In the month of May this year, the National Information Technology Development Agency (NITDA) issued a statement which drew attention to the very critical issue of privacy policy with regard to utilization of social media. This advisory came just about the same time as a number of users on WhatsApp were getting messages to accept the new policy.
NITDA is a regulator and part of the African network on data protection authority. Earlier, the Agency had engaged Facebook officers at the global level to understand the content of what the global platform was trying to do. It was after this that NITDA eventually issued an advisory concerning the new privacy policy.
The report by NITDA gave the hint regarding policy changes on WhatsApp. This came with promises of repeated reminders to WhatsApp users to accept the new policy which becomes binding upon consent. Policies of this nature are often detailed and in small print with a view to luring in users without letting them know the boundaries of their utilization of a particular App.
It is usually difficult for users to read everything about privacy policy. Research shows that if one decides to read privacy policies of the products one uses, one will spend 33 days out of one year. That’s why government has to intervene by empowering Nigerians to make informed decisions about social media usage.
Early January this year, there was a new development on WhatsApp privacy policy, and that was to the effect that Facebook bought over WhatsApp whose policies have been updated by taking metadata into consideration. In other words, there are about 13 other personal information of users that are sources of privacy invasion by WhatsApp. This suggests that information of WhatsApp users can now be shared with other users of Facebook including Instagram and other products that Facebook may have today or in the future.
The issues of privacy bother on power and control. Social media regulators are ‘provider-centric.’ That means they censor, control and dictate what happens in the social media space. For this same reason, privacy configuration, for a very long time, has taken a unilateral approach in the sense that application providers are the ones who determine how privacy is structured. This is basically on the philosophy that consumers ACCEPT or DECLINE a new policy. That is to say, there are terms for using an App, and oftentimes when one declines the offer, one is blocked and unable to get access.
Control over social media has to be within democratic and social norms, just like the work done by the Global Commission on the Stability of the Cyber Space in the Hague which developed norms for state and non-state actors. It’s about achieving the right balance.
Certainly, social media is not censored by the Nigerian government. It is censored by corporations, most of which at this point, are based in Southern California.
Almost all the data that captures how Nigerians interact with each other and their environment, is domiciled outside the country. Private corporations have more information on consumers’ interactions than the government and security agencies. The security agencies also fall victim. The information we are talking about in terms of metadata is basically mined to understand even people in government so that things can be influenced. Tiktok is not left out, given the massive data expended and the impact on teenagers.
Statistics show that Facebook Messenger collects about 46 pieces of information on metadata, WhatsApp collects close to 16, Telegram collects about 8, Signal collects between 0 and 1. The point here is that the less data the App collects, the more protected or private the user is, because the user cannot sell what they don’t have.
About two years ago, the US military decided that its troop should monitor their fitness while training. They were issued fitbit watches so that they would monitor their heart rate, running, among others. But unknown to them, their fitbit traces or tracks were seen online. The soldiers were seen moving in circles in the middle of nowhere in the Republic of Niger. Apparently, those were secret American military bases.
The fact is that the social media devices know more about the user’s movement than the user or anyone else. It’s just like the activity watch people strap. It is helpful because it helps with step count, and some of the other essentials like heart rate when walking out. But this is activated by bluetooth, which is another feature on a digital device.
The Nigerian Data Protection Regulation (NDPR) faces an uphill task, given that Nigeria has a digital ecosystem where foreign companies struggle with local companies to get direct access to government data whereas it is illegal for any foreign company to do the same in their own countries. This is how we need to approach data protection in Nigeria.
The regulators pick and choose what to censor. They use their own culture, ethics and perspectives to censor users across the world. It is a form of digital colonization which is a critical issue that we have no idea how and where it’s going to end.
The United States of America does not have a national law on privacy. It has state laws and sectoral laws but most of these laws are influenced by the big technology companies. Those laws are made to ensure that Facebook, Google, Amazon, among others, are always making good profits.
Those who advocate non-control of social media must understand that it is controlled but not by us. There ought to be some form of regulatory guideline on data protection at any point. That doesn’t mean that the endeavor to develop a social media bill by the legislators was a good one. The bill was shut down partly because there were several clauses that one would argue were undemocratic.
