Introduction

In May of 2020, the NITDA (National Information Technology Development Agency) issued the Guidelines for the Management of Personal Data by Public Institutions in Nigeria, 2020 (hereinafter referred to as the GMPDPIN 2020).

Hey, don’t blame me if it’s a mouthful, I’m not the one that coined that name for the guidelines in the first place.

Don’t worry, when I’m the head of a government agency 20 years from now, I’ll make sure that any regulations or guidelines we issue have easy to pronounce names and acronyms, that’s a pinkie promise. For now, we work with what we have.

So, GMPDPIN 2020 (this sounds like what might happen if APC and PDP ever merged), here we go.

You know what, for this article, let’s call it GMP. Are you cool with that? Sure? Great. Now, let’s get down to business.

This Guideline was a follow-up to the Nigeria Data Protection Regulation (NDPR) 2019.

PS: You see how short and succinct that name and acronym is? The same agency then gave us GMP whatever. NITDA, if you read this someday, please up your game. Some of us might end up cursing our ancestors in the name of calling acronym.

Now the NDPR is meant to be Nigeria’s version of the EU GDPR. A regulation that stipulates what can be done to your personal data, who is licensed to handle it, how it can be processed obtaining consent and everything related. There are criticisms of how effective it is because is simply a regulation, and not an Act of the National Assembly, but they are not my concern here. My concern, as the title of this article suggests, is how the provisions of the GMP can impliedly extend to the regulation of Artificial Intelligence in Nigeria. But first, a short background

PS: If you want to read more about the NDPR and how it affects you, you can read my paper on Academia, boringly titled, ‘A Review of the Nigerian Data Protection Regulation (NDPR) 2019’. Please don’t judge it by its cover. The cover is not fine but the content is fun.

 

GUIDELINES FOR THE MANAGEMENT OF PERSONAL DATA

LEAD BY EXAMPLE

In my above-mentioned paper, one of the things I noted about the NDPR, just like others who might have studied it, was that it focused more on private organizations, private citizens, creating rights and a regulatory framework, whilst neglecting the public sector. We all know, that after the banks, telecoms companies, and FAANG (Facebook, Amazon, Apple, Netflix, and Google), the next best repository of our personal data as Nigerians, is the government. They might not be good at organizing and deriving value out of it, but they sha have it. So, you would expect that the NDPR would say something about how the government should use our personal data. They should lead by example, right? Well, it didn’t, and it got flak for that.

This is where the GMP comes in. It’s a subsidiary legislation, targeted at public agencies, which derives its validity from the NDPR, another subsidiary legislation. The NDPR is the map, the GMP is the compass on how to make sense of it if you’re a public agency.

Now that we’ve established the relationship between the NDPR and the GMP (you can download it here for personal study), let’s get into the real business of the day. Whilst reading the GMP, some of its provisions struck me because of how they unwittingly create some form of the basic regulatory framework for AI. If you’re not aware, AI is built on data, massive amounts of it. The recommendation engine on Netflix that keeps giving you the best suggestions on what to watch is built on data about your preferences, your movie history, and that of millions of users who share your preferences. The search results you get on Google are based on your search history, search location, and other factors, that boil down to data. This is why it is easy for a law or regulation about data protection to easily extend to Artificial Intelligence.

While we do not yet have any form of AI application in the Nigerian public sector (at least, none that is in the public domain at the time of writing), the provisions of the GMP that I’ll be talking about serve to pre-empt such developments, so that if at any time AI is introduced in the Nigerian public sector, we already have some legal standards to measure it against.

Here are those provisions I spoke about

 

Rule 2.1a -Processing of Personal Data

All Public Institutions are under an obligation to protect personal data in any incidence of processing of such data. Processing in the context of this Guideline means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, viewing, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The keyword that brings AI into the mix under this provision is the word ‘automated’. To be clear, AI is not synonymous with automation. It is just one of the many ways, albeit the most efficient means of automation available. I can draw up a budget on paper, but that might take time, but if I do the same thing on Microsoft Excel or Google Sheets with a downloaded template, it will only take minutes. That’s automation. Instead of President Buhari going to the National Assembly every year with hard-cover volumes to present the yearly budget, he could just send an email to the National Assembly and livestream his address. We’re in the era of social distancing, aren’t we?

