THE RIGHT TO BE FORGOTTEN –REALITIES UNDER THENIGERIAN DATA PROTECTIONLEGISLATION

A P R I L 2 0 2 0

A R T I C L E S E R I E S

The Internet is reputed to have a memoryand it is not quick to forget. Every onlineaction is committed to a digital record andstored online to be accessed at anymoment.[1] In recent times, due to theinvasive nature of the Internet, argumentshave been made that Data Subjects(persons whose data/information are beingused) should be allowed to enjoy theirprivacy and be entitled to the right to beforgotten. This right has to be consideredvis-à-vis public interest and the economicright of the publisher of the information.For example, if there is valuableinformation on the Prince of Wales that ispublished online, can the Prince of Wales,as the Data Subject, exercise his right tobe forgotten and demand that the newsitem be deleted? This article will explore the right to beforgotten, how it can be exercised andwhat has to be taken into consideration bythe courts in different situations.

1

INTRODUCTION

[1] Sophie Perryer, The internet never forgets, but people do, The New Economy - https://www.theneweconomy.com/technology/the-internet-never-forgets-but-people-do accessed on 4 March, 2020[2] Available on the EUR-Lex website at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62012CJ0131#t-ECR_62012CJ0131_EN_01-E0001 andaccessed on 4 March 2020[3] Intersoft consulting, available at https://gdpr-info.eu/issues/right-to-be-forgotten/ and accessed on 4 March 2020

auction connected with attachmentproceedings for the recovery of socialsecurity debts. He contended that theattachment proceedings had been fullyresolved for a number of years and thatreference to them was now entirelyirrelevant. He, therefore, demanded thatthe offensive online information shouldbe deleted as it was inaccurate. While delivering its ruling, the CJEUconsidered the privacy rights of thecomplainant over Google’s economicinterest. The court stated that theattachment proceeding was ubiquitous asit was not only accessed by Google Spain,but also by everyone through the parentbody, Google Inc. Consequently, the courtmade its ruling in favour of Mr Gonzalezand held that the information regardingMr. Gonzalez and the attachmentproceedings should be deleted. Thisdecision has served as a locus classicusand reference authority on the right to beforgotten.

BACKGROUNDThe right to be forgotten has its originfrom the case of Google Spain SL, GoogleInc v. Agencia Española de Protección deDatos, Mario Costeja González (2014)[2]and was subsequently codified in theEuropean Union General Data ProtectionRegulations (“GDPR”).[3] In this landmarkcase, Mr Costeja González, a Spanishnational resident in Spain, lodged acomplaint before the European Court ofJustice (“the CJEU”) against two nationaldailies, Google Spain and Google Inc. Hecomplained that upon entry of his name inthe search engine of the Google group(“Google Search”), the informationassociated with his name was a real-estate

APPLICATION OF THE RIGHT IN NIGERIAIn 2019, the Nigerian Data ProtectionRegulation (“NDPR”) was introduced andone of its highlights is the recognition ofthe rights of Data Subjects including theright to be forgotten. Although there hasbeen no case law or judicial authority inNigeria on the right to be forgotten, theNDPR entitles a Data Subject to requestthe deletion of personal data.Interestingly, this right is not absoluteand will only be granted in certaincircumstances.

Section 3.1(9) of the NDPR provides that aData Subject will have the right torequest the deletion of his/her personaldata, and the data controller is to deletethe data in certain circumstances such as,where: a) the personal data is no longernecessary in relation to the purpose forwhich it was collected or processed. Thuswhere, for instance, information wascollected for employment purposes andthe Data Subject subsequently leaves theorganisation, the ex-employee canrequest that certain informationregarding his employment, that is nolonger necessary, be deleted; or b) the Data Subject withdraws consent onwhich the processing is based (forinstance, websites now have cookieswhere you can click consent or untick theconsent box); or c) the Data Subject objects to theprocessing and there are no overridinglegitimate grounds for the processing(overriding legitimate grounds couldinclude public interest, vital interest); or e) the personal data must be erased forcompliance with a legal obligation inNigeria.

ISSUES ARISING

2

A critical issue to consider inimplementing the right to be forgotten isthe cross border nature of the Internet. Inthe popular case of Google v CNIL[4] theCJEU held that there was no obligationunder the European Union (EU) law forGoogle to apply the European right to beforgotten globally. The decision clarifiesthat while EU residents have a right to beforgotten flowing from the GDPR, itsterritorial limitation is only applicable tothe EU states.  The CJEU further held thatthe right to protection of personal data isnot an absolute right but must beconsidered in relation to the function insociety and be balanced against otherfundamental rights. It is anticipated that the Nigerian Courtsmight lean towards the territoriallimitation of this right on the basis ofsovereignty which recognises the fullright and power of a nation to exercise itsterritorial independence without anyinterference from another nation.   Additionally, in some instances, theconcept of total erasure of theinformation may be unattainable. A quickunderstudy of some of the decisions ofthe Belgian Court of Cassation (“BCC”)reveals this.[5] For instance in 2016, theBCC ordered a newspaper to anonymisean online version of its 1994 newspaperarticle concerning a fatal road trafficaccident that the applicant had causedthrough drunk driving.

