Introduction

On 28 November 2023, the Federal High Court (the Court) delivered its judgment in the case of Ikigai v National Information Technology Development Agency Suit No. FHC/ABJ/CS/1246/2022. The Plaintiff, Ikigai, a non-profit organisation, requested the Court to interpret the provisions of the Nigerian Data Protection Regulations 2019 (NDPR) and the Nigerian Data Protection Regulations 2019: Implementation Framework (Implementation Framework) concerning international data transfers.

In this article, I analyse this case and discuss its possible ramifications for international data transfers from Nigeria and the criteria to be used when assessing the adequacy of the level of protection of personal data in a third country.

Why adequacy assessment

Personal data is a critical input in the global digital economy and its international transfer is essential for the provision of various services and benefits to individuals. However, such transfers also pose significant challenges and risks for the protection of personal data and the rights of data subjects, especially when the data is intended to be processed in countries that have different or lower standards of data protection than the country of origin. Consequently, international data transfers are subject to rigorous oversight by privacy regulators and Data Protection Authorities (DPAs) due to these privacy risks. An example of this scrutiny is the decision of the Court of Justice of the European Union (CJEU) in CJEU Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, which invalidated the European Commission’s Privacy Shield Decision, the international data transfer framework between the US and EU, due to the invasive nature of US surveillance programmes, thus rendering transfers of personal data based on the Privacy Shield Decision unlawful.

Adequacy assessment is a mechanism to ensure that international data transfers are conducted in a way that respects the privacy and security of personal data and the fundamental rights and freedoms of data subjects. It involves the evaluation of the level of data protection in a third country by a DPA, to determine whether it is comparable to the level of data protection provided in the country of origin. If a third country is deemed to have an adequate level of data protection, data can be transferred to that country without any additional safeguards or authorisations. This simplifies international data transfers and reduces the administrative and legal burden for the data exporters and importers.

Adequacy assessment is important for several reasons. First, it promotes the harmonisation and convergence of data protection standards and practices across different jurisdictions, which can enhance the trust and cooperation among DPAs, consumers, and other stakeholders. Second, it eliminates digital trade restrictions to the free flow of data in cross-border business transactions, which can benefit the economy and society. Third, it safeguards the rights and interests of data subjects, who can enjoy the same level of data protection regardless of where their data is transferred or processed.

However, adequacy assessment is beset with some challenges and limitations. For example, it requires a comprehensive and rigorous analysis of the legal and institutional framework, the enforcement and oversight mechanisms, and the international commitments and obligations of the third country. In some cases, it requires continuous monitoring and review of the adequacy decision, which can be revoked or suspended if the level of data protection in the third country changes or deteriorates. Moreover, it may be affected by political and diplomatic factors, as well as by judicial interpretations and decisions, such as the judgment under review in this article and the EU case of Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (supra).

Legal framework for international data transfers under the NDPR and Implementation Framework

Under the NDPR, there are, in principle, two ways in which the transfer of personal data to third countries or international organisations is permissible. International transfers of personal data may take place on the basis of: an adequacy decision (art. 2.11); or, in the absence of such an adequacy decision, where an exemption applies (art. 2.12). Under the Implementation Framework, Binding Corporate Rules (BCRs) and Standard Contractual Clauses (SCCs) are introduced under art. 7.3 as an international data transfer mechanism where an organisation seeks to transfer personal data to another entity within its group of companies or an affiliate company.

According to art. 2.11 a) of the NDPR, the Attorney General of the Federation (AGF) supervises the transfers of personal data from Nigeria to a third country or an international organisation, which can only take place if the National Information Technology Development Agency (the Agency or NITDA) determines that the third country ensures an adequate level of protection for the personal data. The Agency has not yet defined what constitutes an ‘adequate level of protection’ for personal data. However, when evaluating the adequacy of protection, art. 2.11 b) of the NDPR requires the AGF to take into account the legal system of the third country, particularly in relation to rule of law, human rights and fundamental freedoms, relevant legislation in various areas, such as public security, defence, national security and criminal law, and the access of public authorities to personal data.

Additionally, art. 2.11 c) – e) of the NDPR requires the AGF and/or the Agency to consider other matters, such as: the implementation of the legislation, data protection rules, professional rules and security measures, including the rules for the onward transfer of personal data to another country (or recipient); the case-law, the effective and enforceable data subject rights and the effective administrative and judicial redress for the data subjects whose personal data are transferred; the existence and effective functioning of one or more independent supervisory authorities in the third country or organisation, with the responsibility for ensuring and enforcing compliance with the data protection rules, assisting and advising the data subjects in exercising their rights and cooperating with the relevant authorities in Nigeria; and the international commitments or obligations of the third country or organisation arising from legally binding conventions or instruments or from its participation in multilateral or regional systems, particularly in relation to the protection of personal data.

In transferring personal data abroad, art. 7.1 of the Implementation Framework stipulates that the following information is required: the list of countries where the personal data of Nigerian citizens and residents is transferred in the regular course of business; the data protection laws and the relevant data protection office/administration of those countries; the NDPR-compliant privacy policy of the data controller; an overview of the encryption method and data security standards; and any other detail that ensures the adequate protection of the privacy of personal data in the target country. Art. 7.2 also states that the Agency shall coordinate transfer requests with the AGF. To implement this provision, a positive adequacy decision in the form of a White List containing a list of countries that provide an adequate level of protection for personal data was established in Annexure C to the Implementation Framework. If the international data transfer is to a third country that is not on the White List, the data controller must ensure the lawfulness of such transfers, either by obtaining the consent of the data subjects or by relying on one of the exceptions provided in art. 2.12 of the NDPR. After the Agency determines that a third country provides an adequate level of protection for personal data, the transfer of personal data from Nigeria to that country becomes lawful and unrestricted.

