INTRODUCTION

Information is power and data is now the new gold. Data protection and privacy is an extension of the fundamental rights of citizens, privacy of their homes, correspondence, telephone conversations and telegraphic communications, therefore every individual must be aware of their rights in this respect and the legal options available to them for protection or redress for breach of the duty to protect such rights.

The 21^st century is dubbed as “the information age” and virtually everyone on the planet has their personal data i.e., name, address, pictures, email address etc. online. Sensitive personal information that can be exploited to harm users for economic and other gains is contained therein, therefore, it is pertinent to protect these data and regulate the way data is used.

Data subjects are individuals who can be identified, directly or indirectly, via an identifier such as a name, an ID number, location data, or via factors specific to the person’s physical, physiological, genetic, mental, economic, cultural or social identity.[1] They must be given the opportunity, based on adequate information, to decide whether or not they want to share some information; who has access to it; for how long; for what reason and also be able to modify some of this information, if necessary.

Data is described as individual units of information, which may be measured, collected, reported, stored and analyzed while privacy is your right to be left alone.[2] Data protection is the process of safeguarding important information from corruption, compromise or loss. This is essential to ensure that data can be restored quickly after any corruption or loss. Data protection is your insurance that you will be able to exercise your right to privacy when you want it and if you want it.

Typically, internet subscribers and social media users are required to provide personal data and sensitive information to facilitate access and use of these platforms. Almost all transactions conducted online require the release of some form of personal data. That is why as social media or internet users we must often be advised on data privacy terms.

SCOPE OF YOUR RIGHTS

Your right as a Data Subject includes: –

1. 1.  Right to be informed of appropriate safeguards for data protection – where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the appropriate safeguards.[3]
   2.  Right to input minimum requirements of your personal data – Do not overly share your personal information, especially where such information are tagged as optional.
   3.  Right to rectification – Individuals have the right to have personal data rectified.[4] You can rectify personal data if it is inaccurate or incomplete. You must rectify any inaccurate personal data that relates to the individual without undue delay, and in any event within one month.
   4. Right to request for erasure of personal data in appropriate cases – Individuals can make a request for erasure verbally or in writing.[5] The right is not absolute and only applies in certain circumstances, which includes where the personal data is no longer necessary for the purpose which you originally processed it for; and where you have to do it to comply with a legal obligation;
   5. Right to data portability – here, individuals are allowed to obtain and reuse their personal data for their own purposes across different services[6] (i.e. to move, copy or transfer personal data easily from one I.T environment to another in a safe and secure way, without affecting its usability).
   6. Right to object – you have the right to object to an organization using your personal data at any time (i.e. you can stop or prevent the organization from using your data).[7]
   7. Right against automated decision-making including profiling – you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects him or her.[8]
   8. Right to complaints – every data subject has the right to lodge a complaint with a supervisory authority of an alleged infringement.[9]
   9. Right to damages ­– any person who has suffered material or non-material damage as a result of an infringement of his/her right shall have the right to receive compensation.
   10.  

1. Know who you share your information or personal data with. (Be alert to impersonators) – Before entering personal information into a website, take a look at the top of your browser. If there is a lock symbol and the URL begins with “https,” that means the site is secure. There are a few other ways to determine if the site is trustworthy, such as a website privacy policy, contact information, or a “verified secure” seal.
2. Safely dispose of your personal information ­– Before you get rid of your old computer, delete your personal information from the hard drive so it doesn’t end up in the hands of an identity thief.
3. Encrypt your data – Encryption helps protect your online data by turning personal information into “for your eyes only” messages intended only for the parties that need them — and no one else. You should make sure that your emails are being sent over an encrypted connection, or that you are encrypting each message. Encryption offers a kind of control but it has to be the right kind of encryption. If a specific file or email is encrypted properly, you can control who can read it at all times. Even if there is a data breach of your IT system and unauthorized individuals gain access to the data, they will not be able to read it and a data breach with respect to that data is avoided. Most email clients come with the option for encryption in their Settings menu, and if you check your email with a web browser, take a moment to ensure that SSL encryption is available.
4. Keep passwords private – ensure you create strong passwords, avoid using numbers that include you contact number or your birth date, also create a unique password instead of using the same password across multiple sites (a password manager tool can help you keep track).
5. Don’t overshare personal information’s about you on social networking sites – don’t be that one friend who posts too many intimate details of their life online, it can also put your personal information at risk. Check your privacy settings so you are aware of who’s seeing your posts, and be cautious when posting your location, hometown, birthday, or other personal details.
6. Keep your devices secure – Use security software like anti-virus software, anti-spyware software, and a firewall.
7. Avoid phishing emails – Cyber squatters and Typo squatter are sneaky, and will often compose their phishing scams to look like legitimate communications from a bank, utility company, or other corporate entity. Certain things like spelling errors or a different email address than the typical sender can be a clue that the email is spam.
8. Be wise about Wi-Fi – Most free public Wi-Fi networks have very few security measures in place, which means others using the same network could easily access your activity.
9. Read Privacy Policies (Very Important) – what to note while reading a privacy policy;

