A move by Nigeria’s House of Representatives to mandate telecommunication companies in Nigeria to localize their data has experts at loggerheads.
According to reports, the motion originated from Chukwuemeka Ujam, a member of the House representing Enugu. While presenting the motion before his colleagues, Ujam said he was concerned about the security of critical information that originates from the country which is left in the hands of foreigners through data hosting. Ujam’s argument was unanimously adopted by the entire House with the Speaker of the House, Yakubu Dogara requesting the House committee on ICT to ensure compliance of the motion which it identified under the Data municipal laws.
It should be noted that compliance will likely not be effective without the complete buy-in of the Federal Ministry of Communications and the regulator NCC.
To be sure, data localization refers to the act of keeping data on any device that is physically present within the borders of a specific country where the data was generated. For instance, data that originates and are stored on any device within the Nigerian border should be kept in Nigeria. Countries like Vietnam, Indonesia, Brazil, China, Brunei, Iran, India, Korea, Australia and Russia have data localization laws in various forms.
Some experts have also argued that the latest European Union General Data Regulation Protection (EU GDPR) is an attempt at data localization. Another school of thought say there is a difference between data localization and data sovereignty which they define as data being hosted in a particular country, whereby the country or state laws applies. Thus for this school, the EU GDPR falls within the purview of sovereignty and not localization. The lines can be blurry.
There are various reasons countries enforce data localization. One of them is what Chukwuemeka Ujam alluded to, national security. Data stored outside the border can face risks such as private data hacking in terms of foreign data storage solutions.
Some countries also believe that enforcing data protection regulations cannot be effective without localizing the data within the country (in-country).
Nigeria data protection landscape is very much in the infant stage. There are only a handful of data centre players within the country. The four main players include MainOne’s MDXI, MTN Cloud, Rack Centre and Vodacom.
For those in support of localization, this is a good reason to enforce compliance.
“You cannot compare countries with 40-50 years technology history and over 100 data centres across multiple locations in the world to Nigerian data centres that 2 to 3 locations,” a source in one of the major data centres in Nigeria told BusinessDay. “With more customers, data center business will expand. New players will come in and start differentiators. Quality and cost will eventually differentiate.”
Ndubuisi Ekekwe, a professor of technology does not see any competitive advantage in localizing data. For him, the House move – should it be enforced by federal government – will only stifle the growth of technology startups.
“Most Nigerian start-ups host their data outside Nigeria because the local alternatives are largely more expensive,” Ekekwe wrote in a post. He further notes that the enforcement could compel many startups would reincorporate in US, and then pay US taxes even though the customers are Nigerian customers.
He later told BusinessDay that a localization law must consider realities such as lack of power.
However, data centre businesses in Nigeria appear to have found a solution to power instability.
“Nigeria’s power challenges are lastmile/transmission,” a data centre expert told BusinessDay. “Some data centres such as MainOne invested in a dedicated 33kv feeder and line connection to the National grid through the Eko DC, and gets access to multiple power generating plants and guarantees backup in the event that one power plant goes down. This was a capital investment of hundreds of millions in substation equipment and dedicated power lines which bypass all ‘last mile’ challenges encountered in electricity distribution.”
Data centre is a capital intensive business and requires big pocket investors. Opening up the space through competition policies is what will attract investment. In an era where the internet drives economic growth and it is the key enabler for trading across several global industries, it is imperative therefore that policy makers ensure every stakeholder is on board.