Facts of Ikigai v NITDA and the decision of the Court

Ikigai filed a lawsuit against the Agency on 28 July 2022, seeking the interpretation of several provisions of the NDPR and Implementation Framework pertaining to international data transfers. One of the questions that the Plaintiff raised for the determination of the Court was whether the Agency, as the Defendant, was subject to the NDPR and Implementation Framework with respect to the international transfers of personal data from Nigeria to a third country and whether the NDPR and Implementation Framework mandated the Agency to grant a positive adequacy decision in the White List to only to countries that ensured an adequate level of protection for the personal data. On this basis, the Plaintiff among other reliefs, sought a declaration from the Court that Algeria, Comoros, Guinea Bissau, India, Mauritania, Mozambique, Sierra Leone, Togo and Zambia, which were included in the White List, did not provide an adequate level of protection for personal data, due to the lack of a data protection law and/or a data protection authority (DPA) in those countries. The Plaintiff also sought from the Court a declaration invalidating the BCRs and SCCs, and the White List as specified in Annexure C of the Implementation Framework.

In the main hearing, Ikigai among other things contended (and I agree) that it is impossible to assess the adequacy of protection for personal data in a country that lacks both a data protection law and an independent data protection authority. This according to Ikigai is violatory of art. 2.11 of the NDPR and art. 7.0 of the Implementation Framework. The Court sided with Ikigai by stating that the Agency, when conducting an adequacy assessment for the purpose of international data transfers, must consider the third country’s ‘Data Protection Law, Rule of law, respect for human rights, implementation of data protection rules, the existence of an independent data protection authority and its international commitments’.

Moreover, the Court held that, according to the NDPR and the Implementation Framework, the Agency had to consider the third countries contained in the White List as offering an adequate level of protection for personal data. The Court asserted that this was a mandatory condition of art. 2.11 of the NDPR and art. 7.0 – 7.2 of the Implementation Framework. In the light of this, the Court concluded that the inclusion of Algeria, Comoros, Guinea Bissau, India, Mauritania, Mozambique, Sierra Leone, Togo and Zambia in the White List is null and void since these countries lacked a data protection law or a DPA, and thus did not ensure an adequate level of protection within the meaning of art. 2.11 of the NDPR and art. 7.0 of the Implementation Framework that govern the process of international data transfers from Nigeria. The Court also stated that non-compliance with these provisions deprived the data subjects in Nigeria whose personal data were transferred to these countries of their enforceable data subject rights and their effective administrative and judicial redress mechanism. This consequently violated the right of privacy of Nigerians under section 37 of the Constitution of the Federal Republic of Nigeria (the Constitution).

Finally, the Court held that the use of BCRs and SCCs as mechanisms for international data transfers, as established under art. 7.3 of the Implementation Framework, was invalid since they were not provided for in arts. 2.11 – 2.12 of the NDPR, and thus exceeded the powers of the Agency under the NDPR. The Court based its decision on the case of Amasike v Registrar General Corporate Affairs Commission (2010) 13 NWLR (Pt. 1211) at 399, where the Supreme Court of Nigeria stated that ‘a public body or authority with statutory powers must act lawfully and avoid exceeding or abusing its powers. It must remain within the boundaries of the authority granted to it’.

Considering this and other factors, the Court granted all the reliefs requested by the Plaintiff Ikigai.

Implications for the future of international data transfers in Nigeria

The Court’s decision implies that under the NDPR, any international data transfers from Nigeria to third countries can no longer be made based on the White List. Moreover, any other country that lacks a data protection law and/or a DPA would also likely fail to meet the adequacy requirement and, therefore, any transfer of personal data from Nigeria to that country would be unlawful as well unless an exemption provided for in art. 2.12 applies. Therefore, it is recommended that before transferring personal data to third countries, data controllers in Nigeria must first confirm that a positive adequacy decision has been made by the Agency in respect of that country, or alternatively rely on any one of the exemptions provided in art. 2.12 of the NDPR. Otherwise, the transfer may be contested by data subjects as unlawful. Moreover, if such a legal challenge succeeds, the data subject may also claim compensation if there is a clear showing that the transfer breaches the constitutional right to privacy.

Furthermore, data protection compliance organisations (DPCOs) should be aware that, without any guidance from the Nigerian Data Protection Commission (the Commission), they must properly justify the legal basis of any international data transfers conducted by the companies they audit in the data protection audit report to be filed with the Commission annually. It should also be noted that the NDPR remains in force alongside the Nigeria Data Protection Act 2023 (NDPA), which led to the Agency’s transformation into the Commission. Therefore, any reference to the Agency in this article should be interpreted as a reference to the Commission for the purposes of the NDPA and NDPR.

Under the NDPA, the procedure for international data transfers is similar in some parts to the NDPR, and the lawfulness of such transfers depends on whether the third country or recipient complies with a law, BCRs, SCCs, code of conduct, or certification mechanism that ensures an adequate level of protection for the personal data (section 41 (1) (a)), or if an exemption applies (section 43 (1)). Section 42 (2) requires the Commission to consider the following factors when assessing the adequacy of the level of protection: the availability and enforceability of data subject rights, the possibility of a data subject to seek administrative or judicial redress, and the rule of law; the existence of a suitable instrument between the Commission and a competent authority in the recipient jurisdiction that guarantees adequate data protection; the access of a public authority to personal data; the existence and effectiveness of a data protection law; the existence and operation of an independent, competent data protection, or similar supervisory authority with sufficient enforcement powers; and the international obligations and agreements binding on the relevant country and its participation in any multilateral or regional organisations.

As of the date of this writing, the Commission is yet to exercise its power under the NDPA to designate any third country as providing an adequate level of protection, nor has it endorsed any BCRs, SCCs, codes of conduct, certification mechanisms or other instruments for international data transfers. Consequently, to ensure the legality and permissibility of international data transfers under the NDPA, the data controller (and/or processor) must rely on one of the exemptions provided for in section 43 (1).

Conclusion

Following the Court’s judgment in this case, the Commission is expected to conduct adequacy assessments of third countries and issue positive adequacy decisions that will enable unrestricted data transfers from Nigeria to these countries. Unfortunately, adequacy assessment was not mentioned in the Nigeria Data Protection Strategic Roadmap and Action Plan (NDP-SRAP) 2023-2027.

To this end, the Commission should as a matter of priority adopt a proactive and cooperative approach to adequacy assessments, by consulting with data controllers, processors, DPAs of the third countries, data subjects and other concerned stakeholders, and by reaffirming its adherence to the principles and standards established in both the NDPA and NDPR. A positive adequacy decision by the Commission must rely on core data protection principles present in the legal framework of that third country that align with those stipulated in the NDPA and the NDPR. It must also indicate the scope of its applicability, whether national or sectoral, and the identity of an independent public authority in charge of enforcing the data protection rules. It is further recommended that the Commission establish a robust framework to oversee and evaluate its adequacy decisions on an ongoing basis and be ready to respond to any changes or challenges that may emerge.