• • The type of information that’s been collected.
  • How your information is gathered e.g., through browser cookies.
  • Identify whether any third parties or organizations will have access to your information.
  • Whether there are instructions on how to opt out of information sharing and the consequences of doing so.
  • Whether the site has security protocols.
  • Provide contact information for further inquiries

NOTE: The user should periodically visit the privacy policy page to check for any update

• Consider additional protection – For additional protection, you may want to consider cyber insurance, which can keep you and your family safe if you fall victim to a cyber-attack. Now, Cyber insurance is an insurance policy that covers financial losses resulting from data breaches and other cyber events.It is simply were a network user risks transferred to an insurance company.

CONSEQUENCES OF A DATA BREACH

A data breach is a security incident of unauthorized release of private and sensitive information. The most frequent scenario is when a cybercriminal infiltrates a database and compromises sensitive data, whether it’s just merely that data or copying, transmitting or using it in any way. Data breaches can expose personal information, financial information from individuals and corporate secrets, their software codes, customers and even intellectual property.[10] Now, despite great emphasis that is being place on data security, cybercriminals are still finding new ways to gain access to data. They are trying every available tactic to infiltrate, expose and profit off sensitive information of data subjects. According to a Risk-Based Security research report, within the first nine months of 2019, 5,183 breaches were reported, exposing more than 7.9 billion compromised records. Compared to 2018, the total number of breaches was up 33.3% and the total number of records exposed more than doubled, up 112%.[11] Below are some of the after come of a data breach;

1. 1. 1. Loss of Sensitive Data – A data breach usually results in the loss of sensitive personal data, the consequences can be devastating. Personal data is any information that can be used to directly or indirectly identify an individual. This will include everything from a name to an email address, IP address and images. It also includes sensitive personal data such as biometric data or genetic data which could be processed to identify an individual. The reality is that if a personal or business account got deleted as a result of a data breach it could have a serious knock-on effect on the business of a person and ultimately their life. The fallout from breaches that expose this data can be disastrous and exceed any financial and reputation damage.
   2. 2. Financial Loss – The financial impact of a data breach is undoubtedly one of the most immediate and hard-hitting consequences that individuals or corporations will have to deal with and the ever-growing breadth and depth of artificial intelligence offers small business owners and criminals alike the benefits of evolving technical opportunities. A breach can also significantly impact a company’s share price and valuation. This is exactly what happened to Yahoo after it was breached in 2013. The breach came to light in 2016 when the company was about to be bought over by US telecoms company Verizon. The acquisition went ahead with the company buying Yahoo for a discounted rate of $4.48 billion, around $350 million less than the original asking price.

1. 1. 3. Reputation Damage – Any time a hacker steals your data, it is to blackmail you. One criminal can sell your data or use your private information as part of an espionage scheme. The reputational damage resulting from a data breach can be devastating for a business. Target Research in 2019 shows that up to a third of customers in retail, finance and healthcare will stop doing business with organizations that have been breached. Additionally, 85%will tell others about their experience, and 33.5% will take to social media to vent their anger. News travels fast and organizations can become a global news story within a matter of hours of a breach being disclosed. This negative press coupled with a loss in consumer trust can cause irreparable damage to the breached company. Reputational damage is long-lasting and will also impact an organization’s ability to attract new customers, future investment and new employees to the company.
   2. 4. Client Loss – A data breach can ruin trust in your brand, and it can take years to repair the damage.Every data compromise weakens an individual brand as well as a business’s brand, which leads to client mistrust. Even when a data breach doesn’t force your existing customers away, you will find it considerably more challenging to attract new customers and if customers don’t believe you are protecting them properly, they will leave. Simultaneously, your competitors may take advantage of the publicity surrounding your data breach and contact your customers to poach them. The bottom line is that you will lose clients due to a data breach, so why wait for a breach to happen? Smart businesses work on prevention, and you should, too!