You get the point of automation, basically making processes more efficient and faster. Now lets bring that to AI and Rule 2.1a.  It provides inter alia, that where processing of personal data is by automated means, the public institution carrying out the processing is obligated to protect such data.

Let me illustrate.

In the course of the next few months, INEC (Independent National Electoral Commission) will conduct governorship elections in Edo and Ondo States. It is likely that in the runup to these elections, INEC will conduct continuous voter registration exercises to capture those who might have turned 18 since the last election or have not registered to vote for any reason whatsoever. Based on historical antecedent, this exercise will be carried out physically, with intending registrants queueing for hours, just so an INEC official can capture their data for the issuance of a voters card. For those of you who have gone through this, I’m sorry I took you down memory lane. But this process is grossly inefficient in the age of Google Forms. Its part of why younger Nigerians are largely not interested in voting or being registering for the process. If we can vote for BBNaija (Big Brother Naija) with a text message and our votes count, then we should be able to vote for President without queueing for hours. The older generation should get with the program.

Lets assume this year that INEC decides to implement some of the changes we want. They develop their version of Google Forms for citizens to fill in their personal data from anywhere. But there’s a problem. Now that the process of registration is fully online, how do you ensure that only those who are not registered or whose details have changed since the last process actually register?

To ensure that this is the case, INEC collaborates with NIMC (National Identity Management Commission) for the purpose of data sharing. They use an AI system that compares the NIMC database with the INEC database. Those citizens whose information is not available with INEC have most likely not registered. The AI system delivers this information to INEC. They can use the contact information to directly reach out to those Nigerians, encouraging them to use the online system to register, similar to the way NCDC (National Centre for Disease Control) was sending most of us ‘love messages’ a while back.

Just to be clear, the AI system I mentioned is not fictional, it actually exists and is known as ERIC (Electronic Registration Information Centre). It is used in over 24 states in the USA to identify potential voters and resolve identity discrepancies.

Applying the provisions of Rule 2.1a to this scenario, INEC will be obligated to ensure that they protect the data they gain access to and process by virtue of their collaboration with the NIMC. As such, anytime in the future that a government agency uses AI in some way in connection to personal data, they are obligated to keep it safe. I don’t want my personal data leaking online or somehow, a politician gets hold of it and starts using it send me campaign messages. If it happens, I will actually take legal steps, not ‘audio’ steps.

 

Rule 2.3f – Requirement of Consent

In the following circumstances, consent shall be required for the purpose of processing personal data, even where another legal basis for processing applies:

  1. before the data controller makes a decision based solely on automated processing which produces legal effects concerning or significantly affecting the data subject

In many small ways, our lives are run on intelligent systems and automation. The webpages that you visit when searching for information are ranked in a way that none of us really understands. How Google Search algorithm works is a discussion of its own, but the consequence of the results it gives us is that we hardly ever check the results on page 2 down to the millionth page. The choice of what goes on page 1 or page 1000 might not be life-changing or critical, but when you bring AI into the public space, the results that it makes can mean the difference between getting bail or a prolonged sentence.

An example of this is in the court case of Wisconsin v. Loomis, the defendant was sentenced to 6 years imprisonment. One of the factors upon which the judge premised his decision was the recommendation given by the risk assessment system (an AI system that is designed to pre-empt crime by identifying those most likely to offend, and recommending their removal from society by defined means. The system in question, known as COMPAS – Correctional Offender Management Profiling for Alternative Sanctions) that Loomis, the defendant should be incarcerated because he had a high-risk to reoffend.

You might be wondering how this links back to how AI might affect the Nigerian public space and requirement of consent that we should be talking about. I’ll get to that, but first, I have to explain how a risk assessment system works. Don’t leave me.