Almost every App or online product has access to everything on the user’s phone and other devices including contacts. Truecaller harvests contacts from people’s phones. And from the contact information, there is a lot that can be gleaned from the user’s smart phone including their financial transaction, email, camera, location, sites visited, among others. Such information run on transaction data, and each time the regulators activate them, users become vulnerable. NITDA officials claim that when they had an engagement with Truecaller, a lot of users stopped patronising the product and it affected Truecaller.
The extent privacy invasion can go depends on the skill and knowledge of service providers and their interests including business, national security, identity theft, among others. Experts say there are major globally recognized philosophies about the approach to technology and social media. There is the school of thought that believes business is king. Many businesses in Nigerian, especially the SMEs, use WhatsApp platforms for growth and advertisement in terms of the status update.
Business interest motivates service providers to meet users’ demands. That way, they can intrude into users’ privacy. Those that use their phones to control their homes (home automation) are also at the mercy of service providers who may be interested to know the activities in those homes. Most of the cameras used today are IP-based (Internet Protocol-based). That means users’ information contained in their cameras can easily be downloaded on the internet without their consent or knowledge.
Another school of thought focuses on security and national critical infrastructure protection as part of measures in dealing with data privacy protection. With very limited exceptions, China for instance, does not allow most of its social media contents to go outside its boundaries.
The third school of thought supports the narrative around autonomy. The Europeans are consumers of many American technologies but they are focused more on the autonomy of the individual user. That’s why there are concerns that the privacy policy being operated for countries in Africa and Asia, is not the same as you would find for users of the social media Apps in Europe and the Americas. The Europeans have most of the robust laws, and so, are better protected.
Nigeria is just starting this conversation, given what industry watchers say that we are over 95 years late into this discussion. What we need to do is to see how we can also bridge the gap and leapfrog some of the technology trends.
Today, data is at the centre of everything we do in the cyber space. Data is the new oil which has to be processed just like crude oil. Service providers trade on data. It is a two-way relationship or transaction between the App owner and the user.
Everything users get on the cyber space as free gift has an underlying cost, and will be paid for by users. Service providers produce Apps according to the specifications of users and throw them at consumers. We think that most of the applications we get on play store are free. There must be something the regulators are getting in return. This gives credence to the famous adage in the business space that “If something is free, you are not the customer. You are actually the product being sold.”
Many of the Apps have a very voracious appetite for data. That’s why service providers are multibillion-dollar organizations. About two years ago, Facebook made $52b from advertising technology while Google raked in $107b. This was partly due to metadata of users published and circulated to hundreds and thousands of the demand side partners of the service providers or regulators. This catalogue of information is put together and sold. The highest bidder is the one that will advertise the user. That’s why two people may be browsing the same site but different adverts will pop up because the images of the two individuals as portrayed in the technology world are different, and expectations are gauged accordingly.
Privacy policy issues are intricate, and a lot of users are grappling with the situation. The benefits consumers are getting on social media are not comparable to the huge gains that privacy intruders are maxing.
Clearly, there is a veil behind social media devices. Data privacy disruption has a lot to do with information sharing policy across social networks. This has implications for users who latch on to online contents without bothering about the consequences. That shows no matter how beautiful the offerings on social media are, activities such as data exposure or revealing classified or confidential information of individuals, discredit consumers’ trust.
As a society, we don’t spend or invest enough time and effort in extensive research. That is why in the process of developing social media policies, we lag behind. What research does is to help us to develop a long-term strategy to build products and infrastructure that can support policy dimensions. Research effort can be complemented by thinking through some of the nuances and finesse of how to basically articulate and domesticate social media policies to maximize benefits.
Data protection, no doubt, is an interesting feature, and Nigeria as a part of the global village, cannot afford to stand aloof in matters relating to information protection and regulation implementation. So far, 24 African countries out of 53, have adopted laws and regulations to protect personal data. This is modeled after the 2016 EU General Data Protection Regulation. Kenya, Uganda and Zimbabwe have already enacted personal data protection legislation, the promulgation of which has not yet been effective as the laws are still in the form of bills. Tanzania is in the process of enacting personal data protection legislation. Nigeria on its part, adopted the first data protection regulation in early 2019.
Privacy is about respect, social boundaries and trust. Businesses, relationships, and indeed society won’t work without trust.
NDPR which came into effect in January 2019, has done its bit to enhance information system management through data protection law. NDPR came in good time, as countries that don’t have minimum levels of data protection would be cut off from the global digital economy.
Moses, Publisher, Researcher, Biographer, Phonetics Instructor, Managing Consultant, Legacy BookMedia, Lagos