In conclusion, international data transfers are a vital component of the global digital economy and digital society. Therefore, DPAs must conduct adequacy assessments for international data transfers, in compliance with the applicable legislative frameworks. Adequacy assessments are a means of ensuring that the personal data of data subjects is safeguarded throughout its transit, irrespective of its destination. Finally, it must be emphasised that adequacy assessment is not only a legal requirement, but also of strategic importance for the Commission, as it can enhance its reputation, influence, and impact in the global data protection landscape.

On 31 May 2023, the Governor of the Central Bank of Nigeria (CBN) in exercising powers granted under the Banks and Other Financial Institutions Act 2020 (the Act) issued the Central Bank of Nigeria (Customer Due Diligence) Regulations 2023 (the CDD Regulations). One of the objectives of the Regulations is to provide additional customer due diligence (CDD) measures to enable Financial Institutions (FIs) to comply with the Money Laundering (Prevention and Prohibition) Act 2022, Terrorism (Prevention and Prohibition) Act 2022, CBN (Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing of Weapons of Mass Destruction in Financial Institutions) Regulations 2022 and international best practices.

The CDD Regulations require FIs to among other things, obtain the social media handle of customers for the purpose of identification. In this article, I argue why this requirement imposed on FIs by the CDD Regulations potentially violates the Data Protection Act 2023 (DPA).

What exactly is customer due diligence
According to the CBN Guidance Note on Anti-Money Laundering and Combatting the Financing of Terrorism for Other Financial Institutions 2022 (the Guidance Note), CDD ‘involves customer identification, information gathering, and monitoring’. Under the CDD Regulations, FIs are required by regulation 5 (1) to carry out CDD in the following circumstances: when business relationships are established; when carrying out transactions above the CBN designated threshold; carrying out occasional transactions that are wire transfers; when there is suspicion of money laundering, terrorist financing, proliferation financing; or when there are doubts as to the veracity or adequacy of previously obtained customer identification data.

Among other things, the CDD measures to be implemented by a FI must include the means for customer identification and verification of customer identity. Customer for the purpose of this article refers to only natural persons that are customers of a FI, thus one of the key elements of CDD is customer identification and verification through credible evidence such as original and valid identification issued by government agencies.

Are social media handles personal data
As an initial matter, the DPA is triggered every time personal data is processed. The simple act of collecting, storing or retrieving personal data constitutes a data processing operation. Personal data on the other hand is defined by the DPA as:

any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual.

Online identifier as used in this definition is a phrase borrowed from the General Data Protection Regulations (GDPR) regulating data protection in the European Union. Recital 30 of the GDPR clarifies that ‘[n]atural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags’. According to the Information Commissioner’s Office (ICO), the data protection authority in the United Kingdom, social media handles may be personal data because their use may leave traces which, when combined with unique identifiers and other information received by servers, may be used to create profiles of individuals and identify them.

For illustration, the ICO explains that:

An individual’s social media ‘handle’ or username, which may seem anonymous or nonsensical, is still sufficient to identify them as it uniquely identifies that individual. The username is personal data if it distinguishes one individual from another regardless of whether it is possible to link the ‘online’ identity with a ‘real world’ named individual.

Having established that social media handles are indeed personal data, I now turn to how their collection by FIs as part of CDD measures is violatory of the DPA.

Excessive personal data collection is contrary to the principles of personal data processing
Under the DPA, one of the principles of data personal data protection provided in section 24 (1) (c) is to ensure that the personal data processed is ‘adequate, relevant and limited to the minimum necessary for the purposes for which the personal data was collected or further processed’. This principle is otherwise referred to as data minimisation under the GDPR and in most jurisdictions with a data protection framework. This principle (and others provided for in section 24 of the DPA) must be complied with whenever personal data is processed irrespective of the lawful base, unless such data processing operation is exempt from the application of the DPA.

Data minimisation means that data controllers and processors must only collect and process personal data that is directly relevant to the specific purpose pursued by the processing operation. Thus, data controllers and processors must ensure not to obtain more personal data than is necessary from the data subject (in this case the customers) in relation to the purpose the data processing operation seeks to accomplish. Under the CDD Regulations, the purpose of collecting personal data from customers by FIs is for identification and verification of a customer’s identity.

For the purpose of identifying customers, regulation 6 (a) of the CDD Regulations requires FIs to in addition to collecting the social media handles of customers, also collect the following types of personal data: legal name; permanent address (full physical address); residential address (where the customer can be located); telephone number; e-mail address; Bank Verification Number (BVN); Tax Identification Number (TIN); and an official personal identification number or other unique identifier contained in an unexpired document issued by a government agency, that bears a name, photograph and signature of the customer such as a passport, national identification card, residence permit, social security records or drivers’ license.

While these personal data are required to be collected by FIs to enable the proper identification of customers, it is respectfully submitted that they are excessive in relation to the purpose of the processing operation and potentially violate the data minimisation principle in the DPA. As a matter of fact, only the BVN, TIN and/or official unexpired identity document issued by a government agency is required to properly identify the customer, anything more than this would be excessive data processing. In terms of verifying such official documents when provided by customers, the principle of regularity may be relied upon absent any compelling evidence challenging the validity of these documents. Thus, it goes without saying that data collection in this case is excessive and therefore unnecessary in light of the purpose of the collection since a customer’s identification and verification can easily be accomplished by excluding certain other types of personal data mentioned in the CDD Regulations.

Conversely speaking, another question is whether a FI has the technological means to verify a customer’s identity through a social media account. While another third party may be able to do so, this is unlikely to be the case for FIs considering the technical resources available to them. It is also unlikely that such a third party would be willing to disclose the identity of an individual associated with a social media account, at the request of the FI in the absence of proper authorisation under the applicable law or data protection legislation. In other words, social media handles serve no customer identification purpose as they cannot enable a FI to ascertain the identity of the individual behind that social media account.

