produce documents or furnish statement in writing made under oath. Pursuant to clauses 42 and 43 respectively, the Commission is authorised to issue a compliance order against a data controller or organisation and an enforcement order against a data controller or processor. While a compliance order may be a warning that certain acts constitute a violation, an enforcement order imposes a sanction.

Penalty provisions

Under clause 43 (3), depending on whether the data controller or processor is of major importance, the Commission may issue a penalty fee as part of its enforcement order which could range from N2,000,000 to two percent of the annual gross revenue in the preceding financial year. Clause 44 provides that a data controller or processor who fails to comply with an order of the Commission is guilty of an offence and liable upon conviction to a fine, imprisonment for a term not exceeding a year or both fine and imprisonment.

Status of the NDPR

It is pertinent to state that the Bill does not seek to repeal the NDPR. This is clearly expressed in Clause 59 (2) (f) which among other things provides that all regulations issued by NITDA or the Nigerian Data Protection Bureau (NDPB) shall continue in force as if they were issued by the Commission until repealed. This means that unless repealed or withdrawn the NDPR will concurrently apply with the Bill when it is enacted into law. However, where there exists a conflict in the NDPR and the Bill (when enacted), the provisions of the Bill as an Act will prevail over the NDPR because according to established case law in Nigeria, it is a trite principle of law that a subsidiary (or subordinate) legislation (such as the NDPR) cannot contradict or over- ride an Act enacted by the legislature.

Next steps

It appears that the Bill will be given speedy consideration at the National Assembly. However, as I have written elsewhere, there are currently three Bills on data protection before the National Assembly which according to legislative rules and practice must be consolidated with the Bill or withdrawn by their sponsors. In addition, I expect a public hearing on the Bill would be held in the next couple of weeks by a joint committee comprised of members of each chamber of the National Assembly. At the public hearing, stakeholders such as the Minister, NITDA, NDPB, civil society, human rights organisations, data protection experts and lawyers are likely to attend to make submissions supporting or opposing the Bill. On this basis, I note that some parts of the Bill remain unclear and contains some inconsistencies which may be highlighted for amendment during the public hearing.

After this public hearing, the Bill would be passed by each chamber and delivered to the President for his assent, which I expect would happen ahead of the inauguration of the incoming administration on 29 May 2023.

Conclusion

Stakeholders have looked forward to the enactment of a robust data protection legislation in Nigeria. While the NDPR is in force and currently regulates the processing of personal data in Nigeria, stakeholders are still divided on whether NITDA does have the legal authority to issue it although this question has not been tested in court as of the time of this writing. In addition, the NDPR does have several limitations, one of which is the absence of legitimate interest as a legal base for the processing of personal data.

In any case, if the Bill eventually becomes law, one of the policy objectives of pillar #1 of the National Digital Economy Policy and Strategy (2020 – 2030), which is to enact a data protection law for Nigeria would have been met, courtesy of the sustained efforts of the Minister.

On the 30^th day of September 2022, I was notified by the National Information Technology Development Agency (NITDA), the IT standards regulator for Nigeria, of my selection as a member of the National AI Volunteer Expert Group (VEG). The VEG serves as an external working group to NITDA and provides strategic advice, support, research, drafting, collating and review on all aspects related to the formulation and implementation of the national AI policy for Nigeria. The duration of this national assignment is 4 months and commences in November 2022.

For keen observers of the tech policy landscape in Nigeria, this particular effort to see that Nigeria finally has a national AI policy was expected. Recall that pillar 7 of the National Digital Economy Policy and Strategy 2020 – 2030 (NDEPS) issued by the Federal Ministry of Communications and Digital Economy (the Ministry), considers AI as an emerging technology that must be harnessed for the development of Nigeria’s digital economy in order to attain 7 of the sustainable development goals (SDGs) as prescribed by the United Nations. These SDGs are; poverty eradication; good health and well-being; quality education; decent work and economic growth; industry, innovation and infrastructure; reducing inequality; and sustainable cities and communities. These SDGs in my view, are the overarching theme that should guide the formulation of Nigeria’s AI policy. Prior to the issuance of the NDEPS, Nigeria had in November 2021 participated at the international level in the development of an international AI policy framework by adopting UNESCO’s Recommendations on the Ethics of Artificial Intelligence.

