REGULATORY ANALYSIS Digital Entrepreneurship in Nigeria REGULATORY ANALYSIS Digital Entrepreneurship in Nigeria © 2021 International Bank for Reconstruction and Development / The World Bank Group 1818 H Street NW Washington DC 20433 Telephone: 202-473-1000 Internet: www.worldbank.org DISCLAIMER This work is a product of the staff of The World Bank with external contributions. The findings, interpreta- tions, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. RIGHTS AND PERMISSIONS The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Any queries on rights and licenses, including subsidiary rights, should be addressed to the Office of the Publisher, The World Bank, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522-2422; e-mail: pubrights@worldbank.org. CONTENTS Abbreviations v Acknowledgments vii 1. EXECUTIVE SUMMARY 1 2. INTRODUCTION 5 3. SNAPSHOT OF THE DIGITAL ECOSYSTEM IN NIGERIA 8 Definition and Attributes of Digital Firms 8 Landscape of Nigerian Digital Firms 9 Institutional Landscape 12 Variation in the Rules 14 Intermediary Organizations 14 Ventures Platform 16 Wennovation Hub 17 4. REGULATORY REVIEW 19 Background: Nigerian Legal System 19 Incorporation or Registration of Companies 20 ADOPT: Basic Regulations to Allow Digital Businesses to Operate 21 Electronic Contracts 21 Electronic Documentation and Electronic Signatures 22 Cross-Border Data Flows 23 Personal Data Protection 24 Taxation 27 SCALE: Enabling Regulation to Build Trust and Allow Digital Businesses to Scale Up 28 Online Dispute Resolution Mechanism 28 Online Consumer Protection 29 Cybersecurity 30 Intermediary Liability 33 Intellectual Property 34 Other Sectoral Consumer Protection Regulations 35 Digital Entrepreneurship in Nigeria   iii CONTESTABILITY: Regulations to Level the Playing Field for All and Increase Competition 37 Antitrust 2.0: Abuse of Dominant Position 38 Antitrust 2.0: Restrictive Agreements Between Competing Firms and Merger Review 39 5. CONCLUSION 42 6. REFERENCES 50 7. ANNEXES 52 Annex 1. List of Interviews 52 Annex 2. Data Analysis Methodology 53 Annex 3. Case Studies 54 Flutterwave 54 Konga 72 55 MAX.ng 56 Outsource Global 57 Promane and Promade 58 Reliance Health 59 Wellahealth 62 FIGURES Figure 1: GDP, Real Constant Growth Rates 2016–2020 5 Figure 2: Digitalization Pillars 6 Figure 3. Framework to Identify Regulatory Gaps by Level of Digital Ecosystem Maturity 6 Figure 4. Digital Platforms and Data-Driven Firms 9 Figure 5. Distribution of Digital Firms by Industry 11 Figure 6. Mature Firms vs. Start-Ups 11 Figure 7. Number of Digital Firms by Foundation Year 11 Figure 8. Companies by Financing Status 12 Figure 9. Percentage of Digital Firms by Financing Status 15 Figure 10. Percentage of Intermediary Organizations by Location 15 Figure 11. Intermediary Organizations by Type TABLES Table 1. Recommendations 4 Table 2. Attributes of Digital Firms 9 Table 3. Employment and Financial Descriptive Statistics for Nigerian Digital Firms 10 Table 4. Overview of Nigerian Government Entities in the Digital Policy Space 13 Table 5. Topic Cluster Analysis of Intermediary Organizations 15 Table 6. Main Findings of the Regulatory Review 44 iv   Digital Entrepreneurship in Nigeria ACRONYMS AND ABBREVIATIONS ACA Arbitration and Conciliation Act ISP Internet service provider ADR alternative dispute resolution IT information technology AfCFTA African Continental Free Trade Agreement Area LIRS Lagos Internal Revenue Service AGM annual general meeting LLP limited liability partnership APA Advertising Practitioners Registration Act LMDC Lagos Multi-Door Courthouse APCON Advertising Practitioners Council of Nigeria LWG Legal and Regulatory Reform Working Group ATM automated teller machine mPOS mobile point of sale B2B business to business MSME micro, small, and medium enterprise B2C business to consumer M2C manufacturer to consumer B2B2C business to business to consumer NAFDAC National Agency for Food and Drug Administra- BCR binding corporate rule tion and Control CA Certificate Authority NCA Nigerian Communications Act CAC Corporate Affairs Commission NCAA Nigerian Civil Aviation Authority CAMA Companies and Allied Matters Act, 2020 NCC Nigerian Communications Commission CBN Central Bank of Nigeria NDPR Nigeria Data Protection Regulation CERT Computer Emergency Response Team NERC Nigerian Electricity Regulatory Commission CIT Companies Income Tax NETA Nigerian Electronic Transaction Act CITA Companies Income Tax Act NIPC Nigerian Investment Promotion Commission CRM customer relationship management NITDA National Information Technology Development C2C consumer to consumer Agency DPB Data Protection Bill 2020 NRC nonresident company DRS dispute resolution system ODR online dispute resolution ECOWAS Economic Community of West African States OECD Organisation for Economic Co-operation and EU European Union Development FCCPA Federal Competition and Consumer OIIE Nigerian Office for ICT Innovation and Protection Act Entrepreneurship FCCPC Federal Competition and Consumer ONSA Office of the National Security Advisor Protection Commission O2O online to offline FMoCDE Federal Ministry of Communications and PCI DSS Payment Card Industry Data Security Standards Digital Economy PKI public key infrastructure GDP gross domestic product SEC Securities & Exchange Commission GDPR General Data Protection Regulation SEP Significant Economic Presence HAGF Honourable Attorney General of the Federation SON Standards Organisation of Nigeria ICT information and communications technology UNCITRAL United Nations Commission on International ID4D Identification for Development Trade Law IP intellectual property VAT value-added tax IPR intellectual property rights WEF World Economic Forum Digital Entrepreneurship in Nigeria   v ACKNOWLEDGMENTS This report was prepared by a team led by Siegfried Zottel (Senior Financial Sector Specialist, Finance, Competitiveness, and Innovation Global Practice) and Juni Tingting Zhu (Private Sector Specialist, Markets & Technology Unit), with Ana Cristina Alonso Soria (Private Sector Development Consultant, Markets & Technology Unit) and Keongmin Yoon (Counsel, Legal Operations) as the main authors. The report benefited from the support of Olatokunbo Ifeanyichukwu Fayomi (Consul- tant), Ma. Regina Paz Saquido Onglao (Consultant), Jason Anastasopoulos (Consultant), Olumide Osundolire (Consultant, Banwo & Ighodal), Daniel Sokol (Consultant, University of Florida), Hsing K. Cheng (Consultant, University of Florida), and Chizoba Akuabata Onoh (Consultant). Sara Nyman (Senior Economist, ETIMT), Prasanna Lal Das, Bolanle Abubakar Karimu (Senior Financial Sector Specialist, Finance, Competitiveness, and Innovation Global Practice), Feyi Boroffice (Resident Rep- resentative, World Bank Office, The Gambia), Ida S. Mboob (Senior Digital Development Specialist, Digital Development), and Eva Clemente Miranda (Private Sector Specialist, Finance, Competitive- ness, and Innovation Global Practice) provided valuable guidance for the preparation of the report. Special thanks to Olusegun Sayo Jayesimi (Consultant, Africa Advisory Services), Loretta Ann Grace Matthews (Consultant), Meseret Belete Mengesha (Program Assistant, Markets and Technology Unit) and Adela Antic (Consultant). This report benefited from inputs from different stakeholders in the Government of Nigeria, private sector firms, and intermediary support organizations. Special thanks to Inuwa Kashifu Abdullahi, Director General of the National Information Technology Development Agency (NITDA); the team at NITDA; Yewande Sadiku, Executive Secretary/CEO of the Nigerian Investment Promotion Com- mission (NIPC); the team at NIPC; Dr. Adeluyi Olufemi at the Ministry of Communications and Digi- tal Economy; the teams at the Federal Competition and Consumer Protection Commission, and to the Ministerial Broadband Implementation Steering Committee. Annex 1 provides a detailed list of local stakeholders consulted in developing the report. The team thanks Tora Estep for editorial assistance and Naylor Design, Inc. for design and layout assistance. Digital Entrepreneurship in Nigeria   vii viii   Digital Entrepreneurship in Nigeria 1 EXECUTIVE SUMMARY As one of the largest markets in Sub-Saharan Africa, covered in the report; interviews with digital firms, gov- Nigeria is uniquely positioned to become a regional ernment institutions, and private intermediaries; and data leader in native digital entrepreneurship. The gross analysis using traditional and alternative data sources. domestic product (GDP) of the information and communi- While the report focuses on the regulatory aspects, other cations technology (ICT) sector grew at an average rate of issues highlighted by interviewed firms, for example in the 5 percent from 2016 to 2019, well above the 0.83 percent areas of access to finance and infrastructure, are also pre- average annual growth for the whole economy (National sented to complement the analysis. Bureau of Statistics 2020). As Nigeria’s National Digital Economy Policy and Strategy 2020–2030 highlights, the Analysis using traditional and alternative data anal- growth of the digital sector over the past few years evi- ysis and data extraction methods shows that as of dences the potential of digital businesses to reconfigure the end of 2020 at least 615 digital firms were oper- traditional sector dynamics, providing new sources of ating in Nigeria.1 The largest number of digital firms is employment and economic diversification away from the concentrated in the financial sector, including firms that oil and gas sector. Much sector dynamism comes from provide financial software, consumer finance, and spe- new entrepreneurial activity. While the foundational ele- cialized finance and other financial services. Digital firms ments for a thriving ecosystem are present, important in the education sector are also prevalent, for example gaps persist, including, among others, inadequate legis- firms offering educational software and educational train- lation for digital firms. ing services and other human capital development ser- vices. Business-to-business (B2B) services firms, including This report aims to present an overview of the regu- business and productivity software providers, media and latory framework surrounding digital firms in Nigeria information services, software development applications, and provide recommendations to strengthen relevant and automation and workflow software and network man- regulatory areas. This review identifies regulatory gaps agement software companies, are also common. Several by level of digital ecosystem maturity. The areas ana- key industries also have a smaller number of firms such as lyzed include electronic transactions and electronic doc- logistics, real estate, automotive, and retail. umentation, trust-building regulations (data protection, consumer protection), and antitrust provisions and regu- Evidence points to an increasingly complex digital lations. The framework adopted by this review (detailed in environment, with innovative business models that fill the approach and methodology sections) aims to support service gaps in the country. Companies exhibit a lot of policy makers in identifying digital laws that are critical variation in terms of the complexity of their business mod- for the development of a digital ecosystem and poten- els and operations, from B2B to business-to-consumer tial regulatory gaps or areas for improvement. The report (B2C) to business-to-business-to-consumer (B2B2C), was completed following desk and qualitative research by and many were created to fill a gap—for example in the a local legal firm with experience in the regulatory areas insurance, leasing, or financing markets—that was under- Digital Entrepreneurship in Nigeria   1 served by traditional, nondigital businesses. The larger, nesses encounter when conducting commercial transac- more established firms tend to have a diversified set of tions online.2 The ratification of the African Continental digital offerings and products. For example, WellaHealth, Free Trade Agreement Area (AfCFTA) in November 2020 a company originally selling customer relationship man- adds urgency to the regulatory agenda, especially given agement (CRM) software solutions for pharmacies, now the agreement’s focus on fostering digital trade and trade offers an app-based malaria insurance product. In gen- facilitation mechanisms through digital platforms. eral, the Nigerian market displays much room for growth, as quite a few firms still lack a direct competitor in their The regulatory environment for e-commerce in Nige- space. ria has evolved in recent years, but regulatory gaps remain. We recommend the government to follow the Common challenges private firms cited during inter- adopt, scale, and contestability framework described views include access to finance, access to skills, and a in section 4 of this document to prioritize actions for challenging regulatory environment. Virtually all firms strengthening the regulatory areas that this review covers. reported using personal and informal sources of funding The following summarizes the main gaps and areas for for the company and highlighted access to finance as an improvement that the framework addresses. important constraint. Innovation hubs confirmed these constraints: access to finance and skills training are the ADOPT: BASIC REGULATIONS TO ALLOW most sought-after services by entrepreneurs. Access to DIGITAL BUSINESSES TO OPERATE reliable internet services and infrastructure also seems to be an important concern for firms. Electronic contracts. Currently no law governs electronic transactions in Nigeria. Because commercial transactions Many traditional legal rules and mechanisms devel- are typically based on contracts, the traditional principles oped for traditional commerce in Nigeria circa 1950 of common law that relate to contracts apply to electronic have yet to be adapted to digital commercial trans- contracts. actions. As a result, the legal infrastructure applicable to e-commerce remains underdeveloped and incomplete Taxation. How the Companies Income Tax Significant and legal certainty based on well-functioning rules is not Economic Presence (SEP) Order 2020 will be administered always present, making predictions about future behavior and enforced as it relates to digital service providers lacks of firms and markets difficult. In some areas, the multi- clear provisions (Blackwood & Stone LP 2020). plicity of laws and regulation help to address what would otherwise be gaps in e-commerce regulation. However, E-signatures and electronic documentation. A lack of in some cases, overlapping and potentially contradictory regulations exists regarding the technical or procedural regulations create an overly restrictive environment that requirements for validating e-signatures; a regulatory might stymie e-commerce in Nigeria. authority empowered to administer the provisions of the Cybercrimes Act and the Evidence Act in the context of The regulatory environment for digital business in e-commerce is absent; and provisions pertaining to elec- Nigeria remains at its formative stage and continues tronic signature are fragmented among three laws—the to rely on laws, regulations, and guidelines that gov- Cybercrimes Act, the Evidence Act, and the Companies ern traditional modes of business. However, in recent and Allied Matters Act (CAMA) 2020—with seemingly dif- years, the National Information Technology Development ferent terminology. Agency (NITDA) has been active in developing subsidiary regulatory instruments and policies to drive the adoption Personal data protection and cross-border data flows. of technology to automate business and government A comprehensive and sufficiently robust legal framework activities. Notable legislative efforts, especially in the on privacy is lacking in Nigeria outside the general privacy areas of cybercrime, cybersecurity, taxation of digital ser- stipulation of the Constitution and a few statutes that have vices, and data protection, have helped fill important gaps privacy and data protection provisions. in the legal framework for the digital economy. However, gaps remain in areas that are important for the growth The subsidiary nature of the Nigeria Data Protection Reg- of digital markets, for example, intermediary liability and ulation (NDPR) puts its provisions at risk of conflict with e-transactions law. If approved and signed into law, the those of a primary legislation. Electronic Transactions Bill will represent an important enabler for e-commerce in Nigeria and help eliminate A properly constituted regulatory agency empowered to some of the uncertainties that both consumers and busi- administer and enforce NDPR provisions is absent. 2   Digital Entrepreneurship in Nigeria SCALE: ENABLING REGULATIONS TO Intermediary liability. The absence of a law on intermedi- BUILD TRUST AND ALLOW DIGITAL ary liability means no uniform guidance is available on the BUSINESSES TO SCALE UP issue and no minimum standard exists with which interme- diaries must comply. Online dispute resolution mechanism. The alternative dispute resolution (ADR) framework provides the reassur- ance and certainty necessary for commercial undertakings CONTESTABILITY: REGULATIONS TO LEVEL to rely on the enforceability of electronic contracts. Such THE PLAYING FIELD FOR ALL AND INCREASE reliance is important because it forms the cornerstone for COMPETITION such undertakings to adopt electronic contracting as a Antitrust 2.0. The 2019 FCCPA and the creation of the way of doing business and promotes the growth of elec- Federal Competition and Consumer Protection Commis- tronic commerce. sion (FCCPC) in 2019 were significant developments and important steps toward improving the ease of doing busi- Consumer protection. The Federal Competition and ness and ensuring market contestability and competition. Consumer Protection Act (FCCPA) that governs consumer Areas of improvement include improving the thresholds protection in Nigeria provides general rules, but it is not for notification of small mergers and the criteria to review specially designed to address issues that may arise in the small mergers and the development of guidelines on context of electronic transactions. digital economy issues (for example, market definition, assessment of abuse of dominance) (The World Bank Cybersecurity. The Cybercrimes Act, modeled after the Group 2019a). African Union Convention on Cybersecurity and Personal Data Protection and the Economic Community of West African States (ECOWAS) Directive (January 8, 2011), pro- Table 1 lists the recommendations of the report. The con- vides for an effective, unified, and comprehensive legal, clusions section provides more details on each area. regulatory, and institutional framework for the prohibition, prevention, detection, prosecution, and punishment of cybercrimes in Nigeria. Digital Entrepreneurship in Nigeria   3 TABLE 1. Recommendations IMPORTANCE FOR PRIORITIZATION AND TO ENSURE THE PASSAGE INTO LAW OF LEGISLATION PROVIDING FOR THE FOLLOWING IMPLEMENTATION The validity, enforceability, and admissibility of electronic documents and transactions High The role of NITDA as the administrative authority empowered to issue rules, guidelines, and stan- High dards for data protection, electronic signatures, and electronic transactions The authentication of electronic documents and rules for acceptance of electronic signatures High Harmonization and/or consolidation of electronic signature regulations that three laws—the Cyber- High crime Act, the Evidence Act, and CAMA—currently cover with seemingly different terminology A well-defined privacy and data protection regime, with a clear determination of the role and purview High of the corresponding data protection agency The legality of electronic signatures created or used outside Nigeria provided they satisfy Nigerian Medium certification standards Consumer protection provisions that address issues in electronic commerce such as fair business and High advertising and marketing practices; clear information about an online business’s identity, the goods or services offered, and the terms and conditions of any transaction; a transparent process to confirm transactions; secure payment mechanisms; fair, timely, and affordable dispute resolution and redress mechanisms; privacy protection; and consumer and business education An intermediary liability regime applicable to electronic transactions High IMPORTANCE FOR PRIORITIZATION ADDITIONAL RECOMMENDATIONS TO STRENGTHEN THE REGULATORY REGIME AND EASE OF AND DOING BUSINESS IMPLEMENTATION To clarify how the SEP provision will be administered and enforced, and whether the corporate Medium income tax returns will be based on actual or deemed income basis FCCPC should consider engaging with other government regulators that affect the dynamics of dig- Low ital markets. Additionally, the FCCPC should consider developing competition guidelines on digital economy issues (for example, market definition, assessment of abuse of dominance) (The World Bank Group 2019a). Regarding merger review regulations and notice for review (the World Bank Group 2019a), FCCPC Low could consider using provisions relating to “small mergers” to review mergers in the digital economy that would not otherwise meet notification thresholds. Other areas for further exploration that fall outside the scope of the report include public key infrastructure (PKI) and legislation of blockchain technology and blockchain-empowered contracts. NOTES 1. See annex 2 for more details on the methodology employed for data analysis and extraction. 