[4] Available on the curia.europa.eu website at http://curia.europa.eu/juris/document/document_print.jsf;jsessionid=FF2068A68B302A60C12B4191B752D64D?docid=218105&text=&dir=&doclang=EN&part=1&occ=first&mode=DOC&pageIndex=0&cid=1704403 and accessed on 4 March 2020[5] Case Law, Belgium: Olivier G v Le Soir: “Right to be forgotten” requires anonymisation of online newspaper archive’ Olivier G v. Le Soir (29 April 2016,n° C 15 0052 F) accessed via http://private-law-theory.org/?p=9441 on 27 March, 2020.

d) the personal datahave been unlawfullyprocessed (probably without the consentof the Data Subject or processed beyondthe consent obtained); or

Since the complainant had spent hisconviction, the BCC upheld his right to beforgotten on the condition that the eventactually occurred and the report per se isjustifiable. The BCC while giving itsdecision, stated that where total erasuremay not be achieved in the circumstance,suppression of the personal data may be asuitable alternative. The alternative to total erasure could bedata minimisation techniques such asanonymisation[6], encryption[7] andpseudonymisation[8]. Even though thishas been argued by many as being asound approach, it appears to be totallyunattainable where the reports arecontained in texts or history books thathave been published and sold to thegeneral public. Nonetheless, the nature ofthe document will dictate the mostefficient erasure technique. Furthermore,where the right to erasure is notachievable, it is our opinion that acombination of the data minimisationprinciple may be an effective measure toreach similar goals (privacy).

CONCLUSION

3

As application of the right to be forgottenis novel in Nigeria, a lot of trainings willbe required for judges to understand theprinciples of the NDPR and the rights ofData Subjects. Furthermore, organisationsshould employ the use of a disposalschedule.[10] This will serve as a guidefor determining how and when personaldata is to be destroyed and it willpromote the effectiveness of DataSubject’s right to be forgotten.

[6] Anonymisation means processing data with the aim of irreversibly preventing the identification of the individual to whom it relates. It is the most secure and isintended for information that should never be converted or shown to users.[7] For the implementation of encryption, an encoding algorithm can be used to turn into unreadable data all the information submitted. Thus, the encrypted informationwill appear as a sequence of meaningless characters.[8] Pseudonymisation is implemented when a series of sensitive information is linked not directly to the name, surname, social security number or email address, but to asecret code (pseudonym).[9] Joseph Steinberg, Why Americans Need and Deserve the Right to be forgotten, accessed via inc.com/joseph-steinberg/why-americans-need-deserve-right-to-be-forgotten.html on 2 April 2020.[10] A disposal schedule sets out the minimum amount of time specific types of records must be kept in accordance with legal obligations.

The rationale behind the right to beforgotten is that it is the interest of all ofhumanity that people are not adverselyjudged and/or punished as a result ofsome old infraction that does notrepresent their extant interests.[9] Withthis right, Data Subjects will be confidentthat there are regulations to their onlinepresence, slanderous or embarrassingstatement can be removed from thepublic view and every individual can havethe privacy they desire.

@ae lexpa r tne r s

C O P Y R I G H T : A l l r i g h t s r e s e r v e d . N o p a r t o f t h e p u b l i c a t i o n m a y b e r e p r o d u c e d , s t o r e d i n ar e t r i e v a l s y s t e m o r t r a n s m i t t e d i n a n y f o r m o r b y a n y m e a n s w i t h o u t t h e p r i o r p e r m i s s i o n i nw r i t i n g o f Ǽ L E X o r a s e x p r e s s l y p e r m i t t e d b y l a w .   D I S C L A I M E R : T h i s p u b l i c a t i o n i s n o t i n t e n d e d t o p r o v i d e l e g a l a d v i c e b u t t o p r o v i d e i n f o r m a t i o no n t h e m a t t e r c o v e r e d i n t h e p u b l i c a t i o n . N o r e a d e r s h o u l d a c t o n t h e m a t t e r s c o v e r e d i n t h i sp u b l i c a t i o n w i t h o u t f i r s t s e e k i n g s p e c i f i c l e g a l a d v i c e . Ǽ L E X i s a f u l l - s e r v i c e c o m m e r c i a l a n d d i s p u t e r e s o l u t i o n f i r m . I t i s o n e o f t h e l a r g e s t l a w f i r m s i nW e s t A f r i c a w i t h o f f i c e s i n L a g o s , P o r t H a r c o u r t a n d A b u j a i n N i g e r i a a n d A c c r a , G h a n a .  

C o n t a c t u s a t :

4 t h F l o o r , M a r b l e H o u s e ,  1 K i n g s w a y R o a d , F a l o m o I k o y i ,L a g o s , N i g e r i a

T e l e p h o n e : ( + 2 3 4 - 1 ) 4 6 1 7 3 2 1 - 3 , 2 7 9 3 3 6 7 - 8 , 7 4 0 6 5 3 3 ,                          

E - m a i l : l a g o s @ a e l e x . c o m

t o f o l l o w o u r s o c i a l m e d i a h a n d l e sc l i c k b e l o w

C l i c k h e r e w w w . a e l e x . c o m

Ǽ L E X i s a f u l l - s e r v i c e c o m m e r c i a l a n d d i s p u t e r e s o l u t i o n f i r m . I t i s o n e o f t h e l a r g e s t l a w f i r m s i nW e s t A f r i c a w i t h o f f i c e s i n L a g o s , P o r t H a r c o u r t a n d A b u j a i n N i g e r i a a n d A c c r a , G h a n a . A p r o f i l eo f o u r f i r m c a n b e   v i e w e d h e r e .   Y o u c a n a l s o v i s i t o u r w e b s i t e a t   w w w . a e l e x . c o m   t o l e a r n m o r ea b o u t o u r f i r m a n d i t s s e r v i c e s . ’

Florence

Bola-Balogun

Opeyemi

Adeleke