CITAD warns against mandatory physical offices for social media platforms

The Centre for Information Technology and Development (CITAD) has rejected a proposed amendment to the Nigeria Data Protection Act, 2023, seeking to compel social media platforms, data controllers and data processors to establish physical offices in Nigeria, warning that the move could undermine digital rights, innovation, competition and inclusion.

The organisation made its position known during a media briefing on Friday, where its Digital Rights Lead, Ali Sabo, outlined CITAD’s concerns over the proposed legislation sponsored by Senator Ned Munir Nwoko.

The bill seeks to amend the Nigeria Data Protection Act, 2023, by requiring social media platforms, data controllers and data processors operating in Nigeria to establish and maintain physical offices within the country.

It further proposes that any affected entity that fails to maintain a physical office in Nigeria for 30 consecutive days could be prohibited from operating in the country.

Read Also:

Kano Online Media Chapel Honours Governor Yusuf with Excellence Award

CITAD, a non-profit organisation committed to advancing digital rights, promoting digital inclusion, supporting technological innovation and strengthening good governance through information and communication technologies, said it supports efforts aimed at strengthening data protection and improving regulatory oversight. However, it argued that the proposed amendment adopts a disproportionate approach that could harm Nigeria’s growing digital economy.

Speaking during the briefing, Sabo said while the objectives of improving accountability and enhancing data protection are legitimate, requiring every covered entity to establish a physical presence in Nigeria is neither necessary nor practical.

“The proposed blanket physical-presence requirement is disproportionate, potentially harmful to digital rights and likely to undermine Nigeria’s digital economy,” he said.

According to him, the proposal would create unnecessary barriers for technology companies, online platforms and cross-border digital service providers, particularly smaller technology firms, start-ups, non-profit organisations, open-source projects and emerging digital platforms that may lack the financial capacity to establish and maintain physical offices in Nigeria.

He added that the amendment could inadvertently strengthen the dominance of large technology companies while creating an uneven digital environment in which only the biggest corporations can afford to comply, thereby undermining competition, innovation and the development of indigenous digital solutions.

CITAD also faulted what it described as the bill’s one-size-fits-all approach, noting that it applies the same physical office requirement to all data controllers, data processors and social media platform operators regardless of their size, operational scope, level of data processing, risk profile or degree of connection to Nigeria.

The organisation maintained that regulatory obligations should instead be risk-based, proportionate and targeted at entities whose activities pose significant risks to the privacy and rights of Nigerians.

Sabo further observed that the Nigeria Data Protection Act, 2023, already provides a comprehensive legal and regulatory framework for protecting personal data, stressing that priority should be given to strengthening the implementation and enforcement of existing provisions rather than introducing new requirements that could produce unintended consequences.

He noted that accountability and consumer protection can be achieved through digital mechanisms without compelling every platform to establish permanent offices in Nigeria.

“In the digital age, regulatory engagement, legal notices, consumer complaints and enforcement actions can be facilitated through effective digital channels and clearly designated local representatives without necessarily requiring every covered entity to establish a permanent physical office,” he said.

As an alternative, CITAD proposed requiring appropriate categories of high-risk or large-scale foreign data controllers and processors to designate authorised representatives in Nigeria, strengthening the Nigeria Data Protection Commission, enhancing cross-border regulatory cooperation, establishing accessible digital channels for complaints and regulatory engagement, adopting risk-based compliance obligations for high-impact data processing activities and improving the enforcement of existing data protection obligations.

The organisation also expressed concern that the proposed amendment could negatively affect digital inclusion by prompting some international digital platforms and service providers to withdraw from or restrict access to the Nigerian market due to increased compliance costs.

According to CITAD, such a development would reduce the range of digital services available to Nigerians and disproportionately affect young people, entrepreneurs, small businesses, civil society organisations and communities that depend on digital platforms for education, communication, advocacy and economic opportunities.

The organisation urged the National Assembly to subject the proposed amendment to broad consultations involving digital rights organisations, technology companies, data protection experts, civil society organisations, consumer groups, start-ups and other relevant stakeholders before taking further legislative action.

It also called on Senator Ned Munir Nwoko and the National Assembly to reconsider the proposed blanket physical office requirement and instead develop a balanced regulatory framework that safeguards Nigerians’ personal data while promoting digital rights, innovation, competition and digital inclusion.