An expert in the subject, Lynda Ugo Ezike has examined a conflux of factors such as rapid advancements in globalized digital networks, the ever-heightening dependence on financial platforms and the expansion of sophisticated Information and Communication Technologies (ICTs) in data privacy and protection in the electricity sector.
She said that “as such, an epoch of unprecedented datafication has ushered in. The complex data-based ecosystem necessitates the storage, processing and transmission of personal information, piercing through every facet of individuals’ lives – from daily transactions to participation in the political sphere, to engagement with diverse sectors like energy, entertainment, fintech and healthcare, among others”.
“There are, however, grave risks such as fraud, data breach, abuse, manipulation, corruption, compromise, as well as loss and theft of information, associated with the aforementioned use of personal data. It has, therefore, become extremely crucial for there to be the safekeeping of a person(s) or organisation’s information in the possession and control of a data controller.
“The country considers its electric power industry to be on par with its national security. This means that the power industry is not left out from being in the vanguard of digital and technological advancements, as they strive to continually break the barriers of innovation. The (renewable) electricity industry, for instance, is going through a significant technological revolution, whereby households and organizations are being digitally connected to renewable energy systems. This is aimed at increasing and easing up the way in which natural resources are used by way of technology, as opposed to relying on conventional fossil fuels. The ineludible use of technology in the power industries would, therefore, automatically give rise to the processing of data.
“Consequently, this leads to the dire need to protect the said personal data/information from the negative ramifications connected to personal data breaches and unauthorized access to personal data within this dynamic technological environment. Thus, data protection and privacy have become fundamental to the safeguarding of energy consumers’ (data subjects’) personal information to such an extent that there is the prevention and protection of the occurrence of the risks attached to the processing and transfer of data.
“Effective data protection can be attained by developing and putting into practice, solid data security protocols in addition to inviolable data protection regulations – designed to address the risks connected to personal data processing activities. There is a connection between technology, privacy and data protection in Nigeria’s electricity industry. It also analyzes the pertinence of sound data privacy practices in the electricity sector, and how the relevant data protection regulatory frameworks, when adhered to judiciously, can attenuate the risks connected to the industry’s inexorable use of technology.
“For example, in the case of Bi-Courtney Aviation Services V Kelani (2021), it was held by the Court of Appeal that a person’s image forms an integral part of their ‘right to privacy’ as enshrined within section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as Amended) (the CFRN).
“Following on from the above, the protection of data, i.e. ‘data protection’ can be defined as the process of safeguarding important data/information from corruption, theft, compromise or loss (data breaches), and supplying the tools or resources necessary to restore the data to a functioning state in the event that something happens that makes it unavailable or unsuitable. The principle of data protection mandates every organization to process and be in control of sensitive (personal) information – whether digitally or otherwise, to ensure the information is appropriately protected.
“Within digitalized electricity distribution networks, smart meters and all other comparable smart applications serve as a medium through which electricity consumers actively monitor their energy consumption rates instantaneously. This is made practicable by the fact that such devices collect and process comprehensive data on patterns of energy consumption at brief intervals. This transparency is further enhanced by interactive online energy retail platforms, serving as a vehicle through which a variety of innovative services are made available.
These innovative services foster empowered consumer engagement through data-driven insights, enabling proactive management strategies for cost reduction and environmentally conscious choices. Ultimately, the promotion of energy conservation within communities is the goal of companies operating within the electricity/power sector.
“The electricity Distribution Companies (Discos) in Nigeria play the important role of providing electrical power to the end-users – by way of technology. A technology that has profoundly impacted the Nigerian electricity industry is the smart meter.
“A smart meter is an electrometer that periodically captures data on a customer’s voltage level and power consumption without the need for physical meter readings. So, in an effort to improve Nigeria’s Disco’s financial viability while reducing their loss of earnings, the emplacement of the prepaid smart meter technology serves as a catalyst to ensure the sustainability of the electricity sector. Smart meter usage is essential to the stability of Nigeria’s electrical system and is necessary for a dependable, reasonably priced, and sustainable energy economy.
“In comparison to the traditional electromechanical meters in which an employee from the electricity distribution company would manually take down information on the power user’s consumption matrix at certain intervals by logging the reading on the meter, digital smart meters allow for communication between the consumer and utility company in addition to recording customers’ kilowatt-per-hour usage.
“They also allow for the breakdown of energy usage into smaller, discrete time intervals. This information aids households in reducing energy expenses and amplifies reliability by availing electricity suppliers with relevant data about the quantity of electricity being used throughout their service areas. This availability of data reduces energy prices for homes and improves dependability by giving electricity end-users and electricity suppliers better insight into the amount of electricity consumed.
“However, there are identifiable data protection challenges that spring up regarding the utilization of a smart meter. In using smart meters, data such as the quantity of power usage by the consumers would be conveyed to the customer such that he/she possesses the requisite information about his/her consumption use. This said data would also be communicated to the electricity supplier as a means to monitor and secure payments for the power afforded to the customers. As such, it can be said that the detailed information collected on energy usage patterns brings to bear data protection issues.
“The data collected and stored can reveal insights into an electricity consumer’s behaviour and routines – thereby requiring strong privacy security measures. For example, such information can be used to detect fraud, support, or refute an alibi etc.
“Relevant authorities or personnel, such as law enforcement or electricity distribution companies would be able to obtain personal information from smart meters, including a person’s daily schedule, the types of appliances he/she uses in his/her home, and whether or not they are in their place of abode. The disclosure and flow of personal information or data to the various relevant parties involved, thus, introduces data protection-related concerns.
“Another issue of import regarding data protection matters in the electricity sector revolves around the adoption of financial technologies to facilitate the payment of electricity bills by energy consumers. Cashless or online payments are, therefore, great technological innovations by fintech companies that aid the electricity sector with the ease of conducting business and transactions. Such payments are typically made by way of licensed information communication technology platforms e.g., the Internet, mobile applications, smartphones etc.
“Another point worthy of note is that discos may use Client Management Systems or Customer Engagement Platforms to help manage energy consumers’ accounts, track the services rendered, maintain a relationship and communication with (potential) customers and proffer possible personalized recommendations.
“In a general sense, the employees of companies carrying out operations in the electricity sector would, in the ordinary course of business, have their (and possibly families’) personal data processed, controlled and distributed. Such information may be required for the application of health insurance/coverage, for instance. Furthermore, personal information pertaining to visitors of the company – which may be imputed in the ‘Visitors Registers’ or their images captured on CCTVs, is also under the control of the electricity companies. Such information could be an easy target for personal data security breaches – thereby leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the said personal information processed, transmitted or controlled.
“This triggers an urgent need for the establishment of the apposite technical and organizational initiatives that guarantee the protection of the personal data the electricity company possesses or handles.
“The pertinence of privacy and data protection in Nigeria’s electricity/power industry cannot be overemphasized. The utilization and advancement of technology in the electricity sector in conjunction with the digitalization of the industry – has occasioned the inadvertent control, processing and transfer of (personal) data.
Nigeria’s data protection regulatory framework addresses all issues that may stem from an electricity company’s data processing activities and expounds on the importance of safeguarding the data privacy rights and personal data of its data subjects.
Electric power companies are to integrate data protection principles, as outlined in the relevant data protection regulations, into their daily data processing activities. Such data protection processing activities must be lawful, fair transparent; necessary and proportional; accurate etc.
Furthermore, electricity companies must ensure that they adhere to the relevant data protection laws to avoid sanctions from the relevant regulatory bodies, preserve their business reputation, mitigate the risk of personal data breaches, and protect their stakeholders’ information.
