NigeriaAccess to Registered Information in the National Identity Database Regulations, 2017
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://www.nimc.gov.ng/docs/NIMCaccess_register.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- National Identity Management Commission
- Obligation class
- Access restriction, Consent, Licensing
As of .
What it requires
- Where you are a person other than a security, Government or licensed private agency, obtain an application made by or with the authority of the registered individual, or the individual's consent given by submitting the National Identification Number or biometrics, before you receive that individual's registered information, and do not seek fingerprint or other biometric information through such an application (regulation 4(1) and (2)).
- Where you are a private agency verifying or authenticating a registered individual's identity against the National Identity Database, hold the licence the Commission grants, obtain the registered individual's consent and pay the applicable fees (regulation 7(1) and (2)).
- Where you are a Government agency, make a prior written request to the Commission from an official not below the rank of a Permanent Secretary or Director-General, and comply with the procedures, processes and guidelines the Commission prescribes (regulation 6(2)).
- Use devices that conform to the specifications and standards in the Commission's guidelines when obtaining registered information (regulation 8(2)).
- Do not use or disclose registered information obtained by the grant of access without authority, and do not access data or information contained in the National Identity Database without authority (regulation 9(2)(d) and (h)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Regulation 1 states that the Regulations make provision for the granting of access to information of a registered individual in the National Identity Database to security agencies, public agencies and licensed private agencies.
Regulation 4(1) lets the Commission provide registered information to a person other than the designated security, Government and licensed private agencies where the registered individual, or someone with that individual's authority, applied for it, or the registered individual consents by submitting the National Identification Number or biometrics to the Commission. Regulation 4(2) puts fingerprint and other biometric information outside the purview of such an application.
Regulation 6(2) makes disclosure to a Government agency subject to a prior written request to the Commission from an official not below the rank of a Permanent Secretary or Director-General, and to the procedures, processes and guidelines the Commission prescribes. Regulation 7(1) lets the Commission, with the consent of a registered individual, grant licensed private sector agencies access for the purpose of verification and authentication of the identity of that individual.
Regulation 7(2) makes that disclosure subject to the payment of applicable fees and the grant of a licence to the agency by the Commission. Regulation 8(2) requires the devices used in obtaining information from the Commission to conform to the specifications and standards listed in the guidelines the Commission issues. Regulation 9(2)(d) makes the unauthorized use or disclosure of registered information obtained by the grant of access to the National Identity Database a contravention.
Regulation 9(2)(h) makes unauthorized access of data or information contained in the National Identity Database a contravention.
When LexLint raises it
When your app profile says your app processes biometric data, is a bank, is a lender, is an insurer or provides telecom services.