2. The National Assembly Bill tracker information indicates that the first review session of the bill took place on October 10, 2019. No other sessions on this bill have been held since then. https://www.nassnig.org/documents/bill/10766# 4   Digital Entrepreneurship in Nigeria 2 INTRODUCTION As one of the largest markets in Sub-Saharan Africa, FIGURE 1: GDP, Real Constant Growth Rates 2016–2020 Nigeria is uniquely positioned to become a regional 20 leader in native digital entrepreneurship. The gross domestic product (GDP) of the information and com- 15 munications technology (ICT) sector grew at an average 10 rate of 5 percent from 2016 to 2019, well above the 0.83 5 percent average annual growth for the whole economy (figure 1) (National Bureau of Statistics 2020). As high- 0 lighted in Nigeria’s National Digital Economy Policy and –5 Strategy 2020–2030, digital sector growth over the past few years evidences the potential of digital businesses –10 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 to reconfigure traditional sector dynamics, providing new sources of employment and economic diversifica- 2016 2017 2018 2019 2020 tion away from the oil and gas sector. Much sector dyna- Telecommunications & Information Services GDP mism comes from new entrepreneurial activity. According GDP at 2010 constant prices to data from Pitchbook, between 2009 and 2019, 164 launches of business-to-business (B2B) digital companies3 Source: National Bureau of Statistics and 227 launches of business-to-consumer (B2C) digital companies took place in Nigeria in sectors as diverse as transportation, entertainment, e-commerce, agritech, and potential improvement in the regulatory environment for ed-tech, among others. digital firms and digital service providers, which could be further strengthened to support the creation and growth The foundational elements for a thriving digital ecosys- of digital firms. tem are present, but important gaps persist (The World Bank Group 2019b). According to Nigeria Digital Econ- Law and regulation can be used to promote entre- omy Diagnostic Report (The World Bank Group 2019b), preneurial activity, innovation, and inclusion. Legal some of the most important weaknesses of the Nigerian development through courts and administrative agencies entrepreneurship ecosystem is the inadequate legislation allows for experimentation that generates opportunities for innovative financing and digital start-ups, the lack of for digital firms and their customers. Examples include digital skills and early-stage investors, and uneven inter- contracting for data rights and the unique interaction net/mobile penetration, which are critical elements for between more generally applicable legal rules for com- digitalization (figure 2). This study highlights areas for mercial transactions and rules for online transactions, such Digital Entrepreneurship in Nigeria   5 FIGURE 2: Digitalization Pillars Transportation Manufacturing Other services Agribusiness Education Tourism Mining Health Retail Digital solutions providers (Digital platforms, data firms, Fintech, software developers, BPO) Enabling policies and regulations Access to finance Digital skills Digital infrastructure Source: Authors’ elaboration Note: BPO = business process outsourcing FIGURE 3: Framework to Identify Regulatory Gaps by Level of Digital Ecosystem Maturity 3. Contestability: To level the playing field for all and increase rivalry • Antitrust 2.0 2. Scale: To build trust and enable digital businesses • Competitive neutrality including for online-offline market players to call and drive mass digital uptake • Data portability and rules to DIGITAL START-UPS GROW • Online consumer protection facilitate switching and multi- • Online supplier protection homing 1. Adopt: To allow digital businesses to operate and digital solutions to • Personal data protection • Foreign investment regulations • Open data/industry data to digital firms be adopted policies • Digital taxation harmonization • E-transaction/e-Commerce law • Cybersecurity/cybercrime • Licenses to turn spare assets into • Access to government commercial use (e.g. home/ride procurement contracts, sharing) especially for MSME • Sectoral regulation requirements • Intellectual property (e.g. food safety, housing safety, protection passenger safety) • Venture capital regulations • Unique taxpayer registration (e.g. for gig-workers) • Regional harmonization for digital single market • Cross-border data flows DIGITAL BUSINESS MODELS ADOPTION INCREASES IN THE ECONOMY Source: World Bank Group (2021) Note: MSME = micro, small, and medium enterprise as contracting between e-commerce platforms and sell- digital ecosystem (figure 3). This review includes regula- ers. Additionally, some specific regulations pertain only to tory areas that are critical for enabling trust and allowing electronic transactions. digital firms to scale and an introduction to the state of market contestability regulation in the context of digital The innovative nature of business models in the dig- markets. ital space requires a careful balance between poten- tial risks and tradeoffs and efficiency gains from new This regulatory review follows this framework by analyzing technologies. The adoption of a three-tiered framework the state of regulation that is critical to guarantee adop- can help policy makers prioritize legislation and regula- tion, contestability, innovation, growth, protection, and tions and adapt them to the level of development of the equity in digital markets: 6   Digital Entrepreneurship in Nigeria • ADOPT: basic regulations to allow digital businesses The objective of this report is to present an overview of to operate. Rules to allow for entry and creation of the regulatory framework surrounding digital firms in new business models, such as e-transaction laws to Nigeria and provide recommendations to strengthen ensure basic legal legitimacy of online transactions; relevant regulatory areas, following the “adopt, scale, cross-border data flow provisions; and digital business and contestability” framework. The report was pre- registration requirements, including sectoral permits pared using a novel combination of data analysis using and licenses. traditional and alternative data sources;4 interviews with digital firms,5 government institutions, and private inter- • SCALE: enabling regulation to build trust and allow mediaries; and desk and qualitative research. The report digital businesses to scale up. Rules to enable trust is divided into four main sections. Section 3 presents in online transactions so digital business models can a snapshot of the digital ecosystem in Nigeria, includ- scale, such as consumer and supplier protection, ing an overview of the types of digital firms operating cybersecurity, personal data protection, cybersecu- in the country, relevant government actors and policies, rity and cybercrime, intellectual property protection, and intermediary support institutions (tech hubs, innova- among others. tion hubs, venture capital firms). Section 4 presents an • Contestability: regulations to level the playing field assessment of the regulations applicable to digital firms for all and increase competition: Rules to guarantee in Nigeria, including the state of regulations regarding fair competition between online and offline players, electronic transactions and electronic documentation, large and small firms, and foreign and local firms, trust-building regulations (data protection, consumer including data storage, access, processing, re-use, protection), and antitrust provisions and regulations. Sec- interoperability, cross-border data flows, antitrust reg- tion 5 concludes. ulations, competitive neutrality, digital taxation harmo- nization, among others. NOTES 3. The terms digital business and digital firms are used interchangeably. For the purposes of this note, these terms include both digital platforms and digital services providers. 4. The term alternative data refers to online, digital data either published in consumable open data format or otherwise available for scraping. 5. Refer to annex 1 for a complete list of actors interviewed. Digital Entrepreneurship in Nigeria   7 3 SNAPSHOT OF THE DIGITAL ECOSYSTEM IN NIGERIA Digitalization can be described as the process through market expansion opportunities (for example, through which firms in an industry start deploying digital tech- e-commerce platforms). Analysis of the adoption of nologies and solutions throughout their value chain. information technology (IT)–enhanced equipment in the The potential intensity of digitalization varies by the manufacturing sector has shown that plants that adopt type of industry, the value chain activities each firm per- IT-enhanced equipment shift their business strategies to forms (with some activities within the value chain more produce more customized products; improve efficiency amenable to digitalization than others), and the activities by saving time during setup, production runs, and inspec- through which firms in that industry derive their key reve- tions; and adopt new talent-sourcing strategies that focus nue stream (core transaction objects), among others. For more on problem-solving and technical skills (Bartel, Ich- example, in the agriculture sector, vertically integrated niowski, and Shaw 2007). In agriculture, the adoption of large-scale farms usually have well-established channels digital platforms can help farmers connect with large buy- with large food companies, lowering the scope for plat- ers or avoid intermediation by connecting them directly to formization, while small farmers who usually sell their restaurants and catering services (farm-to-table). products to middlemen at the farm site have a higher potential for digitalization through e-commerce platforms The pace of digitalization rests on the quality of digital (GSM Association 2019). infrastructure and enabling policies and regulations. Firms within an industry can digitalize by developing dig- Companies may deploy digital technologies or digital ital technologies in-house or by sourcing from digital ser- services to 1) transform their business model, 2) opti- vice providers. Firms at the high end of the digitalization mize the production process of final goods and ser- spectrum usually take the form of digital platforms and vices, and 3) update their business support functions, data-driven firms (figure 4). such as distribution and logistics, marketing, sales and after-sales services, administrative and management DEFINITION AND ATTRIBUTES OF functions, procurement and supplier relations, and DIGITAL FIRMS research and development. For example, for a large retail firm, the digitalization of distribution and logistics Digital firms are characterized by high levels of con- functions may entail the launch of an e-commerce plat- nectivity, low geographic limitations, data intensity, form along with the supporting logistics network, whereas low transaction and menu costs, and more opportu- for a small grocery store, digitalization may begin by offer- nities for price discrimination (Täuscher 2016). These ing click-and-collect services at its location (GSM Associ- characteristics allow digital firms more flexibility to evolve ation 2019). constantly. For example, Amazon’s initial value proposi- tion relied on selling physical goods (books) and a rela- Digitalization can bring benefits in the form of effi- tively simple business-to-consumer (B2C) model, local in ciency gains, added value to consumers, and new geographic scope. Now, the company has evolved into a 8   Digital Entrepreneurship in Nigeria FIGURE 4: Digital Platforms and Data-Driven Firms • Commercial digital platforms are multisided online marketplaces that enable producers and users to create value Digital platforms together by removing market frictions, facilitating interactions and matching, and by exploiting and managing direct and indirect network effects (Still et al. 2017). They offer distinctive benefits for users, for example, lower transaction costs, lower search costs, lower prices of intermediate and final goods, and better quality of products and services. The rise of digital platforms presents important risks, usually in the form of anticompetitive behavior and lack of consumer and contractor protection. For example, network effects and winner-takes-all dynamics may foster market concentration, and incumbents may engage in collusive and discriminatory practices that affect new entrants and suppliers, usually by exploiting data as a source of market power. • Data-driven technology firms systematically and methodically collect or aggregate large datasets and Data-driven leverage advanced analytics to create value for customers. They tend to rely on data as a key resource in their rms business model (Hartmann 2014). Data-driven technology firms can help traditional industries upgrade through servicification to optimize production processes, increase sales, streamline decision-making, and even re-think revenue models. Data-driven technology firms are increasingly observed in the aritficial intelligence era, and most digital platforms are also data-driven firms. Source: Insight 2 Africa (2018). TABLE 2. Attributes of Digital Firms BUSINESS MODEL ATTRIBUTES TYPES OF BUSINESS MODEL BY ATTRIBUTE Value proposition Transaction type (physical good, physical service, digital good, digital service) Industry scope (vertical (sector-specific), horizontal) Value capture Key revenue stream (commission, advertising fees, subscription, service sale, retail, license, finan- cial risk) (Schlie, Rheinboldt, and and Waesche 2011) Main revenue partner (seller, buyer, third party, hybrid) Pricing mechanism (fixed, market, differential by product feature, customer, volume, geography) (Osterwarlder, 2004) User segments B2C, B2B, B2B2C, B2C2C, C2C (peer-to-peer), O2O, M2C Underlying Internet of Things, artificial intelligence engines, intelligent automation, quantum computing, cloud technology technologies, etc. Geographic scope Global (more than 20 countries in two or more continents) (Schief 2014) Local (country specific) Regional (fewer than 20 countries or single continent) Source: Adapted from Täuscher (2016) Note: B2B = business to business; B2B2C = business to business to consumer; B2C = business to consumer; B2C2C = business to consumer to consumer; C2C = consumer to consumer; M2C = manufacturer to consumer; O2O = online to offline global platform that offers both digital and physical goods LANDSCAPE OF NIGERIAN DIGITAL FIRMS and services with complex revenue models and pricing Traditional and alternative data analysis and data mechanisms. extraction methods show that at least 615 digital firms currently operate in Nigeria.6 The true number Digital firms can be analyzed through their key busi- of digital firms operating in the country is by nature dif- ness model attributes: value proposition, value capture, ficult to quantify. Using a combination of proprietary user segments, underlying technology, and geographic data, open source databases, web scraping, and pub- scope (table 2). lic administrative data, we were able to compile a novel database of digital firms. Digital firms were selected for Digital Entrepreneurship in Nigeria   9 the database by identifying key terms in the compa- young firms, which often focus on developing digital ny’s description through machine learning text analysis technologies as part of their core product or services, techniques.7 The following analysis is based on a subset tend to display high-growth characteristics, given low of firms for which a key set of variables was available. marginal replication costs and network effects. The rate According to this analysis, the mean number of employ- of creation of new firms seems to have accelerated sub- ees of digital firms is 109, with the first quartile of firms stantially in 2011, with a peak number of firms founded employing 5 employees on average and the top 75 in 2016 (figure 7). percent employing a mean of 50 employees (table 3). The average amount of financing raised by digital firms Most digital firms are currently generating reve- is close to US$7 million, with the first quartile of firms nue, including start-ups; however, very few of these raising an average of US$300,000 and the top quartile businesses are profitable, and many, particularly the raising around US$1.6 million (table 3). The first financ- smaller businesses, went out of business (figure 8). The ing valuation of firms at the 50th percentile is US$1.46 firms that are generating revenue were started within the million on average, with the top quartile’s average closer past four to six years, but profitable firms were started to US$1.7 million (table 3). before 2012. In general, 2012 seems to be a pivotal year in which most start-ups were founded. The financing sta- Digital firms are mostly concentrated in the financial, tus of businesses contains information about the types of social media, business services, and education indus- organizations that provided initial and continuing fund- tries. Figure 5 presents the top industries by number of ing for digital firms. Figure 9 plots the percentage of firms. The largest number of digital firms is concentrated digital firms by financing status and suggests that most in the financial sector, including firms that provide finan- firms are backed by venture capital, incubators, or cor- cial software, consumer finance, and specialized finance porations. Dividing these results by year founded shows and other financial services. Digital firms in the education that venture capital and incubator funding accelerated sector are also prevalent, for example, firms offering edu- greatly for firms founded from 2012 on. cational software and educational training services and other human capital development services. B2B services Companies exhibit significant variation in terms of the firms, including business and productivity software pro- complexity of their business models and operations. viders, media and information services, software develop- Many of these firms were created to fill a gap—for exam- ment applications, and automation and workflow software ple in the insurance, leasing, or financing markets—that and network management software companies are also was underserved by traditional, nondigital businesses. common. Several key industries also have a smaller num- The larger, more established firms tend to have a diver- ber of firms such as logistics, real estate, logistics, auto- sified set of digital offerings and products. For exam- motive, and retail. ple, WellaHealth, a company originally selling customer relationship management (CRM) software solutions for The number of digital start-ups more than doubles pharmacies, now offers an app-based malaria insurance the number of mature digital firms (figure 6). Digital product. In general, the Nigerian market displays much start-ups are a subset of firms in their early entrepre- room for growth, as quite a few firms do not yet have a neurial phase (less than three years in operation). These direct competitor in their space. TABLE 3. Employment and Financial Descriptive Statistics for Nigerian Digital Firms TOTAL RAISED FIRST FINANCING VALUATION # ACTIVE EMPLOYEES (US$ MILLIONS) (US$ MILLIONS)  INVESTORS mean 108.77 6.97 15.07 2.97 min 1 0 0.06 1 25% 5 0.03 0.23 1 50% 11 0.15 1.46 2 75% 50 1.62 1.71 3 max 3,000 210.9 164.18 23 N 48 105 22 143 Source: The primary source for these statistics is Pitchbook 10   Digital Entrepreneurship in Nigeria FIGURE 5. Top industries by number of firms Financial Software Social/Platform Software Application Software Other Commercial Services Business/Productivity Software Food Products Multi-line Insurance Buildings and Property Industry Internet Retail Media and Information Services (B2B) National Banks Other Financial Services (blank) Beverages Real Estate Services (B2C) Educational Software Information Services (B2C) IT Consulting and Outsourcing Educational and Training Services (B2C) Entertainment Software Logistics 0 10 20 30 40 50 Number of firms Source: World Bank staff with primarily Pitchbook data (2020) Note: “Financial” software includes investing and decentralized finance platforms, “social/platform” software refers to social networking applications, “application” software refers to programs designed for a specific task such as spreadsheet or word processing software, “business/productivity” software refers to programs that increase productivity at work. FIGURE 6: Mature Firms vs. Start-Ups FIGURE 7. Number of Digital Firms by Foundation Year 50 40 Number of digital firms 27.2% 30 20 72.8% 10 0 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Startup (2017 and later) Foundation year Mature firm (before 2018) Source: World Bank staff with primarily Pitchbook data (2020) Source: World Bank staff with primarily Pitchbook data (2020) Common challenges private firms cited during inter- reliable internet services and infrastructure also seems to views include access to finance, access to skills, and be an important concern for firms. challenging regulatory environment. Virtually all firms reported using personal and informal sources of funding Many companies originating in Nigeria are incorpo- for the company and highlighted access to finance as an rated in Europe and occasionally the United States. important constraint. Innovation hubs confirmed these The main reasons for this are that attracting foreign constraints: access to finance and skills training are the investment is easier if the company is incorporated most sought-after services by entrepreneurs. Access to abroad and to take advantage of favorable tax regimes Digital Entrepreneurship in Nigeria   11 FIGURE 8: Companies by Financing Status FIGURE 9. Percentage of Digital Firms by Financing Status Private Debt Financed 1% 4% Formerly Angel backed 3% 19% Formerly VC-backed 3% Formerly PE-Backed 4% Angel-Backed 5% Formerly Accelerator/Incubator backed 6% 77% Private Equity-Backed 14% Accelerator/Incubator Backed 20% Venture Capital-Backed 21% Generating Revenue Corporate Backed or Acquired 22% Out of business Corporation 35% Profitable Source: World Bank staff with primarily Pitchbook data (2020) Source: World Bank staff with primarily Pitchbook data (2020) in the cases of Delaware, United States, and Ireland. A compared with 45 percent in 2017, but this proportion few companies referred to the Nigerian Investment Pro- remains below that of males, with 85 percent of male motion Commission’s (NIPC’s) pioneer status, which pro- adults being aware of mobile internet in 2019 (GSM Asso- vides relief from payment of corporate income tax for an ciation 2020). initial period of three years for qualifying companies and is extendable for one or two additional years, but with Virtually all firms reported important disruptions varying impressions. due to COVID-19. The COVID-19 crisis affected firms differently depending on their business model. Firms Firms that had been through an international accel- with field agents reported important disruptions in field eration hub or program reported significant positive operations. Many firms reported having transitioned into impact on their growth. Firms reported that the most remote work. Flutterwave, an e-payments service pro- important benefits of participating in these programs vider, reported that the pandemic negatively affected the took the form of network development and funding momentum of the business indirectly through the pan- prospects. Most firms declared that participation in demic’s effect on airlines, online travel agencies, resorts, acceleration programs was critical for the development and other businesses that use the company’s services. of their business. In contrast, e-commerce firms and delivery services like Konga and Max.ng experienced substantial demand Despite efforts of Nigerian tech and innovation hubs growth during this time. Outsourcing companies pro- to target women entrepreneurs, women’s participa- viding remote services did not report major disruptions tion in the digital economy remains a major gap. Most in their services, but companies offering services partly firms interviewed reported unequal gender representa- relying on community outreach and in-person services tion among founders, direct employees, subcontractors, such as medical health check-ups did suffer disruptions and customers. In some instances, gender participation from lockdown measures. among subcontractors was lower than 20 percent of the total.8 The unequal gender participation of women starts INSTITUTIONAL LANDSCAPE with access to mobile technology. According to the GSM Association’s Mobile Gender Gap Report 2020, 39 per- The Federal Ministry of Communications and Digital cent of women in Nigeria own a smartphone, compared Economy (FMoCDE) is responsible for development with 48 percent of men. Mobile internet awareness has of the digital economy in Nigeria. FMoCDE devel- improved substantially over the past two years, with 76 oped the National Digital Economy Policy and Strategy, percent of women being aware of mobile internet in 2019 which describes the pillars that Nigeria should focus 12   Digital Entrepreneurship in Nigeria on to actively participate in the global digital economy The key implementing actor, under the purview of (FMoCDE 2020). The eight pillars are FMoCDE, is the National Information Technology Development Agency (NITDA). NITDA was established 1. Developmental regulation, in 2001 under FMoCDE with a mandate to be “the prime 2. Digital literacy and skills, agency for e-government implementation, Internet gov- 3. Solid infrastructure, ernance and general IT development in Nigeria.” The 4. Service infrastructure, comprehensive Nigeria ICT Innovation and Entrepreneur- ship Vision, developed in April 2019, includes 15 distinct 5. Digital services development and promotion, objectives ranging from tackling digital literacy to building 6. Soft infrastructure, a national data framework and harmonizing the e-govern- 7. Digital society and emerging technologies, and ment systems. 