Now that the government of Nigeria has taken positive steps to develop a national AI policy, the usual questions would be how to frame this policy to ensure that it serves national interests and benefits Nigerians. One cardinal aspect of AI policy development that is common with the AI national policy in other jurisdictions and/or those proposed by AI policy experts is that AI must be responsible and trustworthy and its development grounded in a human rights framework. In my view, these are the same considerations that should be applied in developing Nigeria’s AI policy and they should be framed around the following key elements which I propose below:

i. Safety and security of AI systems

AI systems should be designed in such a manner that their use will not result in an adverse impact on individuals. In developing and deploying AI systems, the government and organisations should ensure that rules and ethical principles are the foundational building blocks required to trigger the safe and reliable operation of AI systems. Designing AI systems to be safe is to proactively ensure that individuals are not subjected to the unintended yet foreseeable risks that could possibly result from AI use. One of the ways in which this can be achieved is through standard-setting by NITDA in exercising one of its statutory powers or through the adoption of globally accepted AI standards that have been tested and validated by the various stakeholder communities. In addition, such standards must encourage the use of sandboxes where innovative AI systems are tested in a secure environment under regulatory supervision as a pre-condition for final release to the public. Lastly, operationalising safe and reliable AI systems should be strengthened with regular audit obligations to be undertaken by independent trusted third parties and risk assessment in every circumstance where using AI may be categorised as high risk based on the level of impact on individual rights and/or safety.

ii. Law enforcement/national security and military application of AI systems

The application of AI systems to law enforcement and military efforts poses serious challenges to both individual autonomy and fundamental human rights. For instance, the subject (or target) in most of these efforts is unaware of being monitored by AI systems and as a result, has not granted consent. Examples of such use by law enforcement and the military include the use of facial recognition technologies (powered by) AI in public places, surveillance technologies that monitor and/or intercept communications indiscriminately and the use of autonomous weapons systems in the battle space. While such use by AI may be necessary to meet the state’s obligation to protect lives and defend the state. However, this must be done in a manner that respects existing fundamental human rights norms and legally recognised rights, and be subject to robust judicial or regulatory oversight.

Being right respecting means that AI systems must be designed or deployed in such a manner that takes into consideration all the rights guaranteed by law such as the rights to life, privacy, freedom of expression, freedom of movement and freedom from discrimination. While oversight requires a pre-deployment assessment of the potential harms to individuals in using such AI systems, and if deployed, a speedy resolution of complaints by individuals alleging an infringement of their rights through the use of such AI systems. In this regard, it is important to mention that the exemption from the application of the recent data protection bill (yet to be presented to the National Assembly) of data processing operations done for the purpose of criminal investigation is absolutely a bad idea, that can be abused by law enforcement agencies and the armed forces.

iii. AI liability

It is important to bear in mind that the adoption of clear standards governing the safe use of AI systems will not totally eliminate all the harm arising from their use. This harm which could be pecuniary or non-pecuniary ordinarily should help establish the liability of the user and/or developer of such AI systems but unfortunately, this is not always the case. For example, to sustain a claim for liability under Nigerian tort standards, there must be a causal connection between the tortious activity and the resulting damage. However, this can be difficult to establish in situations where the AI system facilitated the harm suffered.

For instance, where the harm suffered is damage to data, an intangible, it may be difficult to argue in court that such an intangible asset qualifies as a physical property that is capable of being damaged. Another limitation of the traditional concept of tort in substantiating liability is the difficulty in proving that the act challenged for causing the harm is a direct consequence of the conduct of the user or developer of the AI system, especially if the AI system involved is self-learning or its initial action has been modified as a result of external data acquired during the normal course of operation.