When assessing what personal data may be collected to accomplish the purpose pursued by the processing operation, data controllers and processors are also minded to consider the adverse impact of the means of processing as well as verifying whether an alternative or less intrusive means of processing is available and has fewer adverse effects on the data subject. While the collection of social media handles may seem reasonable to the CBN, it does pose a significant privacy risk since social media handles are now considered to be an extension of the private sphere of an individual. And any processing in this regard would be deemed to be quite invasive. An example of this is when the Agencia Española de Protección de Datos (AEPD), the Spanish data protection authority, in an administrative determination ruled that the use of biometric data (fingerprints in this case) for access control by students on the premises was excessive when a less intrusive alternative like the use of identity cards would have served the same purpose.

In addition, legitimate concern exists that the disclosure of social media handles pursuant to the CDD Regulations could have a chilling effect on social media use by interfering with freedom of expression, especially if that social media handle is active and/or has massive followership. This chilling effect is a significant impediment to the fundamental rights and freedom of the data subject which the DPA seeks to safeguard in section 1(a). As I have stated elsewhere, the necessity of the personal data collected and its proportionality in relation to the purpose pursued by the processing operation must be taken into consideration by a data controller in its assessment of what personal data may be collected.

Conclusion
While the extant Nigerian Data Protection Regulations 2019 (NDPR) issued by National Information Technology Development Agency (NITDA) which predates the DPA saw minimal enforcement, probably due to stakeholders’ concerns questioning its legal basis. The DPA on the other hand is an Act of the legislature that derives legitimacy from the constitutional power of the National Assembly to make laws. On this basis, it becomes pertinent to mention that where a conflict exists between an Act of the National Assembly such as the DPA and a subsidiary legislation such as the CCD Regulations, the law is that a subsidiary legislation cannot over-rule the law, see Akanni v. Odejide (2004) All FWLR pt. 218 pg. 827 at 853; Kennedy v. INEC (2009) 1 N.W.L.R (Pt. 1123). Thus, the aspect of the CCD Regulations that infringes the data minimisation principle of the DPA can be declared null and void if challenged in court.

In any case, identity verification is a delicate matter that essentially involves the disclosure and dissemination of personal data which in turn triggers the DPA. While note should be taken that the main argument made in this article is that collecting social media handles in accordance with the CDD Regulations serves no customer identification and/or verification purposes and as such violates the data processing principle of data minimisation under the DPA. However, no assumption should be made that other requirements in the CDD Regulations do not implicate other provisions of the DPA such as purpose specification, lawful bases, transparency and information provisions and the obligation to conduct a data privacy impact assessment, the extent of which can only be determined after a comprehensive data protection analysis of the CDD measures to be implemented by FIs.

It, therefore, becomes important for organisations that regularly process personal data and/or implement identity verification processes to ensure compliance with the DPA in every aspect. As of the time of this writing, there has also been a public uproar against the collection of social media handles by FIs in compliance with the CDD Regulations. In particular, the Socio-Economic Rights and Accountability Project (SERAP), a civil society organisation that regularly engages in public interest litigations has written to the CBN asking it to ‘immediately delete the patently unlawful provisions in the Central Bank of Nigeria (Customer Due Diligence) Regulations directing banks to obtain information on customers’ social media handles for the purpose of identification’. It would be interesting to see the final conclusion of this matter and whether this would be the first test of the enforcement bite of the DPA to protect the rights and freedoms of data subjects in Nigeria.

Chukwuyere Ebere Izuogu

On Tuesday 4 April 2023, the President of the Federal Republic of Nigeria delivered the Nigerian Data Protection Bill 2023 (“the Bill”) to the Senate and House of Representatives chambers of the National Assembly for their consideration. At the Senate, the Bill is numbered SB. 1114 while it is numbered HB. 2203 at the House of Representatives. The Bill has had a chequered history from when it was first presented for public comments as a draft document by the Honourable Minister of Communications and Digital Economy (“the Minister”) in 2020 and subsequently in 2022. Now, the document is formally before the National Assembly and can be officially referred to as a Bill.

The Bill in its explanatory memorandum seeks to provide a legal framework for the protection of personal information and establish the Nigerian Data Protection Commission (“the Commission”) for the regulation of the processing of personal information, and for related matters. On Wednesday 5 April 2023, the Bill was read for the first time at both the Senate and House of Representatives. On Thursday 6 April 2023, the Bill was read for a second time at the House and committed to the House Committee of the Whole. In this note, I highlight some of the pertinent provisions of the Bill and what they mean in practice for covered organisations. I also highlight the likely next steps in the legislative history of the Bill until presidential assent.

Scope of the Bill

Clause 2 of the Bill sets out the material scope of the Bill. According to this provision, the Bill shall apply where the:

1. data controller or data processor is domiciled in, resident in, or operates in Nigeria;
2. data processing operation occurs within Nigeria; or
3. data controller and processor not being domiciled, resident or operating in Nigeria, process the personal data of a data subject in Nigeria.

The Bill defines a data controller as ‘an individual, private entity, public commission or agency or anybody who or which, alone or jointly with others, determines the purposes and means of the processing of personal data’ while a processor is defined as ‘an individual, private entity, public authority or any other body, who or which processes personal data on behalf of or at the direction of a data controller or another data processor’.

Clause 3 exempts particular processing operations, some of which are the processing of personal data carried out by one or more persons solely for personal or household purposes. Other processing operation exempted are those carried out by a ‘competent authority’ for the purposes of prevention, investigation, detection, prosecution, or adjudication of a criminal offence or the execution of a criminal penalty, or as is necessary for national security. The definition of competent authority in the Bill is so broad that it spans all the arms of government at all levels of government in Nigeria.

Definition of personal data and sensitive personal data

The Bill defines personal data to mean ‘any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual’. From this definition, it is not clear whether the use of individual refers to both living and deceased individuals. In addition, the explanatory memorandum refers to ‘personal information’ while the Bill makes copious references to ‘personal data’ which it defines. Therefore, it is unclear whether personal information and personal data mean the same thing.

Sensitive personal data is defined to mean personal data relating to an individual’s genetic and biometric data, race or ethnic origin, religious or similar beliefs, health status, sex life, political opinions or affiliations, trade union memberships or other information as may be prescribed by the Commission.

