withdrawal of consent shall not affect the lawfulness of processing based
on consent before its withdrawal;
d) when assessing whether consent is freely given, utmost account shall be
taken of whether, the performance of a contract, including the provision
of a service, is conditional on consent to the processing of personal data
that is not necessary (or excessive) for the performance of that contract
and
e) where data may be transferred to a third party for any reason
whatsoever
2.4 DUE DILIGENCE AND PROHIBITION OF IMPROPER MOTIVES
(a) No consent shall be sought, given or accepted in any circumstance that may
engender direct or indirect propagation of atrocities,
hate, child rights violation,
criminal acts and anti-social conducts;
(b) A party to any data processing contract, other than an individual data subject,
shall take reasonable measures to ensure the other party does not have a record of
violating the principles set out in Section 5 and he is accountable to NITDA or a
reputable regulatory authority for data protection within or outside Nigeria;
accordingly, every Data Processor or Controller shall be liable for the actions or
inactions of third parties which handles the personal data of Data Subjects under this
Regulation;
(c) In this section, “a party” shall include directors, shareholders, servants and
privies of the contracting party; and record shall include report public record and
reports in
credible news media. Accordingly, the distinction between legal and
natural persons for the purpose of limiting due diligence is irrelevant.
2.5 PRIVACY POLICY
Notwithstanding anything contrary in this Regulation or any instrument for the time
being in force, any medium through which personal data is being collected or
processed shall display a simple and conspicuous privacy policy that the class of
Data Subjects being targeted can understand. The privacy policy shall in addition to
any other relevant information contain the following:
9