For this reason, the AI national policy should broadly consider the importance of framing rules for imposing liability especially as AI technologies gain traction and mature in Nigeria. These considerations may take cognisance of the various actors (developers, deployers and users) present in the entire value change of AI and the multiple scenarios of AI use/development that could give rise to liability for which an individual suffering the resulting harm could confidently pursue damages.

iv. Trustworthiness, explainability and fairness of AI systems

AI is trustworthy if it complies with the law and adheres to ethical principles. Explainability means that to trust AI systems, an individual that has been adversely affected by AI decision-making must be provided with an explanation of how and why the AI system arrived at such a decision. Fairness means that AI must not churn output that could discriminate, lead to bias or amplify social inequalities. For AI to remain trustworthy, explainable and fair, AI experts have suggested prescriptive governance mechanisms requiring humans to always intervene or have control over AI systems. Human control is important to mitigate the opportunity for AI in their decision-making, to deviate from what the developers originally intended and/or what was expected by the users. In this regard, the AI national policy may want to consider prescriptive mechanisms that can be implemented to achieve this such as human-in-the-loop, human-on-the-loop and human-in-command. Irrespective of the preferred mechanism, it is very important for the human behind the machine to be properly identified and tasked with ensuring that the operations of critical AI systems are aligned with their required functionalities.

v. Competition, innovation and growth of local content

It bears emphasis to note that very few tech companies have the resources to invest in continuous AI research and development, and because of this AI systems are concentrated in a handful of tech companies from the global north. To ensure that the AI market in Nigeria remains competitive for homegrown AI systems, the AI national policy must obligate specific fair market practices to level the playing field. Understandably, competition law exists in Nigeria but these rules would most likely apply after the harm to the market and/or competitor has occurred. The proposal made here is for the application of specific ex-ante rules to apply within the AI market irrespective of whether market power has been found to exist or not. A suggestion I would readily propose in this regard would be to require AI developers, deployers and users to grant access to their datasets which can be used in the development of AI systems. Public sector organisations that develop AI may also be encouraged to release their AI system to the general public as open source in order to create opportunities for community collaboration that has the potential to accelerate innovation beneficial to Nigerians and to the nation. Alternatively, data governance models like data trusts may be considered if it has a chance of tilting the power asymmetry from AI-powered platforms to users and/or data subjects.

Conclusion

Without prejudice to the foregoing, the AI national policy must also be subject to a robust public consultation that is undertaken when the AI policy is still at a formative stage; adequate information must be provided to enable participants to properly respond; adequate time must be provided in which to respond and lastly NITDA must consider all responses to the consultation. This is to give the final version of the AI policy legitimacy if stakeholders were given an opportunity to contribute and participate in its development. It is also important to stress that all the elements proposed are meant to apply irrespective of the sectoral or cluster application of the AI systems.

AI is globally recognised as having serious potential that benefits the digital economy and society as a whole. This recognition is consistent with Nigeria’s commitment to harness AI to meet the 7 SGDs. However, the flip side of AI use is to realise its socially disruptive nature and the various challenges its application poses to both individual and society. Whilst Nigeria’s national AI policy will no doubt establish a framework on how AI may be developed, deployed and used in order to unlock its benefits, NITDA must as a matter of importance also ensure that the resulting benefits are not overshadowed by the risks associated with AI use. The answer to this will ultimately rest on the approach adopted by the federal government and by extension NITDA in the AI national policy.

This post represents my personal opinion and should not be construed as the opinion of the National AI Volunteer Expert Group or NITDA.

by Chukwuyere Ebere Izuogu

In 2019, the Federal Competition and Consumer Protection Commission Act (FCCPA) was enacted into law. The FCCPA is Nigeria’s first federal competition and consumer protection statute. The FCCPA also establishes the Federal Competition and Consumer Protection Commission (the Commission) and the Federal Competition and Consumer Protection Tribunal (the Tribunal), respectively, as the enforcer and adjudicator of both competition and consumer protection claims in Nigeria. On 29 March 2022, the Tribunal received its first case challenging among other things the alleged anti-competitive practice of Multi-Choice, the first defendant, a pay-TV provider in Nigeria.