Principles of data processing

Clause 19 of the Bill sets out the principles governing the processing of personal data and these are the main responsibilities of covered organisations. In other words, these key principles serve as the conditions that must cumulatively be complied with every time personal data is processed. Under the Bill, these principles are;

1. lawfulness, fairness and transparency which essentially means that personal data must be processed only if a legal ground exists, and must be in a fair and transparent manner with respect to the individual whose personal data is processed;
2. collected for specific, explicit and legitimate purposes, and not be further processed in a way incompatible with these purposes. Data processing is specific if the purpose is sufficiently defined, it is explicit if sufficiently unambiguous and clearly expressed and legitimate where it complies with legal provisions;
3. adequate, relevant, and limited to the minimum necessary for the purpose pursued by the processing operation. Essentially this means that the data collected must be necessary and proportional to accomplish the purpose of the processing;
4. retained for no longer than necessary;
5. accurate, complete, not misleading and where necessary kept up to date having regard to the purpose of the processing; and
6. processed in a manner that ensures appropriate security of the personal data.

Lawful basis of personal data processing

Clause 20 sets out the conditions that must be satisfied for the processing of personal data to be lawful and thus not prohibited. Unlike the data protection principles which cumulatively apply, it is sufficient if at least one of the lawful basis can be identified to legitimise a data processing operation. These conditions are; consent of the data subject; the processing is necessary for the performance of a contract, the processing is necessary for compliance with a legal obligation; the processing is necessary to protect the vital interest of the data subject or other person; the processing is necessary for performance of a task carried out in public interest or in the exercise of official authority vested in the data controller or processor; the processing is necessary for the purpose of legitimate interest pursued by the data controller or processor, or by a third party to whom the data is disclosed.

Data protection impact assessment

Clause 23 (4) of the Bill states that a data protection impact assessment (DPIA) is a process designed to identify the risks and impacts of an envisaged data processing operation. A data controller is required by clause 23 (1) to conduct a DPIA prior to a processing operation, in every circumstance where the processing of personal data may likely result in a high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context and purposes. In this regard, I note that the trigger for a DPIA under the Bill differs from that under the Nigerian Data Protection Regulations 2019 (NDPR) issued by the National Information Technology Development Agency (NITDA) where it is required that a DPIA must be conducted in data processing operations involving the ‘intense’ use of personal data.

Appointment of data protection officers

Clause 27 requires data controllers to designate a data protection officer (DPO) who shall be a person of expert knowledge of data protection law and practices having the ability to carry out the tasks prescribed by the Bill. The DPO may be an employee of the data controller or engaged by a service contract.

Rights of the data subjects

The Bill enshrines in clauses 29, 31-33 the various rights of data subjects to be observed and respected by covered organisations and these rights are; right to obtain certain information from the data controller without constraint or unreasonable delay; to withdraw consent; to object to certain type of processing operations; right not to be subject to a decision based on automated processing of personal data including profiling which produces legal or similar significant effects concerning the data subject; and right to data portability. In setting out the rights of the data subject, I note that the rights to correction, erasure and restriction of processing are not stand-alone rights but rather are listed under the type of information a data subject has the right to request from the data controller.

Cross-border transfers of personal data

Clause 36 (1) (a) of the Bill provides that personal data shall not be transferred from Nigeria to another country unless the recipient of the personal data is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanisms that affords an adequate level of protection with respect to the personal data. In this regard I note the following; first, the concept of transfer is not defined so it is not clear whether it also includes accessing personal data physically located in Nigeria by a recipient that is physically outside of Nigeria. Second, the scope of this provision is restricted to only transfers to another country and does not include transfers made to another territory or an international organisation. Thirdly, ‘adequate level of protection’ as used in other data protection frameworks applies to only laws, and not to binding corporate rules, contractual clauses, and codes of conduct. Lastly, it is unclear, the exact breadth of contractual clauses contemplated as being subject to a contractual clause is not the same thing as being a party to the contract containing the contractual clauses.

Clause 38 also provides other grounds that can legitimise the transfer of personal data outside of Nigeria and they are; consent of the data subject; ‘transfer is necessary for the performance of a contract to which a data subject is a party to…’; transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and a third party; transfer is for the sole benefit of a data subject; transfer is necessary or important for reasons of public interest; transfer is necessary for the establishment, exercise or defence of legal claims; or transfer is necessary to protect the vital interests of the data subject or of another person.

Registration of data controllers and processors

Clause 39 provides that data controllers and processors of ‘major importance’ are required to register with the Commission within six months after the commencement of the Bill (when enacted) or upon becoming a data controller or processor of major importance. Clause 40 provides that the Commission may prescribe registration fees or levies to be paid by data controllers and processors of major importance.

Enforcement Authority

Clause 4 (1) establishes the Commission. Clause 6 (a) empowers the Commission to oversee the implementation of the provisions of the Bill. Accordingly, clause 41 authorises the Commission to investigate any complaint arising from the provision of the Bill. In conducting an investigation, the Commission has a lot of tools at its disposal such as powers to order a person to attend for oral examination, produce documents or furnish statement in writing made under oath. Pursuant to clauses 42 and 43 respectively, the Commission is authorised to issue a compliance order against a data controller or organisation and an enforcement order against a data controller or processor. While a compliance order may be a warning that certain acts constitute a violation, an enforcement order imposes a sanction.

Penalty provisions

Under clause 43 (3), depending on whether the data controller or processor is of major importance, the Commission may issue a penalty fee as part of its enforcement order which could range from N2,000,000 to two percent of the annual gross revenue in the preceding financial year. Clause 44 provides that a data controller or processor who fails to comply with an order of the Commission is guilty of an offence and liable upon conviction to a fine, imprisonment for a term not exceeding a year or both fine and imprisonment.

Status of the NDPR

It is pertinent to state that the Bill does not seek to repeal the NDPR. This is clearly expressed in Clause 59 (2) (f) which among other things provides that all regulations issued by NITDA or the Nigerian Data Protection Bureau (NDPB) shall continue in force as if they were issued by the Commission until repealed. This means that unless repealed or withdrawn the NDPR will concurrently apply with the Bill when it is enacted into law. However, where there exists a conflict in the NDPR and the Bill (when enacted), the provisions of the Bill as an Act will prevail over the NDPR because according to established case law in Nigeria, it is a trite principle of law that a subsidiary (or subordinate) legislation (such as the NDPR) cannot contradict or over- ride an Act enacted by the legislature.

