Appropriate steps are taken to protect data that could, either alone or when combined with other data, result in the identification of individuals or vulnerable groups within datasets used to tackle COVID-19
After an extensive desktop search of online information, no information could be found to demonstrate what any such appropriate steps are required or have been taken.
Data collected for epidemiological purposes shall not be shared or used by other parts of government, such as police forces or Ministries of Interior
The Operational Guidelines for the Police and other Law Enforcement Agencies in Nigeria, the Nigeria Police Force require that police and other law enforcement agencies to use proportionate police investigation resources to carryout contact tracing of individuals believed to have been exposed to Covid-19. The Guidelines require that such contact tracing must be performed in collaboration with authorised health agencies.
Protocols shall be established to respond to potential data breaches of datasets containing sensitive data
The Implementation Framework for the Nigeria Data Protection regulation requires data controllers to notify the National Information Technology Development Agency within 72 hours of becoming aware of any breach. A Data Controller must also immediately notify a data subject of a personal data breach where such will likely result in high risks to their freedoms and rights.
Individuals or vulnerable groups who may be harmed by the misuse of their data in response to the COVID-19 pandemic – either intentionally or accidentally – shall have access to judicial redress and due process
Although such individuals and groups would formally have access to judicial redress to persue a civil claim, they may in fact experience difficulty in obtaining legal advice and representation.
Governments and public bodies shall retain all intellectual property rights over databases and all derivative data outputs produced using African citizens’ data as part of the COVID-19 response
After an extensive desktop search of online information, no information could be found to demonstrate that governments and public bodies have registered or asserted any such intellectual property rights.
Governments, private companies and other entities shall commit to engaging with civil society organisations and digital rights defenders in order to identify responsible and practicable ways of winding-down any emergency data collection, processing and use at the end of the pandemic, in accordance with local laws and in line with international best practices
After an extensive desktop search of online information, no information could be found to suggest that any such engagement has taken place.