The right to privacy is guaranteed by the Nigerian constitution. The Nigerian Data Protection Regulations (NDPR), which went into effect in 2019, govern and protect the processing of Nigerians’ personal data.
It lays out the minimum policies and procedures that must be followed by any company that manages or processes Nigerians’ personal data.
This includes their employees’ and customers’/clients’ personal information. Personal data is any information that can be used to identify a person, such as their name, address, photograph, email address, bank account information, health information, and IP address.
Some CCTV cameras have such high resolution that they can see into dark spaces and zoom in on minute data. The video clips captured by CCTV cameras can be viewed in real time or saved/recorded for later viewing. Both practices constitute personal data processing under the NDPR, which must be carried out in compliance with the legislation.
The NDPR applies to any electronic surveillance conducted outside of a person’s domestic property. As a result, CCTV cameras in businesses and public places must adhere to the NDPR.
The role of that business establishment on how the CCTV camera is to be handled, run, and used by the company in such a way that Nigerians’ privacy rights are respected is outlined in a CCTV Policy.
IN ACCORDANCE WITH THE NDPR, HOW Will CCTV CAMERAS BE USED?
The NDPR outlines six rules that must be followed if an agency tries to handle personal data, including when recording and processing CCTV video. What are the guiding principles:
a. Lawful, equal, and clear recording/processing is required: CCTV video must be processed for a legal reason. The cameras must be installed in public areas, and there must be prominent signs/notices stating that CCTV cameras are in use. The failure to post prominent notices alerting people to the existence of CCTV cameras on the premises makes the situation worse. CCTV cameras are not permitted in areas where people have a reasonable expectation of privacy, such as restrooms and locker rooms. Any recording of toilet operation is both invasive and illegal.
b. It has to be used for particular and legal reasons: The company is only allowed to use the CCTV cameras and footage for the purposes specified in its CCTV Policy. It is prohibited from using the cameras or recordings for any other reason. For example, if the cameras were mounted for security purposes, the company could not use or sell the video footage to data/marketing companies.
c. The recording/processing must be sufficient and appropriate: the data collected by CCTV must be necessary and not unnecessary for its intended purpose. Customers’ clothes should not be visible via a CCTV device built for security reasons in a shop. The gate/car park cameras should not be used to spy on the neighbors’ property.
d. The video must be accurate: No Photoshop software can be used to edit or tamper with CCTV camera footage.
e. The footage must only be kept for as long as it is required: The company cannot keep the footage indefinitely. The video can only be kept for as long as the law allows, after which it must be removed.
f. It must be processed and stored in a safe manner: The CCTV footage must be protected from unauthorized access. There should be no unauthorized or indiscriminate uploading of CCTV footage on social media, since this is a security violation that may result in penalties being imposed on the company’s management.
Who Has Access to CCTV Footage?
Only approved staff named in the CCTV Policy have access to the live and recorded footage captured by the CCTV cameras. The policy also lays out the steps to take if law enforcement officials ask for the video.
Anyone who has been captured on video and is recognizable has the right to see the footage. They can do so by filling out a “Subject Access Request” form and sending it to the organization. Before such a request can be granted, the photos of other people taken by the camera must be blurred.
The National Information Technology Development Agency will impose sanctions on the business establishment if it fails to comply with these provisions of the NDPR (NITDA).
Source: The Guardian