8. Indigenous content development and adoption. In addition to FMoCDE and NITDA, multiple actors are FMoCDE is also responsible for developing the infor- involved in crafting policies targeting development of mation and communications technology (ICT) roadmap the digital economy. Table 4 presents an overview of and consecutive national broadband plans—the most how various public ministries, departments, and agen- current one set for 2020–2025. The various policies and cies support development of the digital space in Nige- programs under the ministry largely focus on providing ria. These interventions range from support to start-ups sufficient infrastructure, developing digital skills, provid- to infrastructure development and market regulation. ing guidelines (ranging from content creation in ICT to use Notable examples outside FMoCDE include the Ministry of mobile money services), and streamlining procedures. of Health’s National Health ICT Strategic Framework, a Targeted support for digital business models and entre- roadmap for strategic application of ICT to help achieve preneurs is present in several initiatives, most noticeably universal health coverage. in terms of start-up and investment support. TABLE 4. Overview of Nigerian Government Entities in the Digital Policy Space MINISTRY OR AGENCY INFRASTRUCTURE INVESTMENT SKILLS/LABOR REGULATION PROCUREMENT Bank of Investment X Bureau for Public Procurement X Central Bank of Nigeria X X X Federal Competition and Consumer X Protection Commission Federal Inland Revenue Services X Federal Ministry of Education X Federal Ministry of Health X X Federal Ministry of Science and X Technology Infrastructure Concession Regulatory X Commission Ministry of Communications and X X Digital Economy National Information Technology X X X X X Development Agency Nigerian Communications Commission X Nigerian Investment Promotion X Commission Office for ICT Innovation and X Entrepreneurship (OIIE) Universal Service Provision Fund X X Digital Entrepreneurship in Nigeria   13 The Nigerian Communications Commission (NCC), Variation in the Rules which was established under the Nigerian Communi- Several different regulatory regimes govern parts of cations Act (NCA), regulates the telecoms industry in e-commerce, including Nigeria. The NCC’s functions include • Companies and Allied Matters Act 2020, • Facilitating investments in and entry into the Nigerian market for provision and supply of communications • National Information and Technology Development services, equipment, and facilities; Agency Act 2007, • Protecting and promoting the interests of consumers • Nigerian Communications Act 2003, against unfair practices, including but not limited to • Finance Act 2020, matters relating to tariffs and charges for and the avail- ability and quality of communications services, equip- • Nigeria Data Protection Regulations 2019, ment, and facilities; • Cybercrimes Act 2015, • Ensuring that licensees implement and at all times • Federal Competition and Consumer Protection Act operate the most efficient and accurate billing system; 2019, • Promoting fair competition in the communications • Companies Income Tax Act, and industry and protecting communications services and facilities providers from misuse of market power or • Value-Added Tax Act. anticompetitive and unfair practices by other service or facilities providers or equipment suppliers; INTERMEDIARY ORGANIZATIONS • Granting and renewing communications licenses According to the most recent information from the regardless of whether the licenses provide for renewal Nigerian Office for ICT Innovation and Entrepreneur- in accordance with the provisions of the NCA and ship (OIIE), as of June 2020, 580 intermediary organiza- monitoring and enforcing compliance with license tions had registered since 2019. Available data from 294 terms and conditions by licensees; organizations show that most of them are in either Lagos • Proposing and effecting amendments to license condi- or Abuja. Lagos has the highest concentration of capac- tions in accordance with the objectives and provisions ity development entities and investors with few others of the NCA; located in other Nigerian cities (figure 10). The data indi- cate that Lagos has about 73 percent of the intermediary • Fixing and collecting fees for grant of communications organizations with Abuja a distant second with 6 percent. licenses and other regulatory services provided by the All other cities have less than 2 percent of organizations NCC; each (figure 10). Available data show that more than 188 • Developing and monitoring performance standards organizations that provide capacity building and co-work- and indices relating to the quality of telephone and ing spaces, more than 42 investor groups, 17 foundations other communications services and facilities supplied and donor organizations, and 15 government organiza- to consumers in Nigeria based on the best interna- tions are active in the digital economy space (figure 11). tional performance indicators; and Top words from topic clusters derived from the descrip- • Making and enforcing such regulations as may be nec- tions of intermediary organizations suggest that they essary under the NCA to give full force and effect to focus on four major areas: youth-oriented innovation, soft- its provisions. ware, sustainable development, and tech hub incubators (table 5) 14   Digital Entrepreneurship in Nigeria FIGURE 10: Percentage of Intermediary FIGURE 11: Intermediary Organizations by Type Organizations by Location Government organizations 9% 1% 1% 1% Research and advisory 1% 2% 2% Business networks 2% Media 6% Investors 73% Foundations and donars Capacity development organizations, co-working spaces and hubs Lagos Abia Kwara 0 20 40 60 80 100 120 140 160 180 200 Abuja Enugu Rest of the Source: World Bank staff with primarily Pitchbook data (2020) Rivers Jos country Kano Port Harcourt Source: World Bank staff with primarily Pitchbook data (2020) TABLE 5. Topic Cluster Analysis of Intermediary Organizations TOPIC CLUSTER TOP WORDS 1 2 3 4 innovation software innovation focus youth talent sustainable knowledge technology product growth idea focus market promote innovation interest solution development storm LABEL youth-oriented software sustainable tech hub innovation solutions development incubators innovations Digital Entrepreneurship in Nigeria   15 Ventures Platform Sector: Tech/accelerator The business model employed and its characteristics: HQ: Lagos • Membership plans for the workspace per day or Country of operation: Nigeria per month. Capacity-building programs are donor funded. Description of company: Ventures Platform is a Pan-African early-stage fund COVID-19 implications: and workspace focused on supporting post minimum • All programs are virtual, the workspace was tem- viable product (MVP) teams to grow their start-ups. porarily closed. The company invests in seed and early-stage compa- Major policy opportunities/challenges: nies that are operating in markets with existing posi- • Conversations with government on reforms for tax, tive offline indicators. It also has a social impact arm procurement, digital literacy, infrastructure. that builds and supports social impact tech entrepre- neurs in Africa. • Rules on procurement effectively exclude start- ups, or at least place them in an uncompetitive Geographic scope: National, with focus on Lagos position. Main services provided: Notable start-ups: • Ventures capital fund, US$20,000 to US$200,000 • Paystack, PiggyVest, Thrive Agric, Kudi.ai. Most dollars depending on size of businesses of the start-ups serve the Nigeria market, but Pay- • Ventures Park (VP), workspace provision includ- stack has added Ghana and is looking at Kenya ing open spaces and private offices, networking and South Africa. opportunities, training and development, and • Most firms are in finance, but VP also has firms in access to virtual reality lab agriculture and environment. • VP foundation, building capacity and focused on Value added the environment • Key services to start-ups: Funding in the form of Background: equity and foundation grants is the most sought-af- Began its entrepreneur support operations in 2016 ter service. Fund provides for three to five busi- nesses a year, the foundation provides for tens to Revenue growth and outlook: hundreds of operations, and the park supports 150 No return on investment yet different businesses. Sectors addressed: No sector orientation, entrepre- • Main outcomes: Job creation, solving social neurship support issues, for example, improving healthcare provi- Employees: 50+ sion. The company is invested in 33–35 compa- nies, with only three failures. Investment history: N/A • Main beneficiaries: Individuals, firms, coopera- Ownership structure: Private tives, and state-owned enterprises (SOEs). Funding: • Programs targeting female entrepreneurs: 30% private sector contributions, 70% donors “Ladies who Launch”: 250 entrepreneurs at a three-day ideation workshop The market gap addressed: Accelerator space in Nigeria Source: World Bank staff elaboration based on field interviews Note: SOE = state-owned enterprise, MVP = minimum viable product , VR = virtual reality 16   Digital Entrepreneurship in Nigeria Wennovation Hub Sector: Tech/accelerator Ownership structure: Private HQ: Lagos Intermediary support: N/A Country of operation: Nigeria Funding: Based largely on project income. Support from inter- Description of company: national donors including the Bill and Melinda Gates Wennovation Hub is a pioneer accelerator hub. It Foundation (for clean energy projects). focuses on social impact sectors including educa- tion, agriculture, healthcare, and infrastructure. The Programs targeting female entrepreneurs: In 2019, company emphasizes job creation in its programs, 30% to 40% of beneficiaries were female, this has and it focuses on start-ups (typically three years old risen to 50% for the current year. Women receive more or younger). tech support. Wennovation provides a range of services includ- The market gap addressed: Accelerator space in ing equity finance, technology extension, infrastruc- Nigeria ture, training, and networking. The business model employed and its Geographic scope: Officers in Abuja, Kaduna, Lagos, characteristics: and Ibadan Offer payment plans for the workspace, but most Main services provided: are sponsored by the company and recommended • Exposure to partners to become part of the portfolio, where Wennovation • Managerial and professional training, specialized takes 2.5% equity for business advisory, which also training, mentorship gives firms 50% discounts on space, plus access to networks and partnerships. Workspace income covers • Access to co-working workspace 40% of its overall costs. • Venture capital arm to fund start-ups COVID-19 implications: N/A Main outcomes: Job creation and skills develop- ment. More than 9,000 people have received skills Major policy opportunities/challenges: training from so far, including 400 start-up teams. In No major policy challenges. As with its finance start- 2019, the company trained 1,200 young people. ups, partnerships with banks have helped with under- standing and navigating policy and regulations. Main beneficiaries: Individuals, firms Notable start-ups: Background: Crop2Cash, Rural Farmers Hub, Jiffix Technology, Began its entrepreneur support operations in 2011 Agrico Revenue growth and outlook: N/A Challenges identified for the sector: Employees: 10 Lack of human capital/technical skills Access to finance Investment history: N/A Source: World Bank staff elaboration based on field interviews Note: VC = venture capital Digital Entrepreneurship in Nigeria   17 NOTES 6. See annex 2 for more details on the methodology employed for data analysis and extraction. 7. Filter keywords used to define digital firms: Software, software, app, App, Platform, platform, services, Services, internet, Internet, online, Online, tech, Tech, technology, Technology 8. Interviews with private sector firms. See annex 3 for more details. 18   Digital Entrepreneurship in Nigeria 4 REGULATORY REVIEW This review describes the state of regulations appli- ness models, such as e-transaction laws, to ensure basic cable to the digital economy in Nigeria. It provides legal legitimacy of online transactions, cross-border data descriptive accounts by global and domestic legal prac- flow provisions, and digital business registration require- titioners with various specializations about the state of ments including sectoral permits and licenses. online commercial transaction laws and regulations (here- after “digital laws”) in Nigeria. SCALE: enabling regulation to build trust and allow digital businesses to scale up. Rules to enable trust in This review responds directly to the objectives of the online transactions so digital business models can scale Developmental Regulation pillar of the National Digital up, such as consumer and supplier protection, cyberse- Economy Policy and Strategy (2020–2030). In particular, curity, personal data protection, cybersecurity and cyber- the implementation strategy of this pillar calls for iden- crime, intellectual property protection, among others. tifying suboptimal regulations that stifle digital economy development and growth; finding gaps in existing legisla- CONTESTABILITY: regulations to level the playing field tion that need to be bridged (or harmonized) to enable a for all and increase competition. Rules to guarantee fair vibrant digital economy; and reviewing, harmonizing, and competition between online and offline players, large enacting new laws appropriate to catalyzing innovation in and small firms, and foreign and local firms, including the digital economy (FMoCDE 2020). data storage, access, processing, re-use, interoperability, cross-border data flows, antitrust regulations, competitive This review utilizes a framework to identify regulatory neutrality, digital taxation harmonization, among others. gaps by level of digital ecosystem maturity. The innova- tive nature of business models requires a careful balance Overall, this report surveys and assesses laws (statutes between potential risks and tradeoffs and efficiency gains and regulations) and provides actionable insights that that come with new technologies. The framework that are critical for ensuring the adoption, scalability, and this review adopts is designed to support policy makers contestability of digital markets. Where deemed help- in identifying digital laws that are critical to develop a dig- ful, provisions of relevant bills before the National Assem- ital ecosystem and potential regulatory gaps or areas for bly have also been considered. improvement. This regulatory review analyzes the state of regulation that is critical to guarantee adoption, scalabil- BACKGROUND: NIGERIAN LEGAL SYSTEM ity, and contestability in digital markets: Under the Constitution of Nigeria, the federal govern- ADOPT: basic regulation to allow digital businesses to ment and the state governments share the authority to operate. Rules to allow for entry and creation of new busi- legislate the digital ecosystem and technology. The legis- Digital Entrepreneurship in Nigeria   19 lative lists in Schedule 2 of the Constitution determine the Relevant ministries, departments, and agencies, exercis- scope and extent of the legislative powers of the National ing delegated power from the legislature: Assembly and the State Houses of Assembly. The Consti- • Bank of Investment; tution provides an Exclusive Legislative List that comprises 68 items for which only the National Assembly may legis- • Bureau for Public Procurement; late9 and a Concurrent Legislative List, which the National • Central Bank of Nigeria; Assembly and State Houses of Assembly may legislate • Federal Competition and Consumer Protection upon, subject to limitations expressly provided therein.10 Commission; • Federal Inland Revenue Services; However, the authority to legislate on different technolo- gies is not clearly defined and depends on the substan- • Federal Ministry of Education; tive matter. Stakeholders have encouraged the National • Federal Ministry of Health; Assembly to take charge of digital laws, relying on the • Federal Ministry of Science and Technology; National Assembly’s exclusive power to legislate on trade • Infrastructure Concession Regulatory Commission; and commerce. • Ministry of Communications and Digital Economy; Legislative and Regulatory Bodies • Ministry of Industry Trade and Investments; The National Assembly (Library of Congress 2020). The • Ministry of Industry Trade and Investments–Trade- federal legislative body consists of two houses, the House marks, Patents, and Designs Registry; of Representatives and the Senate, whose members are • National Agency for Food and Drug Administration elected directly every four years. The National Assembly and Control (NAFDAC); is modeled on that of the United States and enjoys exten- sive oversight powers, including control over spending of • Nigerian Civil Aviation Authority (NCAA); federal funds, the authority to consent to appointments • Nigerian Communications Commission (NCC); for executive positions, and the powers to approve all • Nigerian Electricity Regulatory Commission (NERC); treaties negotiated by the executive, among others. • National Information Technology Development Agency (NITDA); Once a bill (executive, private, or member bill) is intro- duced in the National Assembly, it undergoes three • Nigerian Investment Promotion Commission (NIPC); readings, scrutiny by the relevant committee where • Office for ICT Innovation and Entrepreneurship (OIIE); amendments may be made, and presidential assent. • Securities & Exchange Commission (SEC); • Standards Organisation of Nigeria (SON); and Relevant Senate committees include communications, capital market, banking, insurance and other financial • Universal Service Provision Fund. institutions, information and communications technology (ICT) and cybercrime, industries, information and national INCORPORATION OR REGISTRATION OF orientation, public procurement, and science and tech- COMPANIES nology. Relevant House committees include banking and currency, capital market and institutions, commerce, President Muhammadu Buhari assented to the Com- communications, cooperation and integration in Africa, panies and Allied Matters Act (CAMA) 2020, which healthcare services, industry, public procurement, rules replaced the Companies and Allied Matters Act 1990. and business, and science and technology, among others. CAMA 2020 covers the incorporation, registration, orga- nization, and management of companies in Nigeria. It The State Houses of Assembly. At the state level, leg- also establishes the rules of corporate governance and islative power is vested in unicameral house assemblies relationships with shareholders, members, and directors. whose size varies from 24 to 40 members with state pop- CAMA is relevant for any business offering products or ulation size. As per the Constitution, if any law enacted services online. CAMA 2020 provides a robust framework by a state house of assembly is inconsistent with any law for reforming the previously onerous legal, regulatory, validly made by the National Assembly, the law made by and administrative bottlenecks that for three decades dis- the National Assembly shall prevail. suaded people from doing business in Nigeria (particu- larly for micro, small, and medium enterprises (MSMEs)) and impeded the flow of foreign investment. 20   Digital Entrepreneurship in Nigeria CAMA 2020 enables different business structures, of ICT as a means of entering into contracts. Examples which promotes innovative liability allocation and of issues that have arisen include the validity of contracts growth in digital entrepreneurship. Section 18(2) per- closed through electronic means, the terms and condi- mits the formation of a private company by a single share- tions of such contracts, the policy documents that the holder, while Section 271 permits private companies to seller or service provider is to incorporate into the con- have only one director. CAMA11 also enables business tract, the applicability of exclusion clauses in online con- owners to form limited liability partnerships (LLPs), a tracts and in the warranties and conditions implied in such form of partnership business that enjoys the limited lia- contracts. Enacting legislation to address these issues bility characteristics of a company. The LLP form enables will be necessary to further strengthen the existing legal business owners to enjoy tax status as an individual under framework. personal income (on average 19 percent) rather than the Companies Income Tax (CIT) of 30 percent. The liability of The jurisprudence on electronic contracts is still in its the owners will still be limited to their stakeholding in the infancy under Nigerian law. Consequently, although partnership business except when fraud occurs. these contracts are recognized and may be enforced in Nigeria, no specific provisions of the law are applicable. CAMA 2020 grants various exemptions from compli- Therefore, provided adequate notice of the conditions ance with certain requirements, which result in con- required to conclude a contract is reasonably clear, the siderable cost savings for MSMEs. For instance, small purpose of the contract is not illegal or contrary to public companies12 and single shareholder companies are policy, and there are no vitiating elements such as duress, exempted from appointing auditors for their financial undue influence, mistake, or misrepresentation, any per- statements at their annual general meetings (AGMs), son who fulfills such conditions with the intention of creat- excepting those in the banking, insurance, or other sector ing a contractual relationship shall be bound by the terms prescribed by the Corporate Affairs Commission (CAC); of the contract. small companies and single shareholder companies are also exempted from holding AGMs. Further, private com- No special remedies for breach of electronic contract panies are no longer required to appoint company secre- are available for an aggrieved party. Thus, such an taries and may now hold virtual meetings in accordance aggrieved party may be entitled to damages for breach with the provisions of their articles of association. of contract. Remedies for the buyer include damages for nondelivery,15 specific performance,16 and breach of war- Overall, CAMA 2020 is expected to benefit start-ups and ranty.17 The remedy for an aggrieved seller includes action early-stage companies, whether in digital business or for price where the goods have passed to the buyer and other areas, and to support businesses in identifying opti- the buyer fails to pay for the goods according to the terms mal business and liability structures. of the contract,18 and damages for nonacceptance where the buyer wrongfully neglects or refuses to accept and pay for the goods.19 Given the common and unique method ADOPT: BASIC REGULATIONS TO ALLOW of transacting online, the current Nigerian approach may DIGITAL BUSINESSES TO OPERATE be problematic for consumers who mistakenly agree Rules to allow for entry and creation of new business to electronic transactions. To this end, other jurisdic- models, such as e-transaction laws to ensure basic legal tions provide a special remedy in limited situations. For legitimacy of online transactions; cross-border data flow instance, the Uniform Electronic Transaction Act (adopted provisions; and digital business registration requirements, by 48 states in the United States) provides a remedy for including sectoral permits and licenses. those situations that deal with the “electronic agent” of the other party.20 Electronic Contracts Currently, no law is dedicated to electronic transac- The Bill, currently under consideration by the National tions in Nigeria, but the Electronic Transactions Bill Assembly, seeks to make provisions for e-commerce 2019 (the Bill), is currently under consideration by the transactions. The Bill comprises 45 sections addressing National Assembly. Without a law dedicated to elec- issues covered by most international model regulations, tronic contracts, the traditional principles of common law but it is not specifically modeled after them. relating to contracts apply to electronic contracts.13 Part V of the Bill deals with electronic contracts and While continued relevance of the common law princi- provides, among other things, that in the context of ples of contracts14 cannot be denied, challenges and contract formation, offer and acceptance may be uncertainties have developed from the introduction expressed by means of documents as defined under Digital Entrepreneurship in Nigeria   21 the Bill, unless parties agree otherwise. Payment made However, no regulatory authority is empowered to by electronic means specified by the Central Bank of Nige- administer electronic signatures, because the primary ria is recognized as a valid means of performance of con- objective of those laws was not to regulate. As such, tractual payment obligations (Section 26(5)). The Bill also unnecessary transaction costs are incurred in the event stipulates that contracts may be formed by the interaction of recourse to the courts to establish contractual rights of electronic agents and natural persons, or of interaction and obligations that are founded on electronic contract or agents, provided that the interaction results in the agents contracts executed electronically. engaging in operations that confirm or indicate the exis- tence of a contract. This provision is important, as smart Even so, the aforementioned provisions of the Cyber- contracts fall within the definition of electronic agents. crimes Act and the Evidence Act represent significant improvements that have greatly enhanced the ease of Pending passage of the Bill, the traditional rule of doing business. The Evidence Act, while not explicitly the common law of contract continues to apply to saying so, attempts to establish legal equivalence of elec- e-commerce in Nigeria, meaning no distinction exists tronic documents by defining documents in a very wide between online and offline contracts. The same provi- manner. The Evidence Act defines the term document sions apply to both. Thus, the common law elements of to include “(a) books, maps, plans, graphs, drawings, offer, acceptance, consideration, capacity, and intention photographs, and also includes any matter expressed or to enter into legal relations apply to electronic contracts, described upon any substance by means of letters, figures whether online or offline, and where any of these ele- or marks or by more than one of these means, intended ments is absent or any of the vitiating factors is present, to be used or which may be used for the purpose of an electronic contract may be voided. recording that matter; (b) any disc, tape, sound track or other device in which sounds or other data (not being Electronic Documentation and Electronic visual images) are embodied so as to be capable (with or Signatures without the aid of some other equipment) of being repro- Two laws govern the authentication of electronic signa- duced from it, and (c) any film, negative, tape or other tures. The Cybercrimes Act confers validity on electronic device in which one or more visual Images are embod- signatures in commercial transactions, and the Evidence ied so as to be capable (with or without the aid of some Act regulates admissibility of statements in documents other equipment) of being reproduced from it; and (d) any produced by computers (Section 84) and proof of signa- device by means of which information is recorded, stored ture and handwriting and electronic signature (Section or retrievable including computer output.” However, this 93). Electronic signature has no statutory definition,21 but list-based approach may be restrictive compared with the Cybercrimes Act stipulates that electronic signatures a more principle-based approach, such as that found in in respect of purchases of goods and any other trans- the United Nations Commission on International Trade actions shall be binding.22 The Cybercrimes Act further Law (UNCITRAL) Model Law on Electronic Transferable imposes on the person seeking to impugn the authentic- Records, which provides greater functional equivalence ity of an electronic signature the burden of proof that the and technology neutrality. signature does not belong to the purported originator of such electronic signature. Further, the Evidence Act pro- The Evidence Act further provides that all electronic vides that where a rule of evidence requires a signature signatures may be proved in any manner. This includes or provides for certain consequences if a document is not providing a procedure that requires a person to exe- signed, an electronic signature satisfies that rule of law or cute a symbol or security procedure to verify that an avoids those consequences.23 electronic record is his or hers to proceed further with a transaction.25 However, because the provisions are The combined effect of these provisions validates separated in the two laws and their language differ, the transactions completed with electronic signatures, scope and rules of electronic signatures remain unclear. even if they do not satisfy the requirements for a typ- For example, whether the legal meaning of electronic ical transaction in the traditional contractual sense. signature is identical in the Cybercrimes Act and the Evi- However, certain transactions are expressly excluded from dence Act is unclear. The recently enacted CAMA 2020 these provisions and cannot be concluded by electronic also provides that a document or proceeding requiring means. Some documents cannot be legally accepted in authentication by a company may be signed by a director, electronic format and cannot be signed electronically, secretary, or other authorized officer of the company, and such as wills, property deeds, birth certificates, and so that an electronic signature satisfies the requirement for on, but these exceptions are not expected to significantly signing under the law.26 However, the law fails to define affect e-commerce markets. 