In September 2022, the Tribunal delivered judgment in this case wherein it absolved Multi-Choice of any liability whatsoever for the alleged anti-competitive act. In this short note, I highlight a fundamental error in the reasoning of both claimant and the Tribunal. I also highlight some key takeaways from this case that are likely to have an impact on litigating future competition-related claims under the FCCPA. This note draws on several posts I have previously written here, here, here and here in respect of competition issues in Nigeria.

Factual Background

The origin of this case can be traced to a complaint dated 19 May 2020 and titled ‘Powers of the Commission to Regulate Price; Abuse of Power of Dominance in Market and Impending Price Hike by Multi-Choice/DSTV in Nigeria’ made by the claimant against Multi-Choice before the Commission. In this complaint, the claimant alleged among other things that Multi-Choice’s ‘incessant price increment is repressive, unjustified, unfair and uncalled for’. Unfortunately, according to the claimant, the Commission failed to resolve this complaint in the period leading to the commencement of the case at the Tribunal. In March 2022, Multi-Choice announced another increase in the price for its pay-TV services. According to the claimant, the failure of the Commission to resolve the complaint can ground the invocation of the Tribunal’s power as provided for in section 47 of the FCCPA.

The Fundamental Error

After dispensing with several procedural questions, the Tribunal was invited by the claimant to determine the substantive issues, among which was the question of whether Multi-Choice’s history of price increases constitutes an abuse of a dominant position within the meaning of sections 70 and 72 of the FCCPA. Section 70, particularly subsections 1 and 2 describes the circumstances in which an undertaking is dominant or has market power in a particular market. Section 72 (1) prohibits the abuse of a dominant position by an undertaking while section 72 (2) provides a list of practices that are deemed to be abusive if engaged by a dominant undertaking (or a group of dominant undertakings). Of note here is charging an excessive price to the detriment of consumers provided in section 72 (2) (a), which was the basis of the claimant’s case that Multi-Choice price increases constitute an abuse of a dominant position.

In arguing his case, the claimant among other things contended that Multi-Choice ‘does not only occupy a [d]ominant position but has consistently abused their [d]ominant position … on countless occasions unilaterally and independently without recourse to the consumer, customer or even the regulator (sic) increased the prices of its products and services. The Tribunal in determining this question also stated that ‘there is indeed no doubt that [Multi-Choice] occupies a [d]ominant position’, and further that ‘there is no proof that [Multi-Choice] (though occupies a dominant position) abused her position of dominance’ thereby indirectly affirming the claimant’s argument that Multi-Choice occupies a dominant position.

It is important to note that in resolving this question, nowhere in the judgment nor in any argument made by the claimant was the relevant market in which Multi-Choice is stated to be dominant, defined or identified. Herein lies the error of this case.

The Importance of Market Definition

The general rule in competition law when assessing dominance or market power is to first define the relevant market in which market power can be inferred. In other words, market definition is fundamental when assessing market power and if an abuse of such power has occurred or is likely to occur. The importance of market definition in a dominance assessment is reinforced by Regulation 5 (1) of the Abuse of Dominance Regulations 2022 (the Dominance Regulations) which provides that delineating (or defining) the relevant market shall be the first step when determining whether an undertaking is in a dominant position.

In the words of the Commission in Paragraph 1 of the Notice of Market Definition 2021 (the Notice), market definition is the ‘necessary first step needed to determine whether an undertaking has market power since there can be no market power without a market’, thus market definition is the first step in any dominance assessment. According to Paragraph 2 of the Notice, the relevant market comprises two dimensions, namely the product market and the geographic market. Importantly, Paragraph 3 of the Notice provides ‘Whilst it is not an end in itself, the definition of the relevant market in both its product, geographic and temporal dimensions often has a decisive influence on the outcome of a competition case’.

While the relevant product market comprises all those products which are regarded as interchangeable or substitutable by the consumer, by reason of the products’ characteristics, prices, brand, and their intended use, the geographic market on the other hand is defined in terms of the location of suppliers, and it includes. those suppliers that customers consider to be feasible substitutes, which may be local, statewide, regional, national or wider. Therefore, product markets and geographic markets are respectively determined on the basis of consumer choice and supplier location.