REMEDIES

As an individual brand or a business entity, you must have a plan on crisis response for cyber hacks. Now, if your business or personal account gets hacked and you’re caught unawares, there are numerous things you can do, such as:

• Immediately notify your employees and clients

NOTE: Besides taking the steps of notifying clients and workers and creating a safer security system for your files, you also must take the time to reach out to the public and your client’s. Create a press release and send this out to local news, social media, and your website once it’s up and running again. Ensure that your statements are accurate and honest. Don’t issue public statements without consideration for the implications of what you’re saying and how you sound.

• Contact your lawyer to lodge a complaint at National Information Technology Development Agency[12] and also where there has been unintentional violation of the information of data subjects where you are a data controller.[13]
• Conduct a forensics investigation immediately to close corrupted endpoints.

Once you’ve closed your corrupted endpoints, you’ve contacted your employees and customers. You’ve recovered all of your data. The clouds have parted and a ray of sunshine has cascaded onto your desk. Not so fast. Although it may seem as if your crisis has ended, you’ll want to continue to aggressively and proactively monitor your network to ensure there are no follow-up attacks.

If you do not send a notice out to people involved, you did not have a response plan ready, and did not immediately put new security measures, you may end up in litigation.

CONCLUSION

We must know that one of the legal bases for processing personal information is where the CONSENT of the Data subject has been obtained.[14] Consent as a condition for processing personal information must be specific; it must be informed and freely given. This means that people must understand what their data is to be used for and there must be a clear indication that they consented to that use. The consent of the Data Subject shall not be obtained by fraud, coercion or undue influence.[15] As Data Subjects, we must be aware of his right to withdraw his consent at any time[16] (provided that he is bound by acts carried out pursuant to initial consent before withdrawal), and data subjects must be aware if data is been transferred to a third party. This is usually displayed in the Privacy Policy. So, it’s important to always read it before you click the tab “I Agree”.

REFERENCES

[1] See part 1.3 (xiv) of the Nigerian Data Protection Regulation, 2019

[2] See part 1.3 (iv) of the Nigerian Data Protection Regulation, 2019

[3] See part 3.1 7 (a-f) of the Nigerian Data Protection Regulation, 2019

[4] See part 3.1 7 (h) of the Nigerian Data Protection Regulation, 2019

[5] See part 3.1 9 (a-e) of the Nigerian Data Protection Regulation, 2019

[6] See part 3.1 (15)  of the Nigerian Data Protection Regulation, 2019

[7] See part 2.8 (a) & (b) of the Nigerian Data Protection Regulation, 2019

[8] See part 3.1 7 (l) of the Nigerian Data Protection Regulation, 2019

[9] See part 3.1 7 (j)  of the Nigerian Data Protection Regulation, 2019

[10] Sara Jelen, “5 ways to handle data breach” 27^th November, 2018 Retrieved from: https://securitytrails.com/blog/top-5-ways-handle-data-breach

[11] Geraldine Strawbridge, “5 damaging consequences of a Data Breach” 25^th February, 2020 Retrieved from: https://www.metacompliance.com/blog/5-damaging-consequences-of-a-data-breach/

[12] See part 3.1 (2) of the Nigerian Data Protection Regulation, 2019

[13] See part 2.10 (a-b) of the Nigerian Data Protection Regulation, 2019

Note: The NDPR does not explicitly provide that a data controller or processer be exempt from liability if it proves it is not in any way responsible.

[14] See part 2.3 (1) & (2) of the Nigerian Data Protection Regulation, 2019

[15] See part 2.3 (2) of the Nigerian Data Protection Regulation, 2019

[16] See part 3.1 7 (i) of the Nigerian Data Protection Regulation, 2019