24 what it means by electronic signature. 22   Digital Entrepreneurship in Nigeria Digital signatures on certificates are also recognized for Currently, Nigeria’s electronic signature regime, purposes of facilitating e-commerce under the NITDA despite much progress, remains limited and lacks cer- Public Key Infrastructure (PKI) Regulations, 2018 (Code tainty. Much of the current uncertainty has to do with of Practice for Accredited Certificate Authorities (CAs)). the fragmentation of provisions pertaining to electronic A certificate is defined therein as a document issued by a signatures across three laws—the Cybercrimes Act, the CA to support a digital signature that purports to confirm Evidence Act, and CAMA—with seemingly different ter- the identity or other significant characteristics of the per- minology. To eliminate this uncertainty, consolidation of son who holds a particular key pair. The PKI regulations these provisions is recommended. The passing of the Bill also provide the administrative framework for licensing may facilitate the desired effect. CAs pending the establishment of the Nigeria Electronic Transaction Act (NETA) and its regulations. The NETA reg- Cross-Border Data Flows ulations establish a voluntary licensing scheme for CAs in Cross-border data flows are integral to global economic Nigeria. The NETA regulations stipulate the criteria for a integration. Overly burdensome limits on cross-border CA in Nigeria to be licensed and continuing operational data flows impede economic growth, e-commerce oppor- requirements after obtaining a license. The NETA regu- tunities, and financial transactions. For example, a require- lations contain general information and are intended to ment that data centers be located domestically creates guide interested organizations (public and private) in additional costs for cloud-based services. applying to become accredited CAs. Furthermore, the PKI regulations state that a certification authority can issue The Nigeria Data Protection Regulation (NDPR) requir- certifications of two varying levels of assurance: 1) a “trust- es that the transfer of personal data that are under- worthy certificate” and 2) a certificate that shall not be going processing or are intended for processing after considered a trustworthy certificate. transfer to a foreign country or to an international organization shall be subject to the provisions of NDPR The Bill aims to resolve many of the aforementioned prob- and under the supervision of the Honourable Attorney lems, with provisions for 1) legal equivalence between General of the Federation (HAGF). The General Data paper-based and electronic communications, contracts, Protection Regulation (GDPR) of the European Union signatures, and records; 2) authentication of electronic (EU) influenced the development of the NDPR, partic- documents by prescribing the rules for acceptance of ularly the provisions on cross-border data transfer. The electronic signatures; 3) the equivalency of the legal adequacy and accountability approach were adopted in effect of an electronic signatures created or used outside the NDPR to determine circumstances where cross-bor- Nigeria to that of one created in Nigeria, provided it sat- der data transfer may be allowed. Regulation 2.11 of isfies Nigerian certification standards; and 4) the validity, the NDPR provides that cross-border data transfer may enforceability, and admissibility of electronic documents take place where NITDA has decided that the foreign and transactions. country or territory, one or more specified sectors within that foreign country, or the international organization Even with the optimism generated by the Bill, the cur- in question ensures an adequate level of protection. In rent legal system continues to be in effect and enforced this regard, NITDA has made adequacy decisions for 37 and the enabling impact on electronic transactions is countries (known as the Whitelist).27 In addition, NITDA limited. The provisions of the Evidence Act regarding has affirmed its readiness to issue adequacy decisions electronic signatures in commercial transactions, admissi- with respect to transfer to foreign countries if a data con- bility of statements in documents produced by comput- troller satisfactorily provides the information required to ers, and proof of signature and handwriting and electronic make such decisions.28 In addition, the HAGF is required signature have significantly affected the ease of doing to consider the following: business. The provisions of the Cybercrimes Act have also made a significant impact. However, the impact of 1. The legal system of the destination foreign country, the latter is limited because the focus of the Cybercrimes particularly in the areas of rule of law; respect for Act is establishing a legal framework to prohibit, prevent, human rights and fundamental freedom; and relevant detect, prosecute, and punish cybercrimes in Nigeria. legislation, both general and sectoral, including public Going forward, implementing regulatory provisions mir- security, defense, national security and criminal law, roring robust frameworks such as the European Self-Sov- and the access of public authorities to personal data; ereign Identity Framework for electronic signatures could 2. Implementation of such legislation, data protection further strengthen the Nigerian regulatory framework rules, professional rules, and security measures, includ- (Adetunji et al. 2020). ing rules for the onward transfer of personal data to another foreign country or international organization, Digital Entrepreneurship in Nigeria   23 which that country or international organization com- Where any of the foregoing is the case, the data subject plies with; case law; and effective and enforceable must manifestly be made to understand through clear data subject rights and effective administrative and warnings the specific principle(s) of data protection that judicial redress for the data subjects whose personal are likely to be violated in the event of transfer to a third data are being transferred; country. This, however, will not be necessary where the data subject is answerable in duly established legal action 3. The existence and effective functioning of one or for any civil or criminal claim in a third country. Despite more independent supervisory authorities in the des- being consistent with GDPR, NDPR lacks the condition for tination foreign country or to which an international when the subject is involved in a judicial proceeding in a organization is subject, with responsibility for ensuring third country. and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting While NDPR is largely modeled on GDPR, important and advising data subjects on exercising their rights differences exist. Unlike GDPR, NDPR does not specify and for cooperation with the relevant authorities in whether a cross-border transfer based on international Nigeria; and agreements for judicial cooperation is allowed, and it 4. The international commitments that the destina- does not provide for cross-border data transfers made tion foreign country or international organization has from a register intended to provide information to the entered into, or other obligations arising from legally public (Gibbs-Harris et al. 2020). Additionally, under binding conventions or instruments and from its partic- GDPR, “in the absence of a decision on an adequate ipation in multilateral or regional systems, particularly level of protection, a transfer is permitted when the in relation to the protection of personal data. data controller or data processor provides appropriate safeguards with effective legal remedies that ensure NDPR also provides that absent any decision by NITDA data subjects’ rights as prescribed under the GDPR” or HAGF as to the adequacy of safeguards in a desti- (Gibbs-Harris et al. 2020). In contrast, NDPR does not nation foreign country, cross-border data transfer may provide safeguards such as binding corporate rules take place only under one of the following conditions: (BCRs) that are considered appropriate safeguards under GDPR (Gibbs-Harris et al. 2020). 1. The data subject has explicitly consented to the pro- posed transfer, after having been informed of the pos- Personal Data Protection sible risks of such transfers; Personal data protection is critical to building trust in 2. The transfer is necessary to execute a contract e-commerce. Empirical work on 43 successful platforms between the data subject and the data controller or to and 209 platform failures identifies lack of trust as a basis implement precontractual measures taken at the data for why platforms fail (Gawer, Yoffie, and Cusumano 2019). subject’s request; Platforms have incentives to collect as much data as pos- 3. The transfer is necessary to conclude or execute a sible to better customize and target their services, raising contract concluded in the interest of the data subject potential legal and ethical and security risks in the pro- between the data controller and another natural or cess.29 One aspect of trust ensures that data holders can legal person; protect that data. An instance of a data breach occurred in December 2019 in Nigeria, when the personal data of 4. The transfer is necessary for important reasons of pub- numerous taxpayers in Lagos State were leaked on the lic interest; payment portal of the Lagos Internal Revenue Service 5. The transfer is necessary to establish, exercise, or (LIRS).30 Despite being confirmed by NITDA, LIRS has yet defend legal claims; or to be sanctioned. 6. The transfer is necessary to protect the vital interests While NITDA31 has issued subsidiary legislation on data of the data subject or of other persons, where the data protection, NDPR, the legality of NITDA’s competence subject is physically or legally incapable of giving con- (and hence NDPR) is uncertain. NITDA relies on Section sent. 6 of the NITDA Act to promulgate NDPR.32 However, the text of the law may not support NITDA’s competence to regulate data protection. Given this, if ever challenged in court, NDPR risks being determined unlawful. Simultane- ously, the Government of Nigeria is drafting a separate 24   Digital Entrepreneurship in Nigeria Data Protection Bill 2020 (DPB) through the support of • NDPR does not require the data processor or con- the Nigeria Identification for Development (ID4D) Project, troller to keep a record of processing activities, further calling the legality of NDPR into question. In any whereas GDPR has prescribed a list of information that case, the following analysis examines the critical aspects data processors and controllers must record for inter- of NDPR and DPB. national transfers of personal data (Gibbs-Harris et al. 2020). NDPR, a subsidiary legislation issued by NITDA, gov- • NDPR, while referencing sensitive personal data,34 erns data protection. Furthermore, data protection is does not articulate higher safeguards for process- also provided in sectoral instruments.33 GDPR influenced ing sensitive personal data. No provisions are explic- the development of NDPR, and most of the provisions of itly dedicated to processing sensitive personal data in NDPR mirror the GDPR framework. Provisions regulating NDPR. Further, NDPR does not explicitly require that a issues such as principles of data processing and rights guardian consent to the processing of his or her child’s of data subject cross-border data transfer substantially data (or require reasonable efforts to verify such con- resemble those of GDPR. sent) and does not set an age limit to consent. However, despite the similarities, the differences have • NDPR does not include “legitimate interests of data caused NDPR to not be designated as “adequate” controller” as legal grounds for processing. While under GDPR for cross-border data transfer. the exclusion of this legal ground improves protection, it may deter data innovation by data controllers. To • One of the main gaps is the lack of definition of this extent, many data protection frameworks, includ- key terms in NDPR. NDPR does not define key terms ing GDPR, provide this legal ground. critical to ensuring clarity and consistency, including pseudonymization and anonymization. Among other principles, NDPR provides that personal • NDPR applies to processing of personal data of res- data must be secured against all foreseeable hazards idents in Nigeria and to persons residing outside and breaches such as theft; cyberattack; viral attack; Nigeria who are citizens of Nigeria. This is a signifi- dissemination; manipulations of any kind; and damage cant departure from GDPR, which only applies to nat- by rain, fire, or exposure to other natural elements.35 ural persons residing in the EU. Whether NITDA has In this regard, NDPR requires anyone involved in data the necessary resources to successfully regulate this processing or the control of data to develop security provision is unclear, thus threatening the credibility of measures to protect data. Such measures include but are the agency and NDPR. not limited to protecting systems from hackers, setting up firewalls, storing data securely with access to specific • NDPR lacks extraterritorial scope in respect to authorized individuals, employing data encryption tech- controllers and processors. GDPR applies to entities nologies, developing organizational policies for handling with an “establishment” in the EU. This is an import- personal data (and other sensitive or confidential data), ant provision, as it extends its scope to organizations protecting email systems, and continually building staff in the EU, regardless of where the processing takes capacity.36 It imposes a duty of care toward a data subject place. However, NDPR lacks such a provision. In addi- on anyone who is entrusted with the personal data of the tion, GDPR also applies to entities that market their data subject or who possesses the personal data of the products in the EU, regardless of presence. NDPR data subject. In addition, controllers and processors are lacks such a provision. The extraterritorial provision required to process personal data to guarantee its con- of NDPR only applies to the data of Nigerians outside fidentiality, integrity, and accessibility. Further, anyone the territory. who is entrusted with the personal data of a data sub- • Unlike GDPR, NDPR does not provide for safe- ject or who possesses the personal data of a data subject guards from data processors, such as BCRs, which shall be accountable for his or her acts and omissions in are considered appropriate safeguards under GDPR respect of data processing and in accordance with the and could allow data transfer absent a decision on principles contained in the regulation. There is a require- adequate level of protection (Gibbs-Harris et al. 2020). ment to conduct annual audits and submit audit reports to NITDA. This audit requires an assessment of the secu- • NDPR does not specify whether a cross-border rity of the systems that process personal data.37 transfer based on international agreements for judi- cial cooperation is allowed, and it does not provide NDPR requires any medium through which personal for cross-border data transfers being made from data are collected or processed to display a simple and a register intended to provide information to the conspicuous privacy policy tailored for the data sub- public (Gibbs-Harris et al. 2020). ject’s understanding that speaks to consent require- Digital Entrepreneurship in Nigeria   25 ment, type of data collected and purpose of collection, are processed in a fair and lawful manner in line with the data subject rights regarding data collected, among bill and other existing legislation. other things.38 Every data controller is required to des- ignate a data protection officer to ensure adherence to Part IV of the Electronic Transaction Bill addresses NDPR, relevant data privacy instruments, and data pro- data protection. It covers issues such as conditions for tection directives of the data controller. This responsibility processing of personal data and sensitive personal data, may, however, be outsourced to a verifiably competent rights of data subjects, right to prevent data processing, firm or person.39 A data controller or processor shall processing on behalf of data holder, and security of per- ensure continual capacity building for data protection sonal data. It also empowers NITDA, upon consultation officers and other personnel involved in any form of data with any appropriate regulatory body, to develop rules processing.40 The NDPR Implementation Framework and guidelines for data protection in Nigeria. requires assessing the risks to the rights and freedoms of data subjects and proposing risk mitigation measures to Some protections offered in the Bill resemble those address the risk. available under NDPR. These include right of access, right to be informed about automated decision making, A potential pitfall of the current data governance right to rectification, right to erasure, right to seek judicial regime is that the key regulation, NDPR, is a subsidiary remedy, among others. The Bill also introduces the right legislation. Therefore, in the event of conflict between its to suspend data processing. It also gives the data subject provisions and those of a primary legislation, the provi- the right to be notified within 48 hours of the data control- sions of the primary legislation will always prevail.41 Under ler reporting a data breach that affects the data subject. these circumstances, this provision may fail to achieve its The Bill penalizes data breaches by individuals, bodies, objectives where conflicting primary legislation exists. data controllers, processors, and Commission staff and Another gap is the absence of a properly constituted reg- prescribes fines of up to ₦10 million and imprisonment ulatory agency empowered to administer and enforce its up to five years for persons or bodies convicted under the provisions. NITDA is the technical agency responsible for Bill. The Bill also provides for the forfeiture of assets by creating a framework for the planning, research, develop- convicted persons under the Bill and allows for the com- ment, standardization, application, coordination, monitor- pensation of victims of data breaches. ing, evaluation, and regulation of information technology practices, activities, and systems in Nigeria and all related The Bill also introduces changes and expands on exist- matters. However, the enabling law, the Nigeria Infor- ing data protection rules. For instance, with regard to mation Technology Development Agency Act, does not the scope, the Bill applies to the processing and use of empower NITDA to perform any of the roles of a data pro- personal data of both Nigerian citizens and persons resid- tection authority or data protection commissioner. NIT- ing in Nigeria, by automated or nonautomated means. It DA’s assumption of the role of a data protection agency applies to the processing of electronic data and nonelec- is subject to challenge on the ground that it is ultra vires tronic data and to persons who reside in Nigeria and Nige- the express provisions of its enabling law. Also doubtful is rian nationals irrespective of residence; public and private whether NITDA has the powers to enforce any sanction companies in Nigeria; unincorporated joint ventures or stipulated in NDPR. associations operating in Nigeria; any institution or body that maintains an office, branch, or agency through which Through the Legal and Regulatory Reform Working business activities are carried out in Nigeria; and foreign Group (LWG) the federal government recently pub- entities who reside in Nigeria. Processing of personal data lished the draft Data Protection Bill 2020. DPB primarily carried out by a data subject while performing a purely seeks to establish an effective regulatory framework to personal or household activity42 is, however, exempted. protect personal data, regulate the processing of informa- tion concerning data subjects, and safeguard their funda- The Bill seeks to establish a Data Protection Com- mental rights and freedoms, which are guaranteed under mission (the Commission) to enforce its provisions the 1999 Nigerian Constitution. DPB aims to promote the by regulating the processing of personal informa- code of practice that guarantees privacy and data pro- tion, overseeing data processors and controllers, and tection without inordinately undermining the interest of so forth. The Bill seek to empower the Commission to commercial organizations and government agencies in implement and monitor compliance with the provisions of respect of such data. In addition, it seeks to minimize the the Bill, make administrative arrangements appropriate to effects of misuse and abuse of personal data, establish an discharging its duties, investigate complaints about infrac- impartial regulatory authority, and ensure personal data tions of the provisions of the Bill, make regulations, apply 26   Digital Entrepreneurship in Nigeria to court for warrant, impose fines and penalties, and gen- iv. Use of a Nigerian domain name (i.e., .ng) or regis- erally perform its duties with the aid of other enforcement tration of a website address in Nigeria; or agencies. In addition, the Commission may regulate the v. Purposeful and sustained interactions with per- licensing and certification of data protection compliance sons in Nigeria by customizing a digital page or officers and organizations. platform to target persons in Nigeria, including reflecting the prices of its products or services in Taxation Nigerian currency or providing options for billing The Nigerian government has recently taken steps to or payment in Nigerian currency (the SEP Order consider the issue of taxation of the digital economy. does not define “purposeful and sustained inter- Under Nigerian law, all companies are subject to the Nige- action”). rian Companies Income Tax, which applies to any income that accrues in, is derived from, is brought into, or is 2. Provision of technical, professional, management, or received in Nigeria (Section 9 of CIT) (Komolafe and Chuk- consultancy services to Nigerian customers. wuani 2020). This regime did not contemplate the taxation of income