In addition, case laws from other competition jurisdictions also support the statement that market definition is important when assessing market power. For instance, in the EU, Case 27/76 United Brands Company and United Brands Continental BV v. Commission of the European Communities [1978] ECR 207, makes clear that in order to determine market power, it is necessary to first define the relevant market. In extreme cases, the failure to properly define the relevant market can lead to the nullification of the decision of the competition authority as seen in Europemballage Corporation and Continental Can Company Inc. v. Commission of the European Communities [1973] CMLR 199. In the US, the position is the same according to Brown Shoe Co. v. United States, 370 U.S. 294 (1962) where the US Supreme Court held that the ‘determination of the relevant market is a necessary predicate to a finding of’ an antitrust violation, and in Queen City Pizza, Incorporated v. Domino’s Pizza Incorporated., 922 F. Supp. 1055 (E.D. Pa. 1996) where a US District Court held that in order to state an antitrust claim, the ‘plaintiff must [first] identify the relevant product and geographic markets’.

Having established the importance of market definition, it becomes pertinent to note that failure to define the relevant market is fatal to any abuse of dominance case commenced under the FCCPA. This is because the obligation to define the relevant market is mandatory having reference to the use of shall in Regulation 5 (1) of the Dominance Regulations. According to well-established Nigerian case laws, the use of shall in a statute connotes a command that it is imperative, mandatory and admits no discretion. Thus, failure to define the relevant market in determining dominance is likely to render invalid any conclusion resulting from such a determination.

The Takeaways

Some of the key takeaways from the judgment of the Tribunal in this case are:

1. It is not mandatory for an aggrieved consumer who seeks to enforce his right to first make a complaint to the FCCPC as he can directly approach the Tribunal in the first instance;
2. For an undertaking to be considered as abusing its dominance, it must engage in all the practices listed in section 72 (2) of the FCCPA (Although I disagree with the interpretation of the Tribunal as each of these practices alone is sufficient to sustain a claim that an undertaking is abusing or has abused its position of dominance in the relevant market); and
3. To sustain a claim of excessive pricing within the meaning of Section 72 (1) (a) of the FCCPA, the claimant must make a clear showing that the price is either ‘excessive’ or ‘detrimental’ to consumers

Conclusion

Despite the failure of the claimant to define the relevant market, one wonders why Multi-Choice did not challenge this failure in any of its arguments made before the Tribunal on the ground that the claimant has not satisfied the burden of proof required to establish dominance, let alone abusing that position of dominance by engaging in an excessive pricing practice. Even if this standard of proof was met, for the claimant to be entitled to the reliefs sought from the Tribunal, he must establish that Multi-Choice’s alleged abuse of a dominant position resulted in an identifiable ‘injury’ to himself (or to existing competitors of Multi-Choice in the relevant market), rather than a violation of his right as he did before the Tribunal. An identifiable injury exists where there is evidence that the claimant has suffered (or will suffer) some harm as a result of the alleged abusive practice. In other words, there must be a causal link between this identifiable injury and the challenged excessive pricing practice of Multi-Choice. From a consumer-facing perspective, the identifiable injury will include the various ways in which Muti-Choice’s alleged abusive practice impacts the availability and pricing of pay-TV services within the relevant market.

In any case, even if the relevant market was properly defined, the analysis must convincingly show that Multi-Choice is indeed dominant in that market. And this is no easy feat for pay-TV services when considering the rate of innovation in viewing broadcasting content, consumer choices and the likelihood of non-broadcasters entering the broadcasting market and/or owning broadcasting content, all key factors that must be considered when defining the relevant market in which Multi-Choice is alleged to have abused its dominance. Unfortunately, in this case, the claimant’s statement that Multi-Choice is dominant and the Tribunal’s confirmation of this statement in its judgment were neither supported by legal reasoning nor rigorous economic analysis but rather on the mere formulaic recital of the provisions in the FCCPA regarding the alleged abusive practice. Understandably, competition law is still nascent in Nigeria and both practitioners and enthusiasts look forward to robust jurisprudence that can help shape and grow this area of practice.