By Olumide Babalola
When sometime early December 2020, my wife, an Assistant Chief Legal Aid Officer with the Legal Aid Council of Nigeria persuaded me to see the Nigerian movie titled “Oloture” produced by EbonyLife Films, I was disappointed at the anti-climax since the villains were neither apprehended nor brought to criminal justice. At the time, little did we both know that, there may be real time legal issues to the movie even at the time of filming, if the claims and counterclaims of copyright infringement flying around are anything to go by.
On Monday the 18th day of January 2021, I woke up to the Chairman of the NBA Young Lawyers’ Forum, Tobi Adebowale’s tweet touting Olaoluwa Oni’s piece “The Oloture Dispute is Not Just A Question of Law, It Is An Examination of EbonyLife’s Business Ethics” as a ‘must read’ on the issues arising from the dispute.
Truth be told, Olaoluwa wittingly captured many interesting issues with her crisp and creatively lucid perspectives but the portion that explicably caught my attention was her submission that:
“… the producers must consider the author’s moral rights (i.e the irrevocable rights of an author to regulate the reversion, alteration or distortion of their work regardless of who holds the copyright, the privacy right of the subjects portrayed by the firm and the journalism publishing industry customs and rules of ethics.” Now, let’s briefly discuss the privacy and data protection issues in the movie without prejudice to the Producer’s insistence that, it is a work of fiction.
Were Personal Data Processed?
An analysis of violation of privacy or data protection issues must necessarily proceed from a determination of whether personal data was processed at all in the movie. According to the Producers of the movie, “This is a work of fiction. The events, name, characters, places and incidents depicted in this motion picture are used fictitiously. Any resembles to actual events or locales or persons, living or dead is entirely coincidental and unintentional.”
In other words, the names were not real names, they were created i.e fictional etc. Nevertheless, in data protection parlance, what the producers had done by using fictional names to identify the characters are known as ‘pseudonymization’. Due to the infancy of Nigerian jurisprudence on data protection, reference will mostly be made to foreign materials here. Thus, article 4(5) of the European Union General Data Protection Regulation defines ‘pseudonymization’ as: “…the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.” It is this writer’s respectful opinion that, since the true identities of the characters in “Oloture” (especially that of Tobore Ovuorie – the Claimant) can be arguably unraveled when placed side by side Tobore’s narration, which was first published January 22nd, 2014 by Zam Magazine, Netherlands and the Premium Times, Nigeria, one can then categorically say that it constitutes her “personal data” which is defined under regulation 1.3 (xix) of the Nigerian Data Protection Regulation 2019 as: “any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It can be anything from a name, address, a photo, an email address, bank details, posts on social networking websites, medical information, and other unique identifier ….”
From the definition above, it appears clear that, even where data subjects’ names and identities are not expressly mentioned in a movie, where innuendos therein bear semblance to their personalities, then their personal data have been introduced indirectly and these are issues for data protection laws.
Do Pseudonymized Data enjoy data protection?
Although, the Nigeria Data Protection Regulation 2019 which is obviously due for a replacement by a principal legislation does not make provision for the effect of pseudonymized data, its definition of personal data as reproduced above suggests that pseudonymized data are personal data contemplated under the regulation.
Again, further reliance will be placed here on foreign experience. In the case of GC & Others v Commission Nationale de l’informatique et des Libertés (CNIL), where one of the applicants specifically requested Google to de-reference a link leading to a photomontage pseudonymously placed on YouTube referring to an intimate relationship she had with a mayor. In ruling on her joint application, the European Court of Human Rights considered the pseudonymized data as personal data and ultimately held among other things that, Google was dutybound to de-reference the pseudonymized personal data taking “into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data.” See page 516 of Casebook on Data Protection by Olumide Babalola
According to the United Kingdom’s Information Commissioner’s Office:
“Pseudonymization is a technique that replaces or removes information in a data set that identifies an individual…However, pseudonymization is effectively only a security measure. It does not change the status of the data as personal data. Recital 26 makes it clear that pseudonymized personal data remains personal data and within the scope of the UK GDPR.”
From the definitions and references above, it seems clear again that, pseudonymized personal data are nevertheless personal data protected by law and the processing of same does not absolve a data controller from its liabilities under the relevant data protection law, in this case, the Nigeria Data Protection Regulation (NDPR), 2019.
Processing with or without consent?
From EbonyLife’s position, Tobore’s consent is not necessary as far as copyright in the movie is concerned but they omitted to address whether the latter’s “freely-given, informed and unambiguous” agreement was sought and obtained before they processed her personal data in the movie since consent has been made an issue and it is one of the lawful grounds of data processing under regulation 2.2(a) the NDPR.
For the avoidance of doubt, regulation 1.3(iii) of the NDPR defines consent as “any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, through a statement or a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her.”
Although Tobore, through her solicitors, alleged that her consent was not sought before filming, EbonyLife may want to argue that, the former was “aware” that her data would be processed in the movie especially as backed by the gratuitous promises of cash reward but this imputed “awareness” falls short of the standards required by data protection laws held in the case of Volker und Markus Schecke GbR and Anor v Land Hessen that being aware of possibility/likelihood of processing personal data does not constitute consent. See page 135 of Casebook on Data Protection by Olumide Babalola.
As held in Volker’s case, assuming EbonyLife informed Tobore of their business decision to process her personal data as part of the movie, such information in itself does not amount to consent under the NDPR except the producers can demonstrate a clear “affirmative action” on the part of Tobore signifying her agreement to such processing.
In the event that it is mooted that Tobore’s silence constituted her consent to such processing, such reasoning will not stand by virtue of the decision in Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH where the Court of Justice of the European Union (CJEU) held that, silence does not constitute consent to processing of personal data. See page 152 of Casebook on Data Protection by Olumide Babalola.
Processing done in Public Interest?
In a video circulated on social media, the Producers stated that the movie was never created as a commercial film and it was made to shed light and expose human trafficking all around the World.
Would this qualify as lawful processing under regulation 2.2(e) of the NDPR which necessitates processing done for the performance of task carried out in public interest?
In the decision in Centre For Oil Pollution Watch v. NNPC ( 2019) 5 NWLR (Pt.1666) 518 , the Supreme Court defined “public interest” as:
“…the general welfare of the public that warrants recognition and protection of something in which the public as a whole has a stake especially, an interest that justifies government regulation.”
Going by the judicial definition of public interest coupled with the Producers’ position that the movie was made to enlighten and educate people on the scourge of human trafficking around the World, it is this writer’s opinion that, this lawful basis raises an arguable defence for them in the face of cogent and verifiable proof. Again, this is neither here nor there!
Conclusively, it is this writer’s modest opinion that, apart from the copyright and ethical issues addressed by earlier commentators, the Oloture saga also raises data protection issues which constitute different cause(s) of action under the Constitution and/or Nigerian Data Protection Regulation 2019.
Thenigerialawyer
+12