derived by nonresident companies (NRCs) from The guidelines follow the United Nations model on rules digital services or products offered to persons resident in guiding income taxation of services through permanent Nigeria (Komolafe and Chukwuani 2020). In January 2020, establishment, with the notable exception that Nige- the Federal Government of Nigeria published the Com- ria’s position is that such income is taxable regardless of panies Income Tax Significant Economic Presence (SEP) whether the service rendered is continuous (Blackwood & Order, 2020, which complements the 2019 Finance Act, Stone LP 2020). providing a new regime for NRCs that provide digital ser- vices and instituting a value-added tax (VAT) on intangible Implementation concerns include the lack of clear supplies. The SEP Order follows the guidelines set out in provisions in the SEP Order as to how the rule will be the Organisation for Economic Co-operation and Devel- administered and enforced in relation to digital ser- opment’s (OECD’s) Final Report on Addressing the Tax vice providers (Blackwood & Stone LP 2020). There are Challenges of the Digital Economy of 2015. currently no anti-double taxation treaties with respect to digital taxation in Nigeria (Blackwood & Stone LP 2020). The SEP Order establishes the conditions under which Furthermore, ascertaining profits derived from activities NRCs that provide digital services or technical, profes- in Nigeria will be difficult, as foreign companies estimate sional, management, or consultancy services to Nige- gross income without specifying the generating jurisdic- rian customers, from outside Nigeria, will be deemed tion, and this difficulty will extend to the application of to have a taxable nexus and therefore be liable to tax transfer pricing principles (Blackwood & Stone LP 2020). in Nigeria (PwC 2020). According to the SEP Order, com- The SEP Order gives no guidance on whether the CIT panies carrying out digital activities in Nigeria generating returns filed by qualifying companies will be based on a minimum derived turnover of N25 million (approxi- actual or deemed income, which has been a matter of mately US$64,320) are liable for taxation (Blackwood & legal dispute in recent cases against the Federal Inland Stone LP 2020). Revenue Service (not involving digital service providers) (Obayomi and Adegite 2020). The SEP Order also seems The SEP Order classified such activities as follows (Black- to be at odds with the definition of connected person in wood &Stone LP 2020): paragraph 6a of the Seventh Schedule of the Companies Income Tax Act (CITA), which is more expansive (the SEP 1. Digital service providers: nonresident companies that Order limited its definition of connected persons to asso- derive N25 million (US$64,320) annual gross turnover ciates as defined by the Companies and Allied Matters or its equivalent in other currencies from any or combi- Act, or business associates, that is, persons controlled by nation of the following digital activities: or under common control) (Obayomi and Adegite 2020). i. Transmission of data collected about Nigerian users generated from users’ activities on websites Finally, the SEP Order does not cover the issue of own- or mobile applications; ership or control of the electronic or wireless appara- tus such as receivers, satellite, and connected servers ii. Provision of goods or services through a digital that are involved in providing digital services (Black- platform to Nigeria; wood & Stone LP 2020). This is a significant omission, iii. Provision of intermediation services through dig- inasmuch as related cases have been already brought to ital platforms, websites, or other online applica- court. Recently, the Vodacom Business Nigeria Limited v. tions that link suppliers and customers in Nigeria; Federal Inland Revenue Service (CA/l/556/2018) litigated Digital Entrepreneurship in Nigeria   27 the subject of whether the bandwidth services provided In line with the common law principles of contracts, via a satellite (in space) that was controlled by a nonresi- parties are free to agree to alternative dispute resolu- dent company were liable to value-added tax in Nigeria tion options. Consequently, parties to commercial con- (Obayomi and Adegite 2020). tracts (online transactions inclusive) often agree to adopt ADR mechanisms (such as mediation, conciliation, and In terms of the scope of application of VAT, the Finance arbitration) in the event of a dispute. This has become Act expands its scope to capture supplies of goods quite prevalent due to concerns about the protracted and services in the digital economy.43 Furthermore, nature of court actions and the attendant high cost.46 the Finance Act provides that supply of goods anywhere would be subject to VAT in Nigeria, provided that the The existing framework for dispute resolution in beneficial owner of the rights in or over the goods is a Nigeria already incorporates ADR as a means of taxable person in Nigeria and the goods or right thereof is resolving ICT-related disputes. These include LMDC situated, registered, or exercisable in Nigeria44 (Komolafe and other independent arbitration and mediation bod- and Chukwuani 2020). ies. These ADR organizations have frameworks in place to resolve all kinds of specialized disputes (including ICT-related disputes). The only significant requirement SCALE: ENABLING REGULATION TO BUILD is for parties intending to enter online transactions to TRUST AND ALLOW DIGITAL BUSINESSES TO incorporate the relevant dispute resolution clause that SCALE UP will allow the use of ADR and to submit to specialized Regulation helps to create the necessary trust in electronic ADR institutions like LMDC. platforms. Trust is a precondition for a vibrant digital economy. The WEF’s Global Governance of Online Con- NITDA recently issued a draft framework on the use sumer Protection and E-Commerce white paper identifies of ADR for the ICT sector (ADR Framework). The ADR five factors to increase trust in e-commerce: 1) create rel- Framework sets out a blueprint for the implementation of evant online consumer protection rules, 2) focus on per- an alternative dispute resolution system for the ICT sector sonal data protection, 3) address variation in the rules, 4) to enable speedy resolutions. However, the ADR Frame- increase international cooperation on e-commerce, and work can be invoked only where parties have expressly 5) engage in international e-commerce talks (WEF 2019). agreed to submit themselves to the ADR Framework. Online Dispute Resolution Mechanism The ADR Framework provides some of the reassurance Nigeria lacks specific legislation for online dispute and certainty necessary for commercial undertakings to resolution (ODR). The existing legal framework for the rely on the enforceability of electronic contracts. Such reli- application of alternative dispute resolution in ODR can ance is important because it enables such undertakings to be found in various legislation, including adopt electronic contracting as a way of doing business and promotes the growth of electronic commerce. • The Arbitration and Conciliation Act (ACA), • The Lagos Multi-Door Courthouse (LMDC) Law 2007, Jurisdiction • The Citizens Mediation Centre Law 2003, and Generally, Nigerian courts will give effect to the par- • The Arbitration Law of Lagos State 2009. ties’ choice of governing law and will apply such law in determining any claims that come within their juris- In addition, court rules provide for the use of ADR.45 diction. However, in electronic and internet transactions, These laws regulate the adoption of ADR in commercial the applicable law and jurisdiction are often determined disputes generally. The key legislation is the ACA, which by the terms and conditions available on the internet plat- is modeled on the 1985 UNCITRAL rules on interna- form. The customer(s) is(are) deemed to have voluntarily tional commercial arbitration with minor modifications. acceded to the choice of law/jurisdiction expressed in said ADR is incorporated in the court rules. In particular, the terms and conditions with their initial positive indication of High Court of Lagos State (Civil Procedure) Rules, 2019, assent and continued access to said internet platform. encourage parties to explore ADR before filing a court action. However, the Supreme Court of Nigeria has ruled that the parties’ choice of law is not conclusive and that to be effective the choice of law must be “real, genuine, bona fide, and reasonable.”47 The Supreme Court also held that the foreign law chosen by parties as the proper 28   Digital Entrepreneurship in Nigeria law of their contract “must have some relationship to and An example of online consumer protection in other juris- must also be connected with the realities of the contract dictions is the European Union Consumer Rights Direc- considered as a whole.” There must be a close connec- tive, which ensures that while making an online purchase, tion between the agreed choice of law and the nature of every consumer has the right to receive clear, correct, the transaction for the choice to be upheld by the courts and comprehensible information about delivery arrange- (other than in the case of mandatory laws where Nige- ments, withdrawal rights, and the legal guarantee in case rian law would apply regardless of the chosen law). In the the product is faulty.48 Transparency of information pro- event the chosen law lacks such a relationship with the vided to consumers is not only a matter of protecting the contract, Nigerian courts would nevertheless uphold the rights of individuals, but it also affects competition in the parties’ choice if the transaction has no connection with market by ensuring that all firms are subject to the same Nigerian law. However, if 1) the agreed choice of law has level of consumer protection provisions. no relationship whatsoever with the contracting parties or the nature of the contract and 2) the contract has a close Currently Nigeria has no e-commerce-specific con- connection with Nigerian law, the parties’ choice of a for- sumer protection laws or rules. The recently enacted eign law may be deemed by the Nigerian courts as unrea- Federal Competition and Consumer Protection Act, 2019 sonable, absurd, and capricious and may not be enforced.  (FCCPA), governs consumer protection in Nigeria and provides general rules in that regard. FCCPA establishes Nigerian courts have demonstrated that in certain the Federal Competition and Consumer Protection Coun- limited circumstances they are prepared to assume cil,49 which is responsible for the administration of FCCPA. jurisdiction despite the express choice of some other Although FCCPA is not based on any international model jurisdiction by the parties. The factors that the courts will (such as the OECD Guidelines for Consumer Protection in consider in determining whether to assume jurisdiction the Context of Electronic Commerce, 1999, or the United include Nations Guidelines on Consumer Protection), it is heavily influenced by the South African National Consumer Pro- The countries with which the parties are connected; tection Act. • The location of the evidence, the convenience in terms of accessibility and expenses between the domestic Sectoral regulators exercise some consumer protection and foreign courts; functions with respect to their sector.50 However, the regulators lack any specific mandate to address e-com- • Whether the party seeking to stay the proceedings is merce issues in their respective sectors. only seeking procedural advantages; and • Whether the plaintiffs would be prejudiced by having FCCPA requires that all information in notices, docu- to sue in the foreign court because they would ments, or visual representations should be in plain lan- – Be deprived of security for that claim; guage.51 The requirement for provision of information in plain language is deemed to have been met if an ordinary – Be unable to enforce any judgment obtained; consumer of the class of person for whom the notice is – Be faced with a time bar not applicable to the intended, with average literacy skills and minimal expe- domestic court; or rience, as a consumer of the relevant goods or services, could be expected to understand the content, signifi- – For political, racial, religious, or other reasons be cance, and import of the notice without undue effort. This unlikely to get a fair trial. requirement essentially codifies the practice among digi- tal businesses of ensuring that their notices and websites Online Consumer Protection present information in a manner that the intended cus- Online consumer protection is one of the main com- tomer can easily comprehend. This has informed the pro- ponents of trust building. The purpose of consumer vision of options of different local languages, written and protection is five-fold: 1) to allow regulators to ana- verbal, and braille features at automated teller machines lyze complaints and conduct investigations of potential (ATMs), for instance.52 Determining the impact of these wrongdoing; 2) to seek redress from firms and individu- provisions on notices and visual representations by digital als that infringe rules and regulations; 3) to create a legal businesses is currently difficult because the form and style ecosystem to promote fairness and transparency; 4) to of presentation of information are largely influenced by stop fraud, deception, and unfair trade practices; and 5) considerations such as marketing principles, user friend- to educate consumers and businesses about their rights liness, and so forth. In this sense, a well-designed notice and responsibilities and assist in informing and educat- or website would have complied with the aforementioned ing consumers as to the nature of business transactions. legal requirement, even where there is no deliberate Digital Entrepreneurship in Nigeria   29 attempt at doing so. FCCPC has yet to develop guide- In practice, most e-commerce businesses develop their lines on this issue,53 and no case on the matter has yet own consumer protection policies, which are often been reported. published on their websites in accordance with best practices. These rules are typically found in one doc- FCCPC also requires that the language used is appro- ument or several documents, such as the Terms of Use priate to the target market for the goods or services. Policy, the Product Return Policy, the Purchase Policy, and This requirement is particularly important in the context so forth. The effect is that the redress available may differ of child protection. FCCPC recognizes various consumer among businesses because they have the discretion to rights, including the right to clear disclosure of prices choose details of redress offered to customers, subject to of goods and services; to adequate trade description; the general FCCPA framework. Typically, these redresses to clear and correct labeling of products; to goods that include recession, repair, replacement, and in deserving correspond with samples and descriptions, particularly as circumstances refund. displayed by vendors; to the ability to reject goods under specified circumstances; to a full refund of money paid To help eliminate some of the uncertainties that both for such goods, and so forth. In addition, a consumer is consumers and businesses encounter when buying entitled to a refund of a reasonable portion of the price and selling online, consumer protection legislation paid for services performed or goods supplied.54 Where that speaks specifically to electronic commerce is nec- goods supplied or services rendered do not comply with essary. Such legislation should address issues such as the required standards, the undertaking shall repair or fair business, advertising, and marketing practices; clear replace the failed, unsafe, or defective goods or refund to information about an online business’s identity, the goods the consumer the price paid for such goods.55 Specifically or services it offers, and the terms and conditions of any in this regard, Section 116 of FCCPA prohibits deliber- transaction; a transparent process to confirm transactions; ately applying misleading trade descriptions or deliber- secure payment mechanisms; fair, timely, and affordable ately altering, defacing, covering, removing, or obscuring dispute resolution and redress; privacy protection; and a trade description or trade mark applied to any goods consumer and business education. The provisions of the in a misleading manner. It further prohibits an undertak- Electronic Transactions Bill, particularly Parts IV and VII, ing from supplying, offering to supply, or displaying any deal with most of these issues and will help to eliminate goods that it knows, could reasonably determine, or has some of the uncertainties that both consumers and busi- reason to suspect a misleading trade description has nesses encounter when buying and selling online and been applied or that the trade description or trademarks clarify their respective rights and responsibilities, if passed applied to those goods has been altered. The restriction into law. Online Advertising is regulated by the Advertis- of the foregoing provisions to goods (as opposed to ing Practitioners Act (see Box 1). “goods and services” in other provisions) is curious and may lead to hardship on customers of services. However, Cybersecurity the provisions of Section 125 may have cured the issue; The provisions of the Cybercrimes Act 2015 and of it provides that any person injured by reliance on false, the Nigeria Data Protection Regulations 2019 gener- misleading, or deceptive representation about a material ally govern cybersecurity issues. The Cybercrimes Act is fact, made to such person in the course of marketing any modeled after the African Unioin Convention on Cyber- goods or services, shall have right to damages and mon- security and Personal Data Protection and the Economic etary restitution. Community of West African States (ECOWAS) Directive (January 8, 2011) and provides for an effective, unified, Neither FCCPA nor case law defines the term unfair and comprehensive legal, regulatory, and institutional competition. However, all undertakings are required to framework to prohibit, prevent, detect, prosecute, and deal fairly and are prohibited from using unfair tactics to punish cybercrimes in Nigeria. It also, among other func- market or supply their goods.56 No express provision of tions, promotes cybersecurity and the protection of com- law bars the distribution of false information capable of puter systems and networks, electronic communications, harming the business of another firm. However, the dis- data and computer programs, intellectual property, and tribution of false, misleading, or deceptive representa- privacy rights. tions to consumers or prospective consumers concerning material facts in relation to goods and services is expressly prohibited.57 30   Digital Entrepreneurship in Nigeria BOX 1 Online Advertising The Advertising Practitioners Registration Cap A7, • Marketing communication sent to a public group LFN 2004 (APA), which established the Advertising must consider the group’s standard for acceptable Practitioners Council of Nigeria (APCON), primar- behavior. ily regulates advertising in Nigeria. APA regulates • Unsolicited messages should be sent only where advertising by giving APCON the power to determine such a message is reasonably believed to be of who can practice advertising, including maintaining a interest to the customer. register of qualified persons, and to set the standards of knowledge and skills required by advertisers and • Marketing communications must also include regulate and control the practice of advertising. Fur- transparent mechanisms to opt out of future solic- ther to the powers vested in it under APA, APCON itations. issued the Nigerian Code of Advertising Practice • Neither the marketing communications nor the and Sales Promotion and Other Rights/Restrictions means of enabling the communications can inter- on Practice (5th Edition) (the Code) (published by fere with the consumer’s normal usage of elec- the Federal Minister of Information pursuant to APA’s tronic data. provisions), which prescribes advertising standards, with the scope extending to foreign practitioners APCON has sought to extend its regulatory func- based in Nigeria. Advertising businesses owned 100 tions to digital marketing recently by express- percent by foreign nationals are only allowed to prac- ing an intention to start vetting internet-based tice advertising targeted at markets outside of Nige- adverts (2019). This can be viewed as an extension ria. In addition, the Code permits only advertising of the Code’s Articles 2158 and 80(a),59 which state practitioners licensed by APCON to provide adver- that APCON’s mandate covers all areas of advertis- tising services directed at the Nigerian advertising ing, including online adverts. In addition, Section 4 of market. The Court of Appeal recently confirmed that APCON’s vetting guidelines of 2017 directs that the APCON’s power to impose sanctions and regulations general principle that advertisements shall conform to is restricted to advertising practitioners and does not the principle of fair competition generally accepted in extend to persons and entities in other industries. business, and of fair comments expected in free human communication, extend to adverts on all media, includ- The Code provides, among other things, that adver- ing the internet. However, APCON suffers significant tisements comply with the following requirements: handicaps in enforcing standards, particularly online • The marketing must not be misleading. It should adverts, to the extent that nonadvertising practitioners be clear regarding the message’s subject. can place adverts on that medium. • There must be clarity of the terms of offer, and Despite the increase in online advertising, the material facts cannot be concealed by devices advertising exchanges remain unregulated. Adver- that will influence the customer’s decision. tising exchanges operate like stock exchanges. Cur- • Procedures for concluding a contract must be rently, no regulation exists in this regard, which risks clearly stated. the exchanges gaining unfair advantage via the infor- mation generated on both the advertiser side and the buyer side. The Cybercrimes Act criminalizes the following actions: • Unlawful destruction or abortion of any electronic mails or processes through which money and or valu- • Unauthorized access to a computer system or network able information is being conveyed; for fraudulent purposes and obtaining data vital to national security, particularly where the data are any • Misdirection of electronic messages with the intention program, commercial or industrial secrets, or classified to fraudulently obtain financial gain, to obstruct the information; process to cause delay, or to speed the messages to Digital Entrepreneurship in Nigeria   31 cause an omission or commission that may defeat the Service providers are required, at the request of the essence of such messages; relevant authority or law enforcement agency, to pre- serve, hold, or retain any traffic data, subscriber infor- • Deliberate and unauthorized interception by technical mation, non-content information, and content data, means of nonpublic transmissions of computer data, or to release such information. Service providers are content, or traffic data, including electromagnetic required to keep all traffic data and subscriber informa- emissions or signals from a computer, computer sys- tion as may be prescribed by the relevant authority for tem, or network carrying or emitting signals, to or from a period of two years. Through an authorized officer, a computer, computer system, or connected system law enforcement agencies are authorized to request or network; any of the aforementioned information, and the service • Inducement under false pretenses of any person provider shall comply. Any data retained, processed, or employed by federal, state, or local governments retrieved by the service provider at the request of any law of Nigeria or of any person in charge of electronic enforcement agency shall only be utilized for legitimate devices to deliver to a person any electronic mes- purposes as provided for under the Cybercrimes Act, any sages, including but not limited to e-mail, credit and other legislation or regulation, or by an order of a court debit card information, and facsimile messages, that of competent jurisdiction. In exercising these powers, due are not specifically meant for that person or his or her regard must be given to an individual’s right to privacy organization (except as authorized to receive such under the Constitution of the Federal Republic of Nigeria messages for and on behalf of his or her organization); 1999 and appropriate measures must be taken to safe- guard the confidentiality of the data retained, processed, • Knowing access to any computer or network to input, or retrieved for the purpose of law