Sometime in 2016, the United Kingdom Information Commissioner’s Office placed a fine on an airline for sending an email to contacts who had previously opted out of their promotional mails. That airline, Flybe had sent those emails to some 3 million people under the guise of confirming if their contact details were correct. The question is, why would you care if my contact details is correct if I have told you I will rather not be contacted?
In another incidence, Honda Europe had sent a mail to a little under 300,000 people asking if they will like to hear from Honda. The bottom line in this email, like the Flybe version, is that they are unsolicited mails. Acting under the Privacy and Electronic Communication Regulations (PECR), the ICO had fined Flybe £70,000 while Honda had to pay £13,000. Fast forward to the new European Union General Data Protection Regulation, these fines will be considered a slap on the wrist. No. More like using a feather to slap the wrist.
Let’s come back home to Nigeria. Some years ago my wife and I had walked into a furniture showroom somewhere in Ikeja, ordered some chairs which were to be delivered the next day and for which our phone numbers were required to enable the delivery guys make contact. Little did we know that we just murdered sleep. Almost a decade after, we are still receiving promotional smses from the culprit.
Around the same Ikeja, I had walked into a shoe store some years back to pick a pair of sandals and had gone back there a couple of times after that. It seems to me however that giving my phone number as part of the invoice documentation process is an invitation to be propositioned endlessly. I have even received real estate offers from the “shoe” company. You can replace furniture and retailers with almost any other small or medium scale business in Nigeria and nothing would have changed. The question is, who regulates issues like this in Africa? Where is our own General Data Protection Regulation?
What is EU GDPR?
If I am to describe the GDPR in a simple language, I will say its the regulation that prevent’s abuse of other people’s personal information. It stipulates what you can collect, how you can collect it, how you can store it, for how long, what happens if I no longer want you to store my information etc.
Article 5 of the GDPR specifically requires that personal data shall be:
“a) processed lawfully, fairly and in a transparent manner in relation to individuals;
b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”
And there are rights! The GDPR provides the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
What about data security?
Article 5(1)(f) of the GDPR concerns the ‘integrity and confidentiality’ of personal data. It says that personal data shall be:
‘Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures’
The EU is particularly interested in data security because of the increasing prevalence of things like identity fraud, fake credit card transactions, breaches of witness protection programmes, mortgage fraud etc.
GDPR Infringement and Penalties
GDPR infringement penalties are determined by the local authorities in the country of infringement and are to be determined with the following in mind:
- Nature of infringement: number of people affected, damaged they suffered, duration of infringement, and purpose of processing
- Intention: whether the infringement is intentional or negligent
- Mitigation: actions taken to mitigate damage to data subjects
- Preventative measures: how much technical and organizational preparation the firm had previously implemented to prevent non-compliance
- History: (83.2e) past relevant infringements, which may be interpreted to include infringements under the Data Protection Directive and not just the GDPR, and (83.2i) past administrative corrective actions under the GDPR, from warnings to bans on processing and fines
- Cooperation: how cooperative the firm has been with the supervisory authority to remedy the infringement
- Data type: what types of data the infringement impacts
- Notification: whether the infringement was proactively reported to the supervisory authority by the firm itself or a third party
- Certification: whether the firm had qualified under approved certifications or adhered to approved codes of conduct.
The fines can range between €10 million, or 2% of the worldwide annual revenue of the prior financial year, whichever is higher and €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher.
Back to Africa
The Era of Do-Not-Disturb
In April 2016, Nigeria’s telecommunications regulator, the Nigerian Communications Commission (NCC) had in a letter issued by its Legal and Regulatory Department directed that Mobile Network Operators (MNOs) should henceforth only send promotional smses on an optin basis and gave them till June 30, 2016 to stop sending unsolicited messages. They were to also implement what has come to be known as DND, short for do-not-disturb. The operators were directed to dedicate a common short-code (2442) to enable subscribers optin or out of promotional messages. The success of otherwise of that directive is for all to judge. NCC started by threatening a fine of N5million Nigerian naira which has since been watered down to N500’000. That’s a huge 90% discount!
The DND directive itself has not been widely implemented by consumers as it is believed that one stands the risk of missing out on important messages once the blanket blockage is implemented. Someone had asked me for example how she will keep receiving her church’s notices usually sent via a web-to-sms platform if she implements DND. She thinks NCC should have enforced a need-to-have optin rather than a blanket optout. A need to have optin enforcement would have penalised people who sends smses without the consent of the receiving party. I agree.
The question on my mind since GDPR became a thing in Europe in 2016 is, who is protecting my own data? Who can I run to if my banking data is stolen from my favourite ecommerce site? What penalty is there for financial institutions if customer data is stolen? Who can I run to if my favourite pizza brand refuses to stop sending me unsolicited promo messages? Shouldn’t I also have a right to be forgotten? Why do we violate consent marketing rules with reckless abandon? When will our GDPR come to be? Could it be, as a collegue in our cyber security sister company joked, that only a country with good GDP will concern itself with GDPR?
What sayeth thou, Africans? Will you kindly join me in chanting: ALL WE ARE SAYING, GIVE US GDPR!!!
What has your own experience been like? Please drop a note, let’s hear your story or opinion. We won’t ‘bomb’ you with messages, we promise.