The NCC Regulations provide that no licensee shall engage in unsolicited telemarketing unless it discloses:

• At the beginning of the communication, the identity of the licensee or other person on whose behalf it is made and the precise purpose of the communication. During the communication, the full price of any product or service that is the subject of the communication must be specified.
• The person receiving the communication shall have an absolute right to cancel the agreement for purchase, lease or other supply of any product or service within seven (7) days of the communication, by calling a specific telephone number (without any charge, and that the Licensee shall specifically identify during the communication) unless the product or service has by that time been supplied to and used by the person receiving the communication.

Licensees are required to conduct telemarketing in accordance with any “call” or “do not call” preferences recorded by the consumer, at the time of entering into a contract for services or after, and in accordance with any other rules or guidelines issued by the Commission or any other competent authority.

Direct Marketing

The Data Protection Act provides that where personal data is processed for direct marketing purposes, the data subject will have the right to object at any time, to the processing of such data. When the data subject objects, the personal data must no longer be processed for such purposes. 

Internet Service Providers (ISP)

The NCC Legal Guidelines for Internet Service Providers (ISP) provides that Commercial Communications ISPs must take reasonable steps to promote compliance with the following requirements for commercial email or other commercial communications transmitted using the ISP’s services:

• The communication must be clearly identified as a commercial communication.
• The person or entity on whose behalf the communication is being sent must be clearly identified.
• The conditions to be fulfilled in order to qualify for any promotional offers, including discounts, rebates or gifts, must be clearly stated.

Promotional contests or games must be identified as such, and the rules and conditions to participate must be clearly stated. Persons transmitting unsolicited commercial communications must take account of any written requests from recipients to be removed from mailing lists, including by means of public opt-out registers, in which people who wish to avoid unsolicited commercial communications are identified.

Advertising

The Advertising Regulatory Council of Nigeria Act 2022 (ARCON Act) is the apex law regarding advertising and marketing communications in Nigeria; its scope covers both terrestrial and online advertisements. The Nigerian Code of Advertising Practice Sales Promotion and Other Rights / Restrictions on Practice (5th Edition) which continues in force under the ARCON Act, provides that all advertisements and marketing communications directed at the Nigerian market using the Internet or other electronic media must comply with the following requirements:

• The commercial nature of such communications must not be concealed or misleading, it should be made clear in the subject header.
• Terms of the offer should be clear and devices should not be used to conceal or obscure any material factors, such as price or other sales conditions likely to influence customer decisions.
• The procedure for concluding a contract should be clear.
• Due recognition must be given to the standards of acceptable commercial behavior held by public groups before posting marketing communications to such groups using electronic media.
• Unsolicited messages should not be sent except where there are reasonable grounds to believe that consumers who receive such communications are interested in the subject matter or offer.
• All marketing communications sent via electronic media should include a clear and transparent mechanism enabling consumers to expressly opt-out from future solicitations.
• Care should be taken to ensure that neither the marketing communication, or applications used to enable consumers to open marketing or advertising messages, interfere with consumers normal use of electronic media.
• Customer information must not be transferred to any party except to the extent agreed with the Customer, as permitted or required by the NCC or other applicable laws or regulations.

Emerging Technologies and Artificial Intelligence

The GAID establishes specific obligations for data controllers and processors deploying Emerging Technologies (ETs) such as Artificial Intelligence, Internet of Things (IoT), and Blockchain for the purposes of processing personal data. Requirements include: 

• Setting technical and organisational parameters for ET tools in accordance with the threshold of data processing permitted by law – specifically taking into account the right not to be subject to decisions based solely on automated processes, the right to be forgotten, safeguards for sensitive personal data and children, cross-border data flow regulation, and privacy by design and by default;
• Carrying out a DPIA before deployment, with particular attention to assessment of disparate outcomes and Data Subjects’ Vulnerability Indexes (DSVI);
• Determining the suitability of data anonymisation upon collection;
• Testing ETs in sandbox (controlled) environments before wider deployment;
• Iteratively retooling and re-testing until satisfactory outcomes are achieved, or wholly discarding the ET if privacy risks are unmitigable; and
• Implementing continuous monitoring and evaluation mechanisms upon deployment. 

The technical and organisational parameters for ET deployment must be documented and filed with the NDPC as part of the CAR. 

Data controllers must refrain from using ET systems that are impossible to operate in compliance with international human rights law or that pose undue risks to the enjoyment of human rights, in line with the United Nations Resolution on Artificial Intelligence and global consensus standards.