enforcement.61 For alter, delete, or suppress any data with the inten- the purposes of the Cybercrimes Act, any entity that pro- tion that such false data will be considered or acted vides users of its services the ability to communicate via upon as if it were authentic or genuine, regardless of a computer system, electronic communication devices, whether such data is directly readable or intelligible; or mobile networks, or that processes or stores computer • Intentional and without lawful authority direct or indi- data on behalf of such communication service or users of rect modification of any data held in any computer sys- such service is considered to be a service provider. This tem or network, whereby any function of the computer includes internet service providers (ISPs) and similar ser- system or network concerned is impaired, or any vice providers. – Program or data held in the computer system is In addition to the foregoing, a judge may, upon an ex altered or erased; parte application to the judge in chambers for the issu- – Program or data is added to or removed from any ance of a warrant for obtaining electronic evidence in a program or data in the system; related crime investigation, issue a warrant authorizing the law enforcement officer to62 – Program or data is suppressed to prevent or ter- minate the availability of the data or function to its • Enter and search any premises or place if an offense authorized users; or under the Cybercrimes Act is being committed within the premises, place, or conveyance; or if evidence – Act occurs that impairs the normal operation of exists of the commission of an offense under the any computer, computer system, or network con- Cybercrimes Act within the premises, place, or con- cerned. veyance; or if an urgent need exists to prevent the commission of an offense under this Cybercrimes Act The Cybercrimes Act contains provisions on investi- within the premises, place, or conveyance; gation powers over cybercrimes. Where reasonable grounds exist to suspect that the content of any elec- • Search any person or conveyance found on any prem- tronic communication is required for a criminal investiga- ises or place referred to previously; tion or proceedings, a judge may order a service provider, • Stop, board, and search any conveyance where evi- through the application of technical means, to intercept, dence exists of the commission of an offense under collect, record, permit, or assist competent authorities the Cybercrimes Act; with collecting or recording content data and/or traffic data associated with specified communications transmit- • Seize, remove, and detain anything that is or contains ted by means of a computer system, or may authorize evidence of the commission of an offense under the a law enforcement officer to collect or record such data Cybercrimes Act; through application of technical means.60 32   Digital Entrepreneurship in Nigeria • Use or cause to use a computer or any device to search standardized actionable processes in handling cyber- any data contained in or available to any computer sys- security issues in the country. It proposes strategies to tem or computer network; adopt in securing the nation’s information security assets, infrastructures, networks, and systems. ONSA maintains • Use any technology to decode or decrypt any coded a National CERT Coordination Center responsible for or encrypted data contained in a computer into read- managing cyber security incidences in Nigeria. CERT was able text or comprehensible format; and established in 2015. • Require any person having charge of or otherwise con- cerned with the operation of any computer or elec- Intermediary Liability tronic device in connection with an offense under the When infringement of law occurs, one question is the Cybercrimes Act to produce such computer or elec- extent to which intermediaries, such as platforms and tronic device. their related app developers, have legal liability for third-party harms or if liability is limited merely to the The Cybercrimes Act also provides for the creation of sellers of products and services on the platform. How a cyber security strategy, infrastructure, and institu- these rules of intermediary liability play out in e-com- tions to identify, investigate, and address cyber secu- merce markets affects the investment that platforms are rity threats. The Office of the National Security Adviser willing to make in the Nigerian market and the recourse (ONSA) is responsible for coordinating all security and that customers may have for infringement. enforcement agencies under the Cybercrimes Act. In this role, ONSA is required to support all relevant security, Currently no legislation is generally applicable to inter- intelligence, and law enforcement agencies and military mediary liability. The Copyright Bill includes provisions services to prevent and combat cybercrimes in Nige- related to intermediary liability, although with limited ria; ensure formulation and effective implementation of coverage. In common law, intermediaries such as plat- a comprehensive cyber security strategy and a national forms and their related app developers have a duty of cyber security policy for Nigeria; establish and maintain ensuring that their platforms or applications are not used a National Computer Emergency Response Team (CERT) as means to infringe on third-party rights. In practice gen- Coordination Center responsible for managing cyber erally, intermediaries are required to take down infringing incidences in Nigeria; build capacity for the effective materials on their platform and would only become liable discharge of the functions of all relevant security, intelli- where they fail, for no justifiable reason, to do so upon gence, and law enforcement and military services under being notified of the infringement. The Nigerian Com- this Cybercrimes Act or any other law on cybercrime in munication Commission has issued Guidelines for the Nigeria; coordinate Nigeria’s involvement in international Provision of Internet Service (ISP Guidelines), which are cyber security cooperation to ensure the integration of published under Section 70(2) of the Nigerian Communi- Nigeria into the global frameworks on cyber security; cations Act of 2003, to guide and regulate ISPs in relation and carry out such other activities that are necessary for to this issue. Under the ISP Guidelines, an ISP will not be the effective performance of the functions of the relevant liable for the content of any internet service transmission security and enforcement agencies under the Cyber- by a user of the service or for providing access to such crimes Act.63 content by other users where it acted as a mere conduit, provided that the ISP The Cybercrimes Act also established a Cybercrimes Advisory Council that comprises a representative of • Did not initiate the transmission, each ministry and agency specified in the Act. Such • Did not select the recipient(s) of the transmission, representatives shall be officers not below the Directorate Cadre in the Public Service or its equivalent and will cease • Did not select or modify the content contained in the to be a member of the Cybercrimes Security Council if transmission, and he or she ceases to hold that office, or if the President is • Acted without delay to remove or disable access to satisfied that it is not in the public interest for such person the information on receipt of any takedown notice or to continue being a member of the council. The National on becoming aware that the information at the ini- Security Adviser will preside over council meetings that tial source of the transmission has been removed or are required at least four times per year and whenever disabled. convened by the National Security Adviser.64 In 2019, NITDA issued the National Cybersecurity Policy/Strategy In event of caching, an ISP shall not be liable for the trans- Implementation Guidelines to ensure coordinated and mission in a communication system of automatic, inter- Digital Entrepreneurship in Nigeria   33 mediate, and temporarily stored information provided by provides that any licensee (inclusive of an ISP) that con- a user of the service, provided that the ISP travened any of the provisions of the regulations is in breach thereof and is liable to such fines, sanctions, or • Did not modify the information, penalties, including any penalties determined under the • Did not interfere with any conditions of access applica- Nigerian Communications Regulations 2005, as may be ble to the information, determined by the NCC. • Complied with any rules regarding the updating of the information. Where the infringement involves personal data breach, • Did not interfere with the lawful use of technology to then NDPR provisions apply. Where e-commerce plat- obtain data on the use of the information, and forms operate as data administrators, then the data controller has the primary responsibility to ensure that • Acted without delay to remove or disable access to compliance with NDPR. Data controllers are required the information on receipt of any takedown notice or to execute a written contract with the platform, which on becoming aware that the information at the ini- ensures that the platform adheres to the NDPR provi- tial source of the transmission has been removed or sions.65 In addition, such platform is required under NDPR disabled. to display a simple and conspicuous privacy policy that the class of data subject being targeted can understand. Where the ISP acted as a host, it will not be liable for the The privacy policy shall in addition to any other relevant storage of information at the request of any user of the information contain the following: service provided that it • What constitutes the data subject’s consent; • Did not modify the information, • Description of collectable personal information; • Did not interfere with any conditions of access applica- ble to the information, • Purpose of collection of personal data; • Did not interfere with the lawful use of technology to • Technical methods used to collect and store personal obtain data on the use of the information, information, cookies, Jason web token (JWT), web tokens, and so on; • Did not have knowledge of illegal activity related to the information, and • Access (if any) of third parties to personal data and purpose of access; • Acted without delay to remove or disable access to the information on receipt of any takedown notice. • A highlight of the principles for lawful data processing; • Available remedies in the event of violation of the pri- Paragraph 12 of the ISP Guidelines provides that ISPs vacy policy; and must establish a procedure for receiving and promptly • The time frame for remedy. responding to content-related complaints, including any notice to withdraw or disable access to identified The absence of a law on intermediary liability means no content issued by the Nigerian Communications Com- uniform guidance is available on the issue and no mini- mission or other legal authority. The ISP Guidelines mum standard exists to which intermediaries must comply. do not require takedown notices to be accompanied by an order by a judicial authority. In practice, the forego- To promote trust in the digital market, the government ing rule generally applies to other intermediaries. Most should take steps to provide an intermediary liability e-commerce platforms have rules for acceptable use of regime applicable to electronic transactions. their service, which include prohibition of activities that may infringe on third-party rights, giving the platform the Intellectual Property right to take remedial actions including penalizing offend- Intellectual property (IP) in the form of patents, trade- ing users and providing indemnity for losses, claims, or marks, industrial designs, and others is a key element sanctions incurred resulting from such infringing actions. of e-commerce transactions. In many cases, the IP is An aggrieved third party may seek redress in a court of the main value in the electronic commercial transaction, competent jurisdiction. Where the intermediary is also as in the case of music, photos, software, design, films, an ISP, the NCC Consumer Code of Practice Regulations training modules, and so forth (Ancona 2003). Given the 2007 requires the development of consumer codes to vast amount of goods and services traded online, it is par- govern the provision of services and related consumer amount to adopt models for intellectual property rights practices, including a complaint procedure. Section 9 of (IPR) protection in e-commerce that prevent IP infringe- the NCC Consumer Code of Practice Regulations 2007 ments and trading of counterfeit goods through better 34   Digital Entrepreneurship in Nigeria cooperation and joint governance among relevant stake- of Practice contains a minimum set of requirements and holders and the sharing of data and technologies among the minimum standard for the provision of services and government authorities, IP rights holders, and e-com- related consumer practices. The individual consumer merce platforms (Sun 2018). code must either include at least the terms and condi- tions of the General Code, or equivalent terms and con- Nigeria is a member of the World Intellectual Property ditions that are no less favorable to consumers than the Organization since 1995. Main IP-related laws in Nigeria General Code. include the following: Crypto Assets • Cybercrimes Act of 2015; SEC recently released a statement officially recognizing • Copyright Act (Chapter C.28, as codified 2004); crypto assets as securities in Nigeria (the Statement). • Copyright (Amendment) Decree No. 42 1999; This is the first firm and official stance that the SEC has • Copyright (Amendment) Decree No. 98 1992; taken on the issue of crypto assets, and SEC has indicated that further regulations would follow. The Statement is an • Patents and Designs Act of 1971 (Chapter 344) attempt by SEC to ensure that digital asset offerings oper- • Trade Marks Act (Chapter 436); and ate in a manner that is consistent with investor protection, • Patents and Designs (Convention Countries) Order, the interest of the public, market integrity, and transpar- 1971 (law notes 95 of 1971). ency. Accordingly, it asserts that the general objective of regulation is not to hinder technology or stifle innovation, The Cybercrimes Act of 2015 protects e-business but to create standards that encourage ethical practices transactions, company copyrights, domain names, and that ultimately make for a fair and efficient market. electronic signatures, and the Copyrights Act 2004 protects the rights of authors of original works. Nigeria The Statement defines crypto assets as “a digital rep- ranked 127 out of 137 in the Intellectual Property Protec- resentation of value that can be digitally traded and tion ranking of the WEF’s Global Competitiveness Index functions as (1) a medium of exchange; and/or (2) a unit 2017–2018 (WEF 2021). Legislative efforts to modernize of account; and/or (3) a store of value, but does not and update the general IPR framework in Nigeria have have legal tender status in any jurisdiction.” A crypto stalled (ITA 2020). In addition to the need to modernize asset is neither issued nor guaranteed by any jurisdiction, the IP framework, IP enforcement is lacking partly because fulfils the aforementioned functions only by agreement of inadequate effective border enforcement against coun- within the community of users of the crypto asset, and is terfeit and pirated goods (OTA 2019). distinguished from fiat currency and e-money (SEC 2020). According to the Statement, SEC considers all crypto Other Sectoral Consumer Protection Regulations assets to be securities unless proven otherwise, and the This section covers other regulatory areas that are relevant burden of proving that the crypto assets that are “pro- to digital entrepreneurs, including telecommunications, posed to be offered” are not securities is placed on the crypto assets, and consumer protection practices of finan- “issuer” or “sponsor” of the crypto assets. In this regard, cial institutions regulated by the Central Bank of Nigeria. the issuer or sponsor is required to prove that its virtual assets do not constitute securities by making an initial Telecommunications assessment filing. However, after the initial assessment The Consumer Code of Practice Regulations 2007, filing, where SEC finds that the virtual assets (not struc- issued by the Nigerian Communication Commission tured to be exclusively offered through crowdfunding in accordance with Section 106 of the Nigerian Com- portals or other exempt methods) are indeed securities, munication Act, further defines the procedures and then the issuer or sponsor must register the digital assets substantive requirements for developing consumer with SEC. In addition, SEC may require foreign or nonres- codes to govern the provision of services by licensed idential issuers or sponsors to establish a branch office telecommunications operators in Nigeria (Licensees) within Nigeria, and foreign issuers or sponsors will be and related consumer practices. The Consumer Code recognized by SEC where a reciprocal agreement exists of Practice Regulations requires a Licensee to either between Nigeria and the country of the foreign issuer prepare an individual consumer code for the provision or sponsor. The Statement further provides that all digi- of services and related consumer practices applicable to tal asset token offerings, initial coin offerings, and other the Licensee or to adopt the General Consumer Code of blockchain-based offers of digital assets within Nigeria or Practice attached as Schedule 1 to the Consumer Code by Nigerian issuers or sponsors or foreign issuers target- of Practice Regulations. The General Consumer Code ing Nigerian investors, shall be subject to SEC regulation. Thus, SEC will regulate crypto-token or crypto-coin invest- Digital Entrepreneurship in Nigeria   35 ments when the character of such investments qualifies as • Establish and implement operational guidelines spec- securities transactions. ifying in clear terms the responsibilities of each party, operational rules and procedures (including dispute The Statement also provides that “any person, (individ- handling), and liabilities of parties in the event of loss ual or corporate) whose  activities involve any aspect of funds arising from negligence of any of the parties; of blockchain-related and virtual digital asset services, • Develop and circulate user guides to educate and must be registered by the Commission and as such, will enlighten other stakeholders on its instant EFT ser- be subject to  the regulatory guidelines. Such services vices; include, but are not limited to reception, transmission and execution of orders on behalf of other persons, dealers on • Maintain confidentiality of instant EFT transactions and own account, portfolio management, investment advice, of information obtained in the course of discharging its custodian or nominee services.” This provision suggests responsibilities and shall ensure that these responsibil- that SEC might also regulate all persons who are engaged ities extend to its employees; in any aspect of blockchain-related services including, • Establish a robust dispute resolution system (DRS) for without limitation, persons engaged in portfolio manage- users of its platform; ment services, rendering investment advice and providing custodian or  nominee services. Persons whose activities • Establish adequate security procedures to ensure the involve any aspect of blockchain-related and virtual digital safety and security of its information and those of its asset services will need to register with SEC and will be clients, which shall include physical, transactions, logi- subject to SEC regulations. Existing digital asset offerings cal, network, and enterprise security; prior to the implementation of the regulatory guidelines • Ensure full compliance with relevant provisions of will have three months to either submit the initial assess- rules, regulations, guidelines, policies, and directives ment filing or documents for registration  proper. SEC is issued by CBN in relation to its operations; and expected to issue further regulations from time to time. • Maintain a robust anti-fraud management system Consumer Protection Practices of Financial approved by CBN or connect to the CBN industry anti- Institutions Regulated by the Central Bank of Nigeria fraud system. The Consumer Protection Regulations 2019 issued by the Central Bank of Nigeria (CBN) under the powers The Guidelines were issued pursuant to powers con- conferred by the CBN Act and the Banks and Other ferred on CBN to promote and facilitate the devel- Financial Institutions Act 2007 (as amended) guide opment of effective systems for settling transactions, effective regulation of consumer protections prac- including the development of electronic payment sys- tices of financial institutions regulated by CBN. These tems. They also make provisions to regulate, among other operate together with other regulatory instruments (reg- things, the use of ATMs, mobile point of sale services, and ulations, guidelines, circulars, and so forth) issued by web acceptance services. The Guidelines also provide for CBN to regulate various aspects of the financial services dispute resolution of issues that may arise from the use of sector. Regulatory instruments relevant to this study are these payment channels that affect doing business online. the Regulations on Instant (Inter-Bank) Electronic Funds The Guidelines specify standards and specifications for Transfer Services in Nigeria (the EFT Regulations) issued ATM terminals, which include in 2018 and the Guidelines on Operations of Electronic • All ATM deployers/acquirers are required to comply Payment Channels in Nigeria (Guidelines). The EFT Reg- with Payment Card Industry Data Security Standards ulation applies to instant electronic funds transfer (EFT) (PCI DSS); services in Nigeria on various payment channels and any payment platform that seeks to provide instant EFT ser- • All terminals must be levels 1 and 2 Europay, Master- vices in Nigeria. The EFT Regulation seeks to, among Card and Visa (EMV) compliant at a minimum and shall other objectives, prescribe the rights and obligations of be upgraded to comply with the latest version within the parties to instant EFT services in Nigeria; provide 12 months of release of the version; minimum standards for the operations of the parties to • All ATM systems shall have audit trail and logs capabil- EFT services; and stipulate procedures geared toward ities that are comprehensive enough to facilitate inves- enhancing the soundness of instant EFT services, while tigations, reconciliation, and dispute resolution; and adequately protecting the interests of instant EFT custom- ers and operators. The EFT Regulation requires an instant • Two percent of ATMs deployed by each acquirer shall EFT service provider to have tactile graphic symbols for the use of visually impaired customers. 