Risk assessment systems are built on data from the prison and police system of a country or state. In the Loomis Case above, COMPAS was trained using data from the prison system of the State of Wisconsin. For context, Loomis was an African-American. Are you getting the picture? We all know that blacks in America are frequently the target of police brutality and arrests. The George Floyd protests have driven that point home. When you frequently arrest people of Group A in a higher proportion compared to Group B, it follows that you will have more data about Group A. When you feed this data into an algorithm, it doesn’t know that the reason Group A is over-represented in a dataset is because of your bias against them. As such, when it processes this data, the results it will give are likely to tend against people from Group A. Do you get me?

The police arrests black people more frequently than the average white person. When a white person is before the court and COMPAS is introduced, COMPAS is likely to recommend a lighter sentence or bail for him because based on the data with which it was trained, white people are not prone to crime, since they are not heavily arrested. But if a black person where before the court, the opposite would be the case.

Now that you have a clearer picture of the risks of AI application in the public space, I’ll link it back to the Nigerian context and law. You can scroll back up now to read the quoted provisions. Have you done that? Good. It says that a Data Controller, before it makes a decision based on automated processing that might produce legal effects or significantly affect the data subject must obtain your consent. And to make it clear, this consent must be expressly obtained. This requirement is not found in the GMP but the NDPR expressly provides for it.

So lets assume that in 2030. Nigerian courts have embraced risk assessment systems. Before a judge of the Federal High Court can pass sentence based on the recommendation of such a system, the defendant or the accused in such a case must have given his consent. In this case, decision emanating from the automated processing has legal effects on him – a conviction or acquittal.

If in 2030, the University of Ibadan decides to introduce an AI system that sorts through the applications of thousands of students who want to study there in order to decide those eligible to write Post-UTME, it must obtain the consent of all the students before doing so. The decision of the system here might not have legal effects, but it can mean the difference between one more year at home or getting into the university early, as such, it has ‘significant effect’ as envisaged by the GMP.

Just to be clear, this technology already exists. Taylor University, in Indiana, USA, in 2015, started using an AI system, known as the Education Cloud, to not just screen applicants, but also target potential applicants for the purpose of direct marketing. It yielded positive results for them as they welcomed their largest class of freshmen ever in the fall of 2015.

 

Rule 2.9d – Privacy Policy

All Public Institutions with data processing responsibilities and functions shall have a privacy policy that provides the following details:

  1. description of technical methods used to collect and store personal information, cookies, JWT, web tokens etc.

This provision can extend to Artificial Intelligence by virtue of the fact that AI falls under the same class of technical methods that can be used to collect and store personal information. Remember the example I gave earlier about INEC using AI to collect data from NIMC? This provision would also apply in that context and similar situation. INEC would be bound to state in their privacy policy to disclose how their AI systems collects data from the NIMC database and stores it for the purpose of further processing.

AI can collect personal data and others using a variety of methods such as image recognition, training algorithms to comb through large swathes of data. A challenge that I foresee arising from this will involve describing the general workings of the algorithm or AI method in language that is simple enough for an average citizen to understand. It would require people who understand the technical workings of such systems and possession of effective communication skills to describe it to laymen.

Rule 3.1b – Rights of a Data Subject

No person shall:

  1. be tracked, traced, or be subject to automatic or digital decisions without a law of the National Assembly or consent of the subject;

If the Coronavirus pandemic had never happened, the import of this provision might be lost or easily set aside. But, Coronavirus is here, and the protection that this provision guarantees, no matter how weak, cannot be waived aside. In the past few months, Apple and Google announced an unprecedented collaboration to track users, using an application programming interface (API), a sort of backend upon which other apps can be built for tracking the user of the smartphone in question. Development of the actual tracking apps in question is left to governments or private companies who will tap into this common API that works across Android and iOS systems.