Next steps

It appears that the Bill will be given speedy consideration at the National Assembly. However, as I have written elsewhere, there are currently three Bills on data protection before the National Assembly which according to legislative rules and practice must be consolidated with the Bill or withdrawn by their sponsors. In addition, I expect a public hearing on the Bill would be held in the next couple of weeks by a joint committee comprised of members of each chamber of the National Assembly. At the public hearing, stakeholders such as the Minister, NITDA, NDPB, civil society, human rights organisations, data protection experts and lawyers are likely to attend to make submissions supporting or opposing the Bill. On this basis, I note that some parts of the Bill remain unclear and contains some inconsistencies which may be highlighted for amendment during the public hearing.

After this public hearing, the Bill would be passed by each chamber and delivered to the President for his assent, which I expect would happen ahead of the inauguration of the incoming administration on 29 May 2023.

Conclusion

Stakeholders have looked forward to the enactment of a robust data protection legislation in Nigeria. While the NDPR is in force and currently regulates the processing of personal data in Nigeria, stakeholders are still divided on whether NITDA does have the legal authority to issue it although this question has not been tested in court as of the time of this writing. In addition, the NDPR does have several limitations, one of which is the absence of legitimate interest as a legal base for the processing of personal data.

In any case, if the Bill eventually becomes law, one of the policy objectives of pillar #1 of the National Digital Economy Policy and Strategy (2020 – 2030), which is to enact a data protection law for Nigeria would have been met, courtesy of the sustained efforts of the Minister.

On the 30^th day of September 2022, I was notified by the National Information Technology Development Agency (NITDA), the IT standards regulator for Nigeria, of my selection as a member of the National AI Volunteer Expert Group (VEG). The VEG serves as an external working group to NITDA and provides strategic advice, support, research, drafting, collating and review on all aspects related to the formulation and implementation of the national AI policy for Nigeria. The duration of this national assignment is 4 months and commences in November 2022.

For keen observers of the tech policy landscape in Nigeria, this particular effort to see that Nigeria finally has a national AI policy was expected. Recall that pillar 7 of the National Digital Economy Policy and Strategy 2020 – 2030 (NDEPS) issued by the Federal Ministry of Communications and Digital Economy (the Ministry), considers AI as an emerging technology that must be harnessed for the development of Nigeria’s digital economy in order to attain 7 of the sustainable development goals (SDGs) as prescribed by the United Nations. These SDGs are; poverty eradication; good health and well-being; quality education; decent work and economic growth; industry, innovation and infrastructure; reducing inequality; and sustainable cities and communities. These SDGs in my view, are the overarching theme that should guide the formulation of Nigeria’s AI policy. Prior to the issuance of the NDEPS, Nigeria had in November 2021 participated at the international level in the development of an international AI policy framework by adopting UNESCO’s Recommendations on the Ethics of Artificial Intelligence.

Now that the government of Nigeria has taken positive steps to develop a national AI policy, the usual questions would be how to frame this policy to ensure that it serves national interests and benefits Nigerians. One cardinal aspect of AI policy development that is common with the AI national policy in other jurisdictions and/or those proposed by AI policy experts is that AI must be responsible and trustworthy and its development grounded in a human rights framework. In my view, these are the same considerations that should be applied in developing Nigeria’s AI policy and they should be framed around the following key elements which I propose below:

i. Safety and security of AI systems

AI systems should be designed in such a manner that their use will not result in an adverse impact on individuals. In developing and deploying AI systems, the government and organisations should ensure that rules and ethical principles are the foundational building blocks required to trigger the safe and reliable operation of AI systems. Designing AI systems to be safe is to proactively ensure that individuals are not subjected to the unintended yet foreseeable risks that could possibly result from AI use. One of the ways in which this can be achieved is through standard-setting by NITDA in exercising one of its statutory powers or through the adoption of globally accepted AI standards that have been tested and validated by the various stakeholder communities. In addition, such standards must encourage the use of sandboxes where innovative AI systems are tested in a secure environment under regulatory supervision as a pre-condition for final release to the public. Lastly, operationalising safe and reliable AI systems should be strengthened with regular audit obligations to be undertaken by independent trusted third parties and risk assessment in every circumstance where using AI may be categorised as high risk based on the level of impact on individual rights and/or safety.

ii. Law enforcement/national security and military application of AI systems

The application of AI systems to law enforcement and military efforts poses serious challenges to both individual autonomy and fundamental human rights. For instance, the subject (or target) in most of these efforts is unaware of being monitored by AI systems and as a result, has not granted consent. Examples of such use by law enforcement and the military include the use of facial recognition technologies (powered by) AI in public places, surveillance technologies that monitor and/or intercept communications indiscriminately and the use of autonomous weapons systems in the battle space. While such use by AI may be necessary to meet the state’s obligation to protect lives and defend the state. However, this must be done in a manner that respects existing fundamental human rights norms and legally recognised rights, and be subject to robust judicial or regulatory oversight.

Being right respecting means that AI systems must be designed or deployed in such a manner that takes into consideration all the rights guaranteed by law such as the rights to life, privacy, freedom of expression, freedom of movement and freedom from discrimination. While oversight requires a pre-deployment assessment of the potential harms to individuals in using such AI systems, and if deployed, a speedy resolution of complaints by individuals alleging an infringement of their rights through the use of such AI systems. In this regard, it is important to mention that the exemption from the application of the recent data protection bill (yet to be presented to the National Assembly) of data processing operations done for the purpose of criminal investigation is absolutely a bad idea, that can be abused by law enforcement agencies and the armed forces.

iii. AI liability

It is important to bear in mind that the adoption of clear standards governing the safe use of AI systems will not totally eliminate all the harm arising from their use. This harm which could be pecuniary or non-pecuniary ordinarily should help establish the liability of the user and/or developer of such AI systems but unfortunately, this is not always the case. For example, to sustain a claim for liability under Nigerian tort standards, there must be a causal connection between the tortious activity and the resulting damage. However, this can be difficult to establish in situations where the AI system facilitated the harm suffered.