36   Digital Entrepreneurship in Nigeria In the event of irregularities in the account of an ATM cus- • Merchants are required to use mPOS solutions that tomer that arise from the use of an ATM card, the card- utilize point-to-point encryption solutions in accor- holder’s complaints shall be treated within three days of dance with the Payment Card Industry Point-to-Point the date when the complaints were received. Encryption Solution Requirements. The Guidelines also provide minimum standards and The prohibition of exclusivity in any area of payment ser- requirements for the operation of point of sale card vice also applies to mPOS services. acceptance services. In this regard, the Guidelines require all industry stakeholders who process and/or store card- The Guidelines also apply to all forms of transfer of holder information to ensure that their terminals, applica- monetary value on the website of a merchant or a tions, and processing systems comply with the minimum payment aggregator in the purchase of goods and requirements of the specified standards and best prac- services on the internet (web acceptance services). In tices.66 In addition, all terminals, applications, and process- this regard, the Guidelines aim to provide minimum stan- ing systems are also required to comply with the standards dards and requirements for processing transactions via specified by the various card schemes. Each vendor is the internet and to promote the safety and effectiveness required provide valid certificates, showing compliance of web acceptance services and thereby enhance user with these standards, and must regularly review the sta- confidence in the service and encourage the develop- tus of all its terminals to ensure they remain compliant as ment of effective, low-risk, low-cost, and convenient pay- standards change. The Guidelines also require continual ment and financial services for customers and businesses review and recertification on compliance with these and via the internet. other global industry standards. The Guidelines also pro- hibit any form of exclusivity in any area of payment service, All web acquirers are required to utilize only the ser- including, but not limited to issuing, acquiring, processing, vices of gateway providers that comply with the min- and sale and maintenance of hardware and software. Con- imum standards. These minimum standards include 1) travention of this prohibition results in CBN suspension for PCI DSS; 2) Payment Application Data Security Standard; a minimum of one month as a payment service or payment 3) Triple Data Encryption Standards, which should be the infrastructure service provider in the first instance, to be benchmark for all data transmitted and authenticated followed by stricter sanctions if the practice persists. between parties; and 4) Second Factor Authentication. Also, any dispute, controversy, or claim arising out of or The Guidelines also provide minimum standards relating to the Guidelines or to the breach, termination, and requirements for operating mobile point of sale or invalidity thereof shall be settled in accordance with (mPOS) acceptance services and provides for promot- CBN’s dispute resolution mechanism and, if unresolved, ing the safety and effectiveness of mPOS, with a view may be referred to an arbitration panel, as provided to enhancing user confidence in the service. All industry under the Arbitration and Conciliation Act Cap. A18 stakeholders who process and/or store cardholder infor- Laws of the Federation of Nigeria 2004. mation are required to ensure that their applications and processing systems comply with the following minimum CONTESTABILITY: REGULATIONS TO LEVEL requirements and standards: THE PLAYING FIELD FOR ALL AND INCREASE • All applications and processing systems shall comply COMPETITION with the standards specified by various card schemes, Antitrust authorities need to adapt to the market with the minimum requirement being PCI DSS certi- features of the digital economy. A firm (or “platform”) fication. that brings together distinct types of economic actors • Acquirers must provide mPOS solutions that utilize to interact (for example, online auctions, dating, search Payment Card Industry PIN Transaction Security in engines, and payment systems) operates in a multisided accordance with Payment Card Industry Point-to-Point market. Antitrust authorities and courts must consider Encryption Solution Requirements. the interdependencies on the multisided platform. In doing so, such decision-makers need to pay particular • Each solution provider must provide valid certificates, attention to non-price competition. In markets catego- showing compliance with the aforementioned stan- rized by dynamic competition, competitive forces on dards and to regularly review the status of their appli- one side of the market can have feedback effects on the cations, to ensure they are in compliance with the other sides of the market. minimum standards. Digital Entrepreneurship in Nigeria   37 The case for antitrust intervention in online markets FCCPA provides the regulatory framework for antitrust requires adaptation of traditional antitrust provisions issues. Section 70 of FCCPA defines dominant position for several reasons: proper market definition, account- as the status of a company that can act without taking ing for possible low entry barriers, multi-homing and account of the reaction of its customers, consumers, or low switching costs, and the need for a proper analysis competitors. Such dominance exists where an undertak- of all sides of a market. Often, multisided markets pro- ing enjoys a position of economic strength that enables it duce significant benefits to consumer welfare in dynamic to prevent effective competition being maintained on the and fast-moving markets. Misapplied antitrust interven- relevant market and allows it to behave to an appreciable tion in such markets threatens innovation. Given these extent independently of its competitors, customers, and concerns, antitrust authorities and courts should ensure ultimately consumers. FCCPA grants FCCPC the power to that facts and economic analysis align well with legal publish the size of market share that may constitute dom- theories in multisided markets when analyzing cases. inant position in particular markets.67 In assessing market Antitrust work specific to e-commerce shows benefits of dominance, FCCPA requires that account be taken of the e-commerce platforms for consumers, at least in the short following: run (Zhu and Liu 2018; Sun et al. 2020). • The market share of the undertaking or undertakings concerned in the relevant market, Until January 2019 when FCCPA was enacted, Nigeria • Its financial power, lacked a dedicated competition law regime. However, during that period, regulators of each relevant sector • Its access to supplies or market, applied sectoral regulation: most prominently with SEC • Its link with other undertakings, for capital market, mergers, and acquisitions transactions; • Legal or factual barriers to market entry by other with the NCC for the telecommunications sector; and with undertakings, the National Insurance Commission for the insurance sec- • Actual and potential competition by undertakings tor. The competition watchdog established under FCCPA, established within or outside the scope of application FCCPC, is still finding its feet and may have to rely on of FCCPA, the prior work of various sectoral regulators to effectively perform its functions until it is fully set up. In this regard, • Its ability to shift supply or demand to other goods or the provisions of FCCPA Section 164, which preserves the services, and provisions of other enactments, regulations, and subsidi- • The ability of the opposite market side to resort to ary regulations will be of great assistance. other undertakings. FCCPA aims to promote efficiency in the emerging Nige- FCCPA expressly prohibits the abuse of market dom- rian economy by eliminating barriers and operational inance. Undertakings with market dominance will be obstacles in the form of abuse of dominant power; uncon- deemed to have abused dominant market position where scionable marketing and trading; and harmful business they practices of manufacturers, wholesalers, retailers, and so • Charge excessive prices to the detriment of consumers; forth. Accordingly, it provides a more robust framework • Refuse to give a competitor access to essential facili- for the protection of consumer rights. ties when it is economically feasible to do so; Antitrust 2.0: Abuse of Dominant Position • Engage in an exclusionary act other than one of the following listed acts if the anticompetitive effect of that Digital markets pose especial challenges in terms of act outweighs its technological efficiency and other analysis and enforcement of dominance (OECD 2020). procompetitive gains; or Abuse of dominance provisions impose special obliga- tions on dominant firms with respect to their business • Engage in any of the following exclusionary acts, decisions to limit instances in which a firm with substantial unless the firm concerned can show technological effi- market power may cause consumer harm (OECD 2020). ciency and other procompetitive gains that outweigh The features of digital markets make them more likely to the anticompetitive effects of its act: produce the kinds of consumer harm that abuse of dom- – Requiring or inducing a supplier not to deal with a inance provisions were design to prevent, while at the competitor; same time increasing the complexity of the analysis of – Refusing to supply scarce goods to a competitor this harm (OECD 2020).In turn, this complexity increases when supplying those goods is economically fea- the likelihood of over- and underenforcement of abuse of sible; dominant positions (OECD 2020). 38   Digital Entrepreneurship in Nigeria – Selling goods or services on condition that the exceeding five years, or both, while the corporation is lia- buyer purchases separate goods or services unre- ble, upon conviction, to a fine not exceeding 10 percent lated to the object of a contract, or forcing a buyer of its turnover in the preceding business year.73 to accept a condition unrelated to the object of a contract; FCCPC recently issued Merger Review Regulations – Selling goods or services below their marginal or that provide a regulatory framework for analyzing average cost; or transactions that are subject to merger notification. The purpose of merger control provisions is to prevent or – Buying up scarce supplies of intermediate goods or mitigate the effect of mergers that hinder market compe- resources required by a competitor. tition and generate harmful effects on consumers. Histor- ically, SEC regulated mergers, pursuant to the provisions Where FCCPC finds that an undertaking has abused its of the Investments and Securities Act on mergers and dominant market position, it shall notify the undertak- acquisitions. Other competition law issues such as abuse ing of its findings accompanied by a copy of the report of dominant position were regulated by sector-specific and direct the undertaking to immediately cease the bodies. FCCPA has, however, repealed the provisions of abusive practice. In addition, such an undertaking has the Investments and Securities Act on mergers and acqui- committed an offense and is liable upon conviction to sitions, and its provisions have been given supremacy over a fine of not less than 10 percent of its turnover in the any other legislation that purports to deal with competi- preceding business year or such higher percentage as tion law issues. Already, FCCPC has issued the Merger the court may determine under the circumstances of the Review Regulations to provide a regulatory framework for case.68,69 However, as evidenced in other jurisdictions, the review of mergers and the Merger Review Guidelines, fines may be inadequate to deter prohibited behavior which describe FCCPC’s general approach to administer- by large corporations, particularly considering “big tech” ing FCCPA’s merger review process. companies’ revenues. Any director of such company is also deemed to have committed an offense and is liable upon Merger review has become an increasingly important conviction to imprisonment for a term of three years or a area in regulating the digital economy. In only two fine of not less than N50 million or both.70 However, where years (2015–2017), the five largest technology firms— the undertaking indicted of abuse of dominant position Google, Amazon, Facebook, Microsoft, and GAFAM— responds to FCCPC’s directive by providing detail of mea- acquired 175 companies, including many small digital sures it proposes to make to cease the abusive practices start-up firms (Gautier and Lamesch 2020). Traditional together with timelines for implementing such measure review thresholds based on turnover may fail to capture and if FCCPC is satisfied with the proposed measures, potentially harmful acquisitions in the digital space. Inclu- FCCPC may decide not to prosecute the company. sion of the ability to claw back review of small mergers in FCCPA is an important provision in this respect because Antitrust 2.0: Restrictive Agreements Between it enables FCCPC to review digital economy transactions Competing Firms and Merger Review that would otherwise not be captured under the thresh- FCCPA prohibits any agreement among undertakings olds for mandatory notification (The World Bank Group with the purpose or effect of preventing, restricting, 2019a). To strengthen these provisions, FCCPC could or distorting competition in any market.71 In addition, consider using provisions relating to “small mergers” agreements aimed at refusing to supply goods or ser- to review mergers in the digital economy that would vices to dealers or withholding supplies of goods or ser- not otherwise meet notification thresholds (The World vices from dealers who resell are also prohibited.72 Thus Bank Group 2019a).The inclusion of these clarifications restrictive “horizontal” agreements or restrictive “vertical” will ensure that harmful transactions in the digital space agreements are not allowed under the law. FCCPC may are identified by the competition authority even when issue a cease-and-desist order to stop such anticompeti- the turnover of the target is not significant. These provi- tive practices. In addition, injunctive remedies, including sions could also serve to reduce the instances of merger interim orders mandating the cessation of the restrictive underenforcement, which have resulted in increased agreement pending the conclusion of an FCCPC inves- concentration in digital markets, partly due to the win- tigation may also be brought against such undertak- ner-take-all and winner-take-most features of digital plat- ings. Furthermore, natural persons (including directors forms (The World Bank Group 2019a). of undertakings involved in restrictive agreements) who are found guilty of such practices are liable to a fine not exceeding N5 million or imprisonment for a term not Digital Entrepreneurship in Nigeria   39 NOTES 23. Section 84, Evidence Act 24. Section 17, Cybercrimes Act. See also Section 4(3) of 9. Section 4(3) of the Constitution the Electronic Transactions Bill, 2019. Property deeds 10. Section 4(4) and (7) of the Constitution. The courts have and other contracts for the lease or sale of immoveable held that any issue not included in the aforementioned property; wills or codicils; documents pertaining to fam- lists constitute residual legislative matters, over which ily law; death and birth certificates; court orders, notices, the states may exclusively legislate, See A.G., Ogun official court processes, and other related judicial doc- State v. Aberuagba (1985) 1 NWLR (Pt. 3) 395. uments and instruments; documents for cancellation or 11. Part C. termination of utility services; any instrument required to 12. Pursuant to CAMA Section 394(3), a small company accompany any transportation or handling of dangerous satisfies the following requirements in a relevant year: (a) materials either solid or liquid in nature; and any docu- it is a private company; (b) its turnover is not more than ment ordering withdrawal of drugs, chemicals, and any N120,000,000 or such amount as may be fixed by the other material either on the ground that such items are Commission from time to time; (c) its net assets value fake, dangerous to the people or the environment, or is not more than N60,000,000 or such amount as may expired by any authority empowered to issue orders for be fixed by the Commission from time to time; (d) none withdrawal of such items of its members is an alien; (e) none of its members is a 25. Section 93(3), Evidence Act government, government corporation or agency, or its 26. Section 101, CAM nominee; and (f) in the case of a company having share 27. The Whitelist includes the European Union’s 28 countries capital, the directors among themselves hold at least 51 and Angola, Argentina, Australia, Brazil, Canada, Cape percent of its equity share capital. Verde, China, Ghana, Iceland, Israel, Japan, Kenya, New 13. Accordingly, there must be offer, acceptance, and inten- Zealand, Norway, Switzerland, Uruguay, and the United tion to enter into a contractual relationship. Because States of America. contracts may be written, oral, or inferred from the 28. Paragraph 16, NITDA Implementation Framework of the parties’ conduct, these conditions may be written, oral, Nigeria Data Protection Regulation or inferred from the conduct of parties or circumstances. 29. Internationally, the exposure of 540 million Facebook 14. The principles establishing the formation of an electronic user records on public storage servers in April 2018 and contract in Nigeria are found in the English case of Carlill the Quora (the Q&A website) data breach in Novem- v Carbolic Smoke Ball Company. This case establishes ber 2018, which exposed the details of more than 100 that an advertisement containing certain terms to get a million users, have led to growing scrutiny into the ways reward constituted a binding unilateral offer that anyone and mechanisms through which these companies save who performed its terms could accept and that a listing and secure private information at their disposal. of goods and services on an e-commerce platform can 30. https://lagos.qpay.ng/TaxPayer be validly treated as offer that can validly be accepted 31. Section 37 of the Constitution of the Federal Republic where members of the consuming public comply with of Nigeria 1999 (as amended) provides the overarching purchase terms provided on such platforms. The means instrument conferring the fundamental right to privacy of authenticating such contracts are provided in provi- on every citizen of Nigeria. This instrument provides sions of the Evidence Act and the Cybercrime Act, which constitutional guarantees of protection of the privacy of validates electronic signatures. citizens, their homes, correspondence, telephone con- 15. Section 51 versations, and telegraphic communications and permits 16. Section 52 Section 53 Section 49, Sale of Goods Act deviation from the right only where such deviation is 17. Section 53 Section 49, Sale of Goods Act done pursuant to public defense, public safety, public 18. Section 49, Sale of Goods Act morality, public order, public health, or for the purpose 19. Section 50, Sale of Goods Act UETA § 21-109(2). of protecting the rights and freedom of other persons. 20. UETA § 21-109(2). 32. As of May 2021, NITDA’s Act was in the process of being 21. NITDA Public Key Infrastructure Regulations (Code of updated and revised to include more extensive powers Practice for Accredited Certificate Authorities) defines to issue regulations and provisions in this and other digital signature: “In relation to an electronic record, [it] areas. means an electronic signature of the signer generated 33. See Consumer Code of Practice Regulations 2007, by the transformation of the electronic record using an Nigerian Communications Commission (Registration of asymmetric cryptosystem and a hash function such that a Telephone Subscribers) Regulations, and National Infor- person having the initial untransformed electronic record mation Technology Development Agency Guidelines on and the signer’s public key can determine (a) whether Data Protection the transformation was generated using the private key 34. NDPR defines personal data as any information relating that corresponds to the signer’s public key; (b) whether to an identified or identifiable natural person (data the initial electronic record has been altered since the subject). An identifiable natural person can be identified, transformation was generated.” directly or indirectly, by reference to an identifier such 22. Section 17, Cybercrimes Act as a name; an identification number; location data; an online identifier; or to one or more factors specific to 40   Digital Entrepreneurship in Nigeria the physical, physiological, genetic, mental, economic, 49. Prior to its enactment, consumer protection was reg- cultural, or social identity of that natural person. Such ulated by the Consumer Protection Council under the an identifier can include a name; address; photo; email Consumer Protection Council Act, Cap 25, 2004 Laws of address; bank details; posts on social networking web- the Federation of Nigeria, primarily aimed at regulating sites; medical information; and other unique identifiers hazardous products. such as but not limited to MAC address, IP address, 50. The regulators include SON, the national body that IMEI number, IMSI number, SIM, or personal identifiable creates standards for products and services; NCC, for information. the telecommunications sector; NERC, for the power 35. Section 2.1(1)(d), NDPR and electricity sector; NCAA, for the aviation sector; the 36. Section 2.6, NDPR Central Bank of Nigeria and SEC, for the financial and 37. Article 2.6, NDPR ; Article 4.1(5), NDPR investment sector; and NAFDAC, for specific regulated 38. Article 2.5, NDPR products such as food, drugs, and cosmetics. 39. Article 4.1, NDPR 51. Section 114, FCCPA 40. Article 4.1(3), NDPR 52. Section 1.1(g) of the Central Bank of Nigeria Guidelines on Automated Teller Machine Operations require at least 41. Primary legislation refers to laws enacted by the legisla- 2 percent of ATMs deployed by each acquirer to have tive branch (e.g., acts,) whereas a subsidiary legislation tactile graphic symbols for the use of visually impaired refers to laws enacted by the executive or another customers. branch (e.g., agencies, ministries), including regulations, decrees, and so forth. Given that many laws, such as 53. FCCPC is vested with the power to do so under Section national statistics, law enforcement (both procedural and 114(3). substantive), national emergencies, and others, are pro- 54. Section 130, FCCPA mulgated as “acts,” they supersede NDPR. To this end, 55. Section 132, FCCPA NDPR already stipulates caveats stating the supremacy 56. Section 124, FCCPA of the corresponding laws. However, some laws that 57. Section 125, FCCPA conflict with NDPR may not be foreseen. 58. This requires all advertisements except public service 42. The Bill defines household activity as an activity that is announcements, goodwill messages, obituaries, and closely and objectively linked to the private life of an vacancies to be presented for vetting and approval by individual or person and that does not impinge upon the the Advertising Standards Panel before exposure. personal sphere of others. Household activities have no 59. This declares that all advertising and marketing commu- professional, commercial, or public intent. nications directed to the Nigerian market using internet 43. Section 46, Finance Act and other electronic media are subject to the laws 44. Section 33, Finance Act regulating advertising practice in Nigeria. 45. For example, in Lagos State, the High Court of Lagos 60. Section 39, Cybercrimes Act State (Civil Procedure) Rules, 2019, requires disputants 61. Section 38, Cybercrimes Act to explore amicable resolution via ADR before filing a 62. Section 45, Cybercrimes Act lawsuit. 63. Section 41(1), Cybercrimes Act 46. Courts generally honor an agreement to submit 64. Section 42, Cybercrimes Act commercial disputes to alternative dispute resolution 65. Regulation 2.7, NDPR procedures. Also, when a party to an arbitration agree- 66. Payment Application Data Security Standard, Payment ment commences an action in court in breach of an ADR Card Industry Pin Entry Device PCI DSS, triple Data agreement, the other party to the agreement can apply Encryption Standards, and minimum EMV requirements to stay the proceedings in the court. However, to obtain 67. Section 70, FCCPA the stay of proceedings, the party making the applica- 68. The amount of the fines with respect to revenue is tion must be seen not to have taken any steps to defend an issue currently under deliberation in the European the matter in court other than entering an appearance. Union, the United Kingdom, and the United States. The Where a party moves to defend the action, for instance proposed amounts fall between the 6 and 10 percent by filing a defense, the party is deemed to have waived thresholds. his or her right to ADR and cannot seek to enforce the ADR agreement. 69. Section 73, FCCPA 47. In Sonnar & Anor. v. Partnenreedri M.S Nordwind & Anor 70. Section 74, PCCPA (1988) N.S.C.C. pps. 28-49 71. Section 50, FCCPA 48. https://ec.europa.eu/commission/presscorner/detail/en/ 72. Section 62, FCCPA IP_20_156 73. Section 69, FCCPA Digital Entrepreneurship in Nigeria   41 5 CONCLUSION Nigeria’s digital ecosystem is growing, as exemplified three laws—the Cybercrimes Act, the Evidence Act, by the number of digital firms operating in the coun- and the Companies and Allied Matters Act (CAMA)— try. Nigerian digital firms display a wide range of business with seemingly different terminology. models that address market gaps, primarily in fintech, • Personal data protection and cross-border data health, education, and business services. Firms usually flows. A comprehensive and sufficiently robust legal start operating in one business segment, but quickly framework on privacy is lacking in Nigeria outside the expand their product offerings to cater to new market general privacy stipulation of the Constitution and a opportunities. For example, Konga, an e-commerce plat- few statutes that have privacy and data protection pro- form, has developed its own payments system, effectively visions. capturing one more source of revenue that is now mar- keted to other online-based platforms. – The subsidiary nature of the Nigeria Data Protec- tion Regulation (NDPR) puts its provisions at risk of The regulatory environment for e-commerce in Nige- conflict with those of a primary legislation. ria has evolved in recent years, but regulatory gaps – A properly constituted regulatory agency empow- remain. We recommend that the government follow the ered to administer and enforce NDPR provisions is adopt, scale, and contestability framework described in absent. section 4 as a model for prioritizing actions to strengthen the regulatory areas covered in this review. • Taxation. How the Companies Income Tax Significant Economic Presence (SEP) Order 2020 will be adminis- ADOPT: Basic Regulations to Allow Digital tered and enforced as it relates to digital service pro- Businesses to Operate viders lacks clear provisions (Blackwood & Stone LP 2020). • Electronic contracts. Currently no law governs elec- tronic transactions in Nigeria. Because commercial SCALE: Enabling Regulations to Build Trust and transactions are typically based on contracts, the tra- Allow Digital Businesses to Scale Up ditional principles of common law that relates to con- tracts apply to electronic contracts. • Online dispute resolution mechanism. The alterna- • E-signatures and electronic documentation. A lack of tive dispute resolution (ADR) framework provides the regulations exists regarding the technical or procedural reassurance and certainty necessary for commercial requirements for validating e-signatures; a regulatory undertakings to rely on the enforceability of electronic authority empowered to administer the provisions contracts. Such reliance is important because it forms of the Cybercrimes Act and the Evidence Act in the the cornerstone for such undertakings to adopt elec- context of e-commerce is absent; and provisions per- tronic contracting as a way of doing business and pro- taining to electronic signatures are fragmented among motes the growth of electronic commerce. 