The way its supposed to work is this. This API (which is built on AI), via Bluetooth technology in your phone, keeps a log of the phones (and their users) thast you come in close proximity with. The logs will not collect personally identifying information, but random numbers that identify each phone (and by extention, its user). Lets assume that Mr. A, on the 17th of August, 2020, comes in contact with Mr. B at the Ojodu Berger Bus Terminal in Lagos, Nigeria. Mr. B later tests positive for the Coronavirus. Depending on the features of the app built on the Google-Apple API, Mr. A will be notified that he might be at risk of having the virus. The authorities may also be able to use the log from the contact tracing to locate determine the phones (and users) that Mr. B has come in contact with.

If you use an Android or Apple smartphone, this API is already live on your phone, It just might not be active yet. For Android users, go to Settings – Google – COVID-19 exposure notifications. For iOS users, go to Settings – Privacy – Health – COVID-19 Exposure Logging.

By default, it should be turned off. You should only be able to turn it on when you install or set up an app. This is where the provisions of Rule 3.1b come in. In the event that the Nigerian Ministry of Health, NCDC, or any other agency of government develops a COVID-19 tracking app, built on the aforementioned API, it would be illegal for them to use it track any Nigerian, except there is a law backing its development or you expressly give your consent to be tracked. A good example of a law that might fit this description is the Infectious Diseases Bill, which generated a lot of furore when it was first represented at the floor of the House of Representatives. Section 5(1) of the proposed bill grants the Director-General of the NCDC the power to institute ‘public health surveillance programmes’ or undertake ‘epidemiological surveys of people’, in order to ‘determine the existence, prevalence or incidence, or to determine the likelihood of a possible outbreak of any infectious disease’

If assented to, this law could provide a legal basis for the development or utilization of a COVID-19 tracing app in Nigeria, and as such, would not be in violation of Rule 3.1b

 

CONSEQUENCES OF ITS BREACH

What’s a law if it doesn’t have some sting? Rule 7.0  of the GMP provides for that as it provides that breach or non-compliance with its provisions would be an offence under section 17 of the NITDA Act 2007 and the NDPR 2019. So if we want to have a clear idea of what the sanctions, we have to visit those legislations. What section 17 generally provides for is that where an offence is committed under the Act by a body corporate (in this context, an agency of government), the CEO of such body corporate or any other person acting in such capacity or on his behalf will be deemed to have committed the offence, except he can prove that the offence took place without his knowledge or connivance.

Since the GMP is subject to the NDPR 2019, the penalties in the NDPR 2019 will extend to it. Any agency subject to the GMP is by extension subject to the NDPR 2019. Rule 2.10 of the NDPR 2019 provides that anyone who is subject to it and is in breach of its provisions would be liable to the following:

  • Where the breach involves 10,000 Data Subjects, a payment of the fine of 2% of Annual Gross Revenue of the preceding year or payment of the sum of N10 million (roughly $25,906 at the official exchange rate), whichever is higher.
  • Where the breach involves less than 10,000 Data Subjects, payment of a fine of 1% of Annual Gross Revenue of the preceding year or payment of the sum of N2 million (roughly $5,181 at the official exchange rate), whichever is higher.

 

 

IS THAT ALL THERE IS TO IT?

This is not to say that these are the only provisions in the GMP that can extend to AI. Like I said earlier, it is easy for any regulation or law about data protection or privacy to extend to AI, because it is built on AI. I chose these 4 out of an initial choice of 17 because they had a more direct tie-in with Artificial Intelligence than the rest, in my opinion. If you’re interested in studying the other provisions that also share a relationship with AI, though not as direct, they are Rules 2.2e,g, h; 2.3b; 2.4; 2.5; 2.6a – c; 4.0a, b, e; and 6.0. Again a link to download the GMP is here. If you’re able to study these provisions and those I discussed, I would love to hear your thoughts. Maybe you disagree. You can reach me on Twitter at @Akin_Agunbiade and on LinkedIn at Akintunde Agunbiade

 

REFERENCES

Leave a comment

Your email address will not be published. Required fields are marked *