For instance, where the harm suffered is damage to data, an intangible, it may be difficult to argue in court that such an intangible asset qualifies as a physical property that is capable of being damaged. Another limitation of the traditional concept of tort in substantiating liability is the difficulty in proving that the act challenged for causing the harm is a direct consequence of the conduct of the user or developer of the AI system, especially if the AI system involved is self-learning or its initial action has been modified as a result of external data acquired during the normal course of operation.

For this reason, the AI national policy should broadly consider the importance of framing rules for imposing liability especially as AI technologies gain traction and mature in Nigeria. These considerations may take cognisance of the various actors (developers, deployers and users) present in the entire value change of AI and the multiple scenarios of AI use/development that could give rise to liability for which an individual suffering the resulting harm could confidently pursue damages.

iv. Trustworthiness, explainability and fairness of AI systems

AI is trustworthy if it complies with the law and adheres to ethical principles. Explainability means that to trust AI systems, an individual that has been adversely affected by AI decision-making must be provided with an explanation of how and why the AI system arrived at such a decision. Fairness means that AI must not churn output that could discriminate, lead to bias or amplify social inequalities. For AI to remain trustworthy, explainable and fair, AI experts have suggested prescriptive governance mechanisms requiring humans to always intervene or have control over AI systems. Human control is important to mitigate the opportunity for AI in their decision-making, to deviate from what the developers originally intended and/or what was expected by the users. In this regard, the AI national policy may want to consider prescriptive mechanisms that can be implemented to achieve this such as human-in-the-loop, human-on-the-loop and human-in-command. Irrespective of the preferred mechanism, it is very important for the human behind the machine to be properly identified and tasked with ensuring that the operations of critical AI systems are aligned with their required functionalities.

v. Competition, innovation and growth of local content

It bears emphasis to note that very few tech companies have the resources to invest in continuous AI research and development, and because of this AI systems are concentrated in a handful of tech companies from the global north. To ensure that the AI market in Nigeria remains competitive for homegrown AI systems, the AI national policy must obligate specific fair market practices to level the playing field. Understandably, competition law exists in Nigeria but these rules would most likely apply after the harm to the market and/or competitor has occurred. The proposal made here is for the application of specific ex-ante rules to apply within the AI market irrespective of whether market power has been found to exist or not. A suggestion I would readily propose in this regard would be to require AI developers, deployers and users to grant access to their datasets which can be used in the development of AI systems. Public sector organisations that develop AI may also be encouraged to release their AI system to the general public as open source in order to create opportunities for community collaboration that has the potential to accelerate innovation beneficial to Nigerians and to the nation. Alternatively, data governance models like data trusts may be considered if it has a chance of tilting the power asymmetry from AI-powered platforms to users and/or data subjects.

Conclusion

Without prejudice to the foregoing, the AI national policy must also be subject to a robust public consultation that is undertaken when the AI policy is still at a formative stage; adequate information must be provided to enable participants to properly respond; adequate time must be provided in which to respond and lastly NITDA must consider all responses to the consultation. This is to give the final version of the AI policy legitimacy if stakeholders were given an opportunity to contribute and participate in its development. It is also important to stress that all the elements proposed are meant to apply irrespective of the sectoral or cluster application of the AI systems.

AI is globally recognised as having serious potential that benefits the digital economy and society as a whole. This recognition is consistent with Nigeria’s commitment to harness AI to meet the 7 SGDs. However, the flip side of AI use is to realise its socially disruptive nature and the various challenges its application poses to both individual and society. Whilst Nigeria’s national AI policy will no doubt establish a framework on how AI may be developed, deployed and used in order to unlock its benefits, NITDA must as a matter of importance also ensure that the resulting benefits are not overshadowed by the risks associated with AI use. The answer to this will ultimately rest on the approach adopted by the federal government and by extension NITDA in the AI national policy.

This post represents my personal opinion and should not be construed as the opinion of the National AI Volunteer Expert Group or NITDA.

by Chukwuyere Ebere Izuogu

In 2019, the Federal Competition and Consumer Protection Commission Act (FCCPA) was enacted into law. The FCCPA is Nigeria’s first federal competition and consumer protection statute. The FCCPA also establishes the Federal Competition and Consumer Protection Commission (the Commission) and the Federal Competition and Consumer Protection Tribunal (the Tribunal), respectively, as the enforcer and adjudicator of both competition and consumer protection claims in Nigeria. On 29 March 2022, the Tribunal received its first case challenging among other things the alleged anti-competitive practice of Multi-Choice, the first defendant, a pay-TV provider in Nigeria.

In September 2022, the Tribunal delivered judgment in this case wherein it absolved Multi-Choice of any liability whatsoever for the alleged anti-competitive act. In this short note, I highlight a fundamental error in the reasoning of both claimant and the Tribunal. I also highlight some key takeaways from this case that are likely to have an impact on litigating future competition-related claims under the FCCPA. This note draws on several posts I have previously written here, here, here and here in respect of competition issues in Nigeria.

Factual Background

The origin of this case can be traced to a complaint dated 19 May 2020 and titled ‘Powers of the Commission to Regulate Price; Abuse of Power of Dominance in Market and Impending Price Hike by Multi-Choice/DSTV in Nigeria’ made by the claimant against Multi-Choice before the Commission. In this complaint, the claimant alleged among other things that Multi-Choice’s ‘incessant price increment is repressive, unjustified, unfair and uncalled for’. Unfortunately, according to the claimant, the Commission failed to resolve this complaint in the period leading to the commencement of the case at the Tribunal. In March 2022, Multi-Choice announced another increase in the price for its pay-TV services. According to the claimant, the failure of the Commission to resolve the complaint can ground the invocation of the Tribunal’s power as provided for in section 47 of the FCCPA.

The Fundamental Error

After dispensing with several procedural questions, the Tribunal was invited by the claimant to determine the substantive issues, among which was the question of whether Multi-Choice’s history of price increases constitutes an abuse of a dominant position within the meaning of sections 70 and 72 of the FCCPA. Section 70, particularly subsections 1 and 2 describes the circumstances in which an undertaking is dominant or has market power in a particular market. Section 72 (1) prohibits the abuse of a dominant position by an undertaking while section 72 (2) provides a list of practices that are deemed to be abusive if engaged by a dominant undertaking (or a group of dominant undertakings). Of note here is charging an excessive price to the detriment of consumers provided in section 72 (2) (a), which was the basis of the claimant’s case that Multi-Choice price increases constitute an abuse of a dominant position.

