Nigeria’s data protection law is being tested by artificial intelligence tools in everyday Nigerian life, raising questions over whether it can keep pace with personal data collection and use.
The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission and set out a framework for the lawful, fair and accountable processing of personal data, according to an analysis published by Global Voices as part of its October 2026 Spotlight series on Big Tech and authoritarianism.
The piece, written by Nshua Cali-Dibang, argues that legislation alone is not the measure of protection. Effective safeguards also depend on implementation, public awareness and regulators’ capacity to hold organisations accountable, it states.
What the FTC found about data collection
The article points to a September 2024 report from the United States Federal Trade Commission, which published findings from an investigation into nine major social media and video-streaming companies, including Meta, YouTube, TikTok and Amazon-owned Twitch.
According to the account, the FTC reported that the companies collected extensive information about users and, in some cases, non-users, covering personal details, interests, online activities and data obtained from other sources.
The investigation also raised concerns about lengthy data retention, inadequate privacy protections and the use of personal information in automated systems, including AI.
The report described an imbalance in which companies can accumulate substantial information about individuals while those individuals may have limited understanding of how their data is used or how to prevent certain uses, the article states.
On AI specifically, the piece notes that data can help train models, improve recommendations and power automated decisions, and that the larger the volume and variety of information companies can access, the more important clear limits on collection and use become.
It frames the concern as one of incentives rather than intent: systems designed to maximise commercial value from information can create pressure to collect more data than people reasonably expect or understand.
Inclusion and its conditions
The article acknowledges that AI offers opportunities that were previously hard to access, including for students, small businesses and journalists, and that in countries such as Nigeria, where access to resources and professional services can be uneven, these tools could help narrow certain gaps.
AI systems that support local languages and reflect diverse cultural experiences could also make digital services more accessible, it adds.
But inclusion, the piece argues, should mean more than permission to use a technology. It should also mean that people understand the conditions under which they use it and retain meaningful rights over their information.
The article notes that many digital services are governed by lengthy terms and privacy policies that users may accept without fully understanding the implications, and that some AI products raise questions about whether information submitted through prompts, uploaded documents or other interactions may be retained or used to improve models.
It states that precise practices differ between companies and products, and that users need clear explanations of what is collected, why it is needed, how long it is retained and whether it may be used beyond the immediate service.
Corporate power and surveillance risk
The article is careful to distinguish private data collection from authoritarianism, which it describes as involving the concentration and exercise of power in ways that undermine accountability, rights and freedoms.
It argues, however, that extensive corporate data collection can create conditions that make surveillance easier, since detailed personal information can support profiling, targeted persuasion and the prediction of individual behaviour, and that businesses, governments or other actors may exploit these capabilities depending on the circumstances.
It identifies particular risks when personal data can be accessed or shared without adequate safeguards, when automated systems make consequential decisions without meaningful oversight, or when people have little opportunity to challenge how their information is used.
Concentrated corporate power adds a further concern: when a small number of companies control widely used platforms, AI services and large pools of information, individuals may have few practical alternatives, and leaving a platform may mean losing access to professional networks, customers, communities or essential services.
The piece states explicitly that this does not mean every AI system is a surveillance tool or that every technology company intends to restrict freedom.
It means, in its words, that the infrastructure of digital life deserves scrutiny because its capabilities can be used in ways that extend beyond their original commercial purpose.
Representation and international principles
Beyond protection, the article raises a question of representation.
If AI systems are developed using data that inadequately reflects Nigerian languages, cultures and social realities, their benefits may be distributed unevenly, it states, and responsible AI governance must therefore address both the protection of personal information and the inclusion of communities whose experiences are often underrepresented.
It cites UNESCO’s Recommendation on the Ethics of Artificial Intelligence, which emphasises privacy, data protection, transparency, accountability and fairness throughout the AI lifecycle, as a foundation for ensuring that technological progress respects human rights.
The article’s prescription is not to reject AI or stop companies from using data to build useful technologies, but to set boundaries that allow innovation without making personal privacy an acceptable casualty.
It says technology companies should minimise unnecessary data collection, communicate policies clearly, provide meaningful choices and strengthen protections against unauthorised access, while regulators must ensure existing laws remain effective as AI capabilities evolve and users need accessible information about their rights.
Digital inclusion, it concludes, cannot be measured solely by the number of people using AI, but must also consider whether those people can participate safely, understand the systems they rely on and exercise meaningful control over their information.
Source: globalvoices.org
Comments