42   Digital Entrepreneurship in Nigeria • Consumer protection. The Federal Competition • The authentication of electronic documents and rules and Consumer Protection Act (FCCPA) that gov- for acceptance of electronic signatures; erns consumer protection in Nigeria provides gen- • Harmonization and/or consolidation of electronic sig- eral rules, but it is not specially designed to address nature regulations that are now covered under three issues that may arise in the context of electronic laws—the Cybercrimes Act, the Evidence Act, and transactions. CAMA—with seemingly different terminology; • Cybersecurity. The Cybercrimes Act, modeled after • A well-defined privacy and data protection regime; the African Union Convention on Cybersecurity and Personal Data Protection and the Economic Commu- • The legality of electronic signatures created or used nity of West African States (ECOWAS) Directive (Jan- outside Nigeria provided they satisfy the Nigerian cer- uary 8, 2011), provides for an effective, unified, and tification standards; comprehensive legal, regulatory, and institutional • Consumer protection provisions that address issues in framework for the prohibition, prevention, detection, electronic commerce such as fair business, advertis- prosecution, and punishment of cybercrimes in Nige- ing, and marketing practices; clear information about ria. an online business’s identity, the goods or services • Intermediary liability. The absence of a law on offered, and the terms and conditions of any trans- intermediary liability means no uniform guidance action; a transparent process to confirm transactions; is available on the issue and no minimum standard secure payment mechanisms; fair, timely, and afford- exists with which intermediaries must comply. able dispute resolution and redress mechanisms; privacy protection; and consumer and business edu- CONTESTABILITY: Regulations to Level the cation; and Playing Field for All and Increase Competition • An intermediary liability regime applicable to elec- Antitrust 2.0. The 2019 FCCPA and the creation of the tronic transactions. Federal Competition and Consumer Protection Com- mission (FCCPC) in 2019 were significant developments Additional recommendations to strengthen the regu- and important steps toward improving the ease of latory regime and ease of doing business: doing business and ensuring market contestability and • Clarify how the SEP provision will be administered competition. Areas of improvement include improving and enforced and whether the corporate income tax the thresholds for notification of small mergers and the returns will be based on actual or deemed income criteria to review small mergers and the development of guidelines on digital economy issues (for example, • FCCPC should consider engaging with other gov- market definition, assessment of abuse of dominance) ernment regulators that affect the dynamics of digital (The World Bank Group 2019a). markets. Additionally, FCCPC should consider devel- oping competition guidelines on digital economy Recommendations issues (for example, market definition, assessment of Ensure the passage into law of legislation providing abuse of dominance) (The World Bank Group 2019a). for • Regarding Merger Review Regulations and the notice • The validity, enforceability, and admissibility of elec- for review (The World Bank Group 2019a), FCCPC tronic documents and transactions; should consider using provisions relating to “small mergers” to review mergers in the digital economy • The role of the National Information Technology that would not otherwise meet notification thresholds. Development Agency (NITDA) as the administrative authority empowered to issue rules, guidelines, and Table 6 summarizes the main findings of the regulatory standards on data protection, electronic signatures, review. and electronic transactions; Digital Entrepreneurship in Nigeria   43 TABLE 6. Main Findings of the Regulatory Review STATUS OF CURRENT LEGAL AND REGULATORY GAPS AND REGULATORY FRAMEWORK POTENTIAL GRAY AREAS RECOMMENDATIONS ADOPT: Basic regulations to allow digital businesses to operate Forming a contract electronically Currently no law governs electronic Pending passage of the Electronic Transac- To create a legal framework that pro- transactions in Nigeria. Because commercial tions Bill, 2019 (the Bill), the traditional rule vides for the validity, enforceability, and transactions are typically based on con- of the common law of contracts continues admissibility of electronic documents and tracts, the traditional principles of common to apply to e-commerce in Nigeria, and the transactions. The passage into law and law relating to contracts apply to electronic framework for electronic transactions remains implementation of the Electronic Transactions contracts. incomplete. No distinction exists between Bill would be a key step toward addressing online and offline contracts: the same provisions gaps in the basic framework to allow online The jurisprudence on electronic contracts apply to both. Thus, the common law elements businesses to operate. is underdeveloped. Consequently, although of offer, acceptance, consideration, capacity, these contracts are recognized and may be Another alternative would be to break down and intention to enter into legal relations apply enforced in Nigeria, no specific provisions of the Bill into different elements and work on to electronic contracts, whether online or offline, law apply to any of them. passing separate legislations, although this and where any of these elements is absent or entails the potential risk of delivering an The Electronic Transactions Bill, 2019 (“the any of the vitiating factors is present, an elec- incomplete framework. Bill), currently under consideration by the tronic contract may be voided. National Assembly, seeks to make provi- sions for e-commerce transactions. The Bill addresses issues covered by most interna- tional model regulations in the matter, but it is not particularly based on any of them. Electronic documentation and electronic signatures The Cybercrimes Act confers validity on No regulatory authority is empowered to Currently, Nigeria’s electronic signature electronic signatures in commercial trans- administer the provisions of the Cybercrimes regime, despite much progress, remains actions, and the Evidence Act regulates Act and the Evidence Act in the context of limited and lacks certainty. Much of the cur- admissibility of statements in documents e-commerce. The primary objective of those rent uncertainty relates to the fragmentation produced by computers74 and proof of legislative instruments was not to regulate elec- of provisions pertaining to electronic signature signature and handwriting and electronic tronic commerce, but to provide a cybersecurity across three laws—the Cybercrimes Act, the signature.75 The Electronic Transactions Bill framework for the Nigerian digital ecosystem. Evidence Act, and CAMA—with seemingly includes provisions that grant legal equiva- Furthermore, whether electronic signature, as different terminology. To this end, it is rec- lence between paper-based and electronic used in the Cybercrimes Act, has such wide ommended that these provisions be consol- communications, contracts, signatures, and applicability as implied by the Evidence Act is idated. The passage of the Bill may facilitate records. unclear. the desired effects. The recognition of electronic signatures is Currently, no regulations determine the tech- The Electronic Transactions Bill confers the particularly useful in the event of recourse to nical or procedural requirements for the valid- same legal effect on electronic signatures the courts to establish contractual rights and ity of e-signatures, with the consequence that created or used outside Nigeria as those obligations that are founded on electronic e-signatures in any format are acceptable for created in Nigeria, provided it satisfies contracts or contracts executed electronically. transactions (Adetunji et al. 2020). However, in Nigerian certification standards. The Bill practice, documents filed to regulatory author- also appoints NITDA as the administrative ities are required to contain wet ink signatures authority for electronic signatures, empow- (Adetunji et al. 2020). ered to issue rules, guidelines, and standards in that regard. The Bill also enables provision of electronic certification services in accor- dance with accreditation granted under the electronic signature administration framework established under it. 44   Digital Entrepreneurship in Nigeria STATUS OF CURRENT LEGAL AND REGULATORY GAPS AND REGULATORY FRAMEWORK POTENTIAL GRAY AREAS RECOMMENDATIONS Cross-border data flows NDPR requires that the transfer of per- Unlike GDPR, NDPR does not provide for Despite many parallels with GDPR, NDPR sonal data that is undergoing processing safeguards provided by data processors, lacks the condition for when the subject is or is intended for processing after transfer such as binding corporate rules (BCRs), which involved in a judicial processing in a third to a foreign country or to an international are considered appropriate safeguards under country, which should be clarified. organization shall be subject to NDPR GDPR and that could allow data transfer in the provisions and under the supervision of the absence of a decision on adequate protection Honourable Attorney General of the Fed- (Gibbs-Harris et al. 2020). eration (HAGF). The European Union (EU) NDPR does not specify whether a cross-bor- General Data Protection Regulation (GDPR) der transfer based on international agree- influenced the development of NDPR, most ments for judicial cooperation is allowed, particularly the provisions on cross-border and it does not provide for cross-border transfer of data. NDPR adopted the ade- data transfers being made from a register quacy and accountability approach in deter- intended to provide information to the public mining circumstances in which cross-border (Gibbs-Harris et al. 2020). data transfer may be allowed. Finally, NDPR does not require the data processor or controller to keep a record of processing activities, whereas GDPR has pre- scribed a list of information that data processors and controllers must record for international transfers of personal data (Gibbs-Harris et al. 2020). Personal data protection NDPR governs data protection, which was A potential pitfall of the current data gov- The government should focus on building issued by NITDA. NDPR defines personal ernance regime is that the key regulation, a well-defined privacy and data protection data as any information relating to an NDPR, is a subsidiary legislation. Therefore, in regime. Going forward the data protection identified or identifiable natural person (data the event of conflict between its provisions and law currently being drafted through the sup- subject). GDPR influenced the development those of a primary legislation, the provisions port of the Nigeria Identification for Develop- of NDPR, and most of its provisions mirror of the primary legislation77 will always prevail. ment (ID4D) World Bank project could help fill the framework provided by GDPR. Under these circumstances, this provision may in existing gaps in personal data protection not be able to achieve its objectives where and privacy legislation. Through the Legal and Regulatory Reform conflicting primary legislation exists. Working Group (LWG), the federal gov- ernment recently published the draft Data Another gap is the absence of a properly Protection Bill 2020.76 The Bill primarily constituted regulatory agency empowered to seeks to establish an effective regulatory administer and enforce NDPR provisions. In framework to protect personal data, regulate particular, the Nigeria Information Technology the processing of information concerning Development Agency Act, does not empower data subjects, and safeguard their fundamen- NITDA to perform any of the roles of a data tal rights and freedoms, which are guaran- protection authority or of a data protection teed under the 1999 Nigerian Constitution. commissioner. NITDA’s assumption of the role of a data protection agency is subject to challenge on the ground that it is ultra vires the express provisions of its enabling law. It is also doubtful that NITDA has the powers to enforce any sanction stipulated in NDPR. Therefore, no comprehensive and sufficiently robust legal framework on privacy currently exists in Nigeria except the general privacy stipulation of the Constitution and a few stat- utes that have privacy and data protection provisions. Digital Entrepreneurship in Nigeria   45 STATUS OF CURRENT LEGAL AND REGULATORY GAPS AND REGULATORY FRAMEWORK POTENTIAL GRAY AREAS RECOMMENDATIONS Taxation Under Nigerian law, all companies are Implementation concerns related to SEP SEP needs to clarify how the provision will subject to the Nigerian Companies Income include the lack of clear provisions on how be administered and enforced and whether Tax (CIT) where such income accrues in, is the rule will be administered and enforced as corporate income tax returns will be based derived from, brought into, or received in it relates to digital service providers (Black- on actual or deemed income. Nigeria (Section 9 of CIT) (Komolafe and wood & Stone LP 2020). Chukwuani 2020). Currently no anti-double taxation treaties Recently, Nigeria has taken steps to address digital taxation in Nigeria (Blackwood consider the issue of taxation of the digital & Stone LP 2020). Furthermore, ascertaining economy. The recently published Companies profits derived from activities in Nigeria will be Income Tax Significant Economic Presence hard to conduct, as foreign companies estimate (SEP) Order, 2020, that complements the gross income without specifying the generating 2019 Finance Act (FA 2019), provides a new jurisdiction, and this difficulty will extend to the regime for non-resident companies (NRCs) application of transfer pricing principles (Black- providing digital services and institutes VAT wood & Stone LP 2020). on intangible supplies. The Order follows the The SEP Order did not give any guidance guidelines set on the OECD’s Final Report on on whether CIT returns filed by qualifying Addressing the Tax Challenges of the Digital companies will be based on actual or deemed Economy of 2015. income, which has been a matter of legal dis- pute in recent cases against the Federal Inland Revenue Service (not involving digital service providers) (Obayomi and Adegite 2020). The SEP Order also seems to be at odds with the definition of connected person in paragraph 6a of the Seventh Schedule of CITA, which is more expansive. Finally, the SEP Order does not cover ownership or control of the electronic or wireless apparatus such as receivers, satellites, and connected servers, which are involved in providing digital services (Blackwood & Stone LP 2020). SCALE: Enabling regulation to build trust and allow digital businesses to scale up Online dispute resolution mechanism Nigeria lacks specific legislation for online NITDA recently issued the draft framework The ADR Framework provides the reassur- dispute resolution (ODR). The existing legal on the use of ADR for the information and ance and certainty necessary for commercial framework for the application of ADR in ODR communication technology (ICT) sector (ADR undertakings to rely on the enforceability of can be found in various legislations, including Framework). The ADR Framework sets out electronic contracts. Such reliance is import- the Arbitration and Conciliation Act (ACA), a blueprint for the implementation of an alterna- ant because it forms the cornerstone for such the Lagos Multi-Door Courthouse (LMDC) tive dispute resolution system for the ICT sector undertakings to adopt electronic contracting Law 2007, the Citizens Mediation Centre Law that enables the speedy resolution of ICT-re- as a way of doing business and promotes the 2003, and the Arbitration Law of Lagos State lated disputes. The ADR Framework can be growth of electronic commerce. 2009. The key legislation is the Arbitration invoked only in respect of contracts where par- and Conciliation Act, modeled after the ties have expressly agreed to submit themselves United Nations Commission on International to the ADR Framework, following common law Trade Law (UNCITRAL) on International principles of contract, by which parties are free Commercial Arbitration 1985 with minor to agree to the alternation dispute resolution modifications. options. 46   Digital Entrepreneurship in Nigeria STATUS OF CURRENT LEGAL AND REGULATORY GAPS AND REGULATORY FRAMEWORK POTENTIAL GRAY AREAS RECOMMENDATIONS Consumer protection Currently no e-commerce-specific con- FCCPA, which governs consumer protection To help eliminate some uncertainties that sumer protection laws or rules exist in in Nigeria, provides general rules, but is not both consumers and businesses encounter Nigeria. The recently enacted FCCPA specifically designed to address issues that may when buying and selling online, having governs consumer protection in Nigeria and arise in the context of electronic transactions. a consumer protection legislation that provides general rules in that regard. FCCPA speaks specifically to electronic commerce establishes FCCPC, which is responsible for is necessary. Such legislation should address FCCPA administration. Although FCCPA issues such as fair business, advertising, and is not based on any international model, it marketing practices; clear information about is heavily influenced by the South African an online business’s identity, the goods or National Consumer Protection Act. services offered, and the terms and conditions of any transaction; a transparent process to The remedies for breach of electronic confirm transactions; secure payment mech- contract are the same as those available for anisms; fair, timely, and affordable dispute an aggrieved party under traditional paper resolution and redress mechanisms; privacy contracts. protection; and consumer and business education. The provisions of the Electronic Transaction Bill, particularly Parts IV and VII, deal with most of these issues and will help eliminate some of the uncertainties that both consumers and businesses encounter when buying and selling online and will clarify their respective rights and responsibilities, if passed into law. Cybersecurity The Cybercrimes Act 2015 and NDPR Prior to the enactment of the Cybercrimes The Cybercrimes Act is modeled after the Afri- provisions generally govern cybersecurity Act, common harmful electronic and internet can Union Convention on Cybersecurity and issues. activities such as scamming, cybersquatting, Personal Data Protection and the ECOWAS cyberattack, PIN theft, hacking, phishing, Directive (January 8, 2011) and provides for an and so forth, were not defined in any statute effective, unified, and comprehensive legal, in the Nigerian law (Olubanwo & Oguntuase, regulatory, and institutional framework to pro- 2019). While compliance with the Cybercrimes hibit, prevent, detect, prosecute, and punish Act will significantly raise overhead costs for cybercrimes in Nigeria. businesses, the benefits on the side of security, Going forward, the government should reliability, and long-term profitability may focus on ensuring adequate implementation outweigh the costs (Olubanwo & Oguntuase, of the provision. 2019). Intermediary liability Currently no legislation is generally appli- The absence of a law on intermediary liability To promote trust in the digital market, the cable to intermediary liability. However, in means no uniform guidance exists on the government should take steps to provide common law, intermediaries, such as platforms issue and no minimum standard exists with an intermediary liability regime applicable and their related app developers, have a duty which intermediaries must comply. This is to electronic transactions. to ensure that their platforms or applications a critical piece of enabling legislation that is are not used as means for infringement of missing in the Nigerian context, which requires third-party rights. In practice generally, inter- attention from sector regulators, as it directly mediaries are required to take down infringing affects e-commerce activities. materials on their platform and would only become liable where they fail, for no justifiable reason, to do so upon being notified of the infringement. The Nigerian Communication Commission has issued Guidelines for the Provision of Internet Service (ISP Guidelines), which are published under Section 70(2) of the Nigerian Communications Act of 2003, to guide and regulate internet service providers (ISPs) in relation to this issue. Additionally, the Copyright Bill includes provisions related to intermediary liability, although with limited coverage. Digital Entrepreneurship in Nigeria   47 STATUS OF CURRENT LEGAL AND REGULATORY GAPS AND REGULATORY FRAMEWORK POTENTIAL GRAY AREAS RECOMMENDATIONS Intellectual property The Cybercrimes Act of 2015 protects Intellectual property (IP) enforcement is lacking Given the vast amount of goods and e-business transactions, company copyrights, partly because of inadequate border enforce- services traded online, it is paramount to domain names, and electronic signatures, ment against counterfeit and pirated goods adopt models for intellectual property and the Copyright Act 2004 protects the (OTA 2019). In fact, Nigeria ranked 127 out rights protection in e-commerce that rights of authors of original works. of 137 in the Intellectual Property Protection prevents IP infringements and trading of ranking of the World Economic Forum’s Global counterfeit goods. These models can be pur- Competitiveness Index 2017–2018 (WEF 2021). sued through cooperation with e-commerce platforms and the application of algorithms to identify instances of IP infringements. CONTESTABILITY: Regulations to level the playing field for all and increase competition Antitrust 2.0 FCCPA provides the regulatory framework FCCPA is the primary competition legislation The FCCPC should consider developing for antitrust issues. FCCPA prohibits any in Nigeria and FCCPC is the foremost compe- guidelines on digital economy issues (for agreement among undertakings with the tition and consumer protection authority. example, market definition, assessment of purpose or effect of preventing, restricting, abuse of dominance) and engaging through The 2019 FCCPA and the creation of FCCPC or distorting competition in any market.78 In advocacy with other government regulators in 2019 were significant developments and addition, agreements aimed at refusing to that affect digital markets (central bank, important steps toward improving the ease of supply goods or services to dealers or with- telecom regulator, and so forth) as per the doing business and ensuring market contest- holding supplies of goods or services from mandate under the law. ability and competition. dealers who resell are also prohibited. Additionally, FCCPC could consider using pro- FCCPC also recently issued Merger Review As per FCCPA, all undertakings are required visions relating to “small mergers” to review Regulations to provide a regulatory framework to deal fairly and are prohibited from using mergers in the digital economy that would for the review of mergers and Merger Review unfair tactics to market or supply their otherwise not meet notification thresholds. Guidelines, which describe FCCPC’