In arguing his case, the claimant among other things contended that Multi-Choice ‘does not only occupy a [d]ominant position but has consistently abused their [d]ominant position … on countless occasions unilaterally and independently without recourse to the consumer, customer or even the regulator (sic) increased the prices of its products and services. The Tribunal in determining this question also stated that ‘there is indeed no doubt that [Multi-Choice] occupies a [d]ominant position’, and further that ‘there is no proof that [Multi-Choice] (though occupies a dominant position) abused her position of dominance’ thereby indirectly affirming the claimant’s argument that Multi-Choice occupies a dominant position.

It is important to note that in resolving this question, nowhere in the judgment nor in any argument made by the claimant was the relevant market in which Multi-Choice is stated to be dominant, defined or identified. Herein lies the error of this case.

The Importance of Market Definition

The general rule in competition law when assessing dominance or market power is to first define the relevant market in which market power can be inferred. In other words, market definition is fundamental when assessing market power and if an abuse of such power has occurred or is likely to occur. The importance of market definition in a dominance assessment is reinforced by Regulation 5 (1) of the Abuse of Dominance Regulations 2022 (the Dominance Regulations) which provides that delineating (or defining) the relevant market shall be the first step when determining whether an undertaking is in a dominant position.

In the words of the Commission in Paragraph 1 of the Notice of Market Definition 2021 (the Notice), market definition is the ‘necessary first step needed to determine whether an undertaking has market power since there can be no market power without a market’, thus market definition is the first step in any dominance assessment. According to Paragraph 2 of the Notice, the relevant market comprises two dimensions, namely the product market and the geographic market. Importantly, Paragraph 3 of the Notice provides ‘Whilst it is not an end in itself, the definition of the relevant market in both its product, geographic and temporal dimensions often has a decisive influence on the outcome of a competition case’.

While the relevant product market comprises all those products which are regarded as interchangeable or substitutable by the consumer, by reason of the products’ characteristics, prices, brand, and their intended use, the geographic market on the other hand is defined in terms of the location of suppliers, and it includes. those suppliers that customers consider to be feasible substitutes, which may be local, statewide, regional, national or wider. Therefore, product markets and geographic markets are respectively determined on the basis of consumer choice and supplier location.

In addition, case laws from other competition jurisdictions also support the statement that market definition is important when assessing market power. For instance, in the EU, Case 27/76 United Brands Company and United Brands Continental BV v. Commission of the European Communities [1978] ECR 207, makes clear that in order to determine market power, it is necessary to first define the relevant market. In extreme cases, the failure to properly define the relevant market can lead to the nullification of the decision of the competition authority as seen in Europemballage Corporation and Continental Can Company Inc. v. Commission of the European Communities [1973] CMLR 199. In the US, the position is the same according to Brown Shoe Co. v. United States, 370 U.S. 294 (1962) where the US Supreme Court held that the ‘determination of the relevant market is a necessary predicate to a finding of’ an antitrust violation, and in Queen City Pizza, Incorporated v. Domino’s Pizza Incorporated., 922 F. Supp. 1055 (E.D. Pa. 1996) where a US District Court held that in order to state an antitrust claim, the ‘plaintiff must [first] identify the relevant product and geographic markets’.

Having established the importance of market definition, it becomes pertinent to note that failure to define the relevant market is fatal to any abuse of dominance case commenced under the FCCPA. This is because the obligation to define the relevant market is mandatory having reference to the use of shall in Regulation 5 (1) of the Dominance Regulations. According to well-established Nigerian case laws, the use of shall in a statute connotes a command that it is imperative, mandatory and admits no discretion. Thus, failure to define the relevant market in determining dominance is likely to render invalid any conclusion resulting from such a determination.

The Takeaways

Some of the key takeaways from the judgment of the Tribunal in this case are:

1. It is not mandatory for an aggrieved consumer who seeks to enforce his right to first make a complaint to the FCCPC as he can directly approach the Tribunal in the first instance;
2. For an undertaking to be considered as abusing its dominance, it must engage in all the practices listed in section 72 (2) of the FCCPA (Although I disagree with the interpretation of the Tribunal as each of these practices alone is sufficient to sustain a claim that an undertaking is abusing or has abused its position of dominance in the relevant market); and
3. To sustain a claim of excessive pricing within the meaning of Section 72 (1) (a) of the FCCPA, the claimant must make a clear showing that the price is either ‘excessive’ or ‘detrimental’ to consumers

Conclusion

Despite the failure of the claimant to define the relevant market, one wonders why Multi-Choice did not challenge this failure in any of its arguments made before the Tribunal on the ground that the claimant has not satisfied the burden of proof required to establish dominance, let alone abusing that position of dominance by engaging in an excessive pricing practice. Even if this standard of proof was met, for the claimant to be entitled to the reliefs sought from the Tribunal, he must establish that Multi-Choice’s alleged abuse of a dominant position resulted in an identifiable ‘injury’ to himself (or to existing competitors of Multi-Choice in the relevant market), rather than a violation of his right as he did before the Tribunal. An identifiable injury exists where there is evidence that the claimant has suffered (or will suffer) some harm as a result of the alleged abusive practice. In other words, there must be a causal link between this identifiable injury and the challenged excessive pricing practice of Multi-Choice. From a consumer-facing perspective, the identifiable injury will include the various ways in which Muti-Choice’s alleged abusive practice impacts the availability and pricing of pay-TV services within the relevant market.

In any case, even if the relevant market was properly defined, the analysis must convincingly show that Multi-Choice is indeed dominant in that market. And this is no easy feat for pay-TV services when considering the rate of innovation in viewing broadcasting content, consumer choices and the likelihood of non-broadcasters entering the broadcasting market and/or owning broadcasting content, all key factors that must be considered when defining the relevant market in which Multi-Choice is alleged to have abused its dominance. Unfortunately, in this case, the claimant’s statement that Multi-Choice is dominant and the Tribunal’s confirmation of this statement in its judgment were neither supported by legal reasoning nor rigorous economic analysis but rather on the mere formulaic recital of the provisions in the FCCPA regarding the alleged abusive practice. Understandably, competition law is still nascent in Nigeria and both practitioners and enthusiasts look forward to robust jurisprudence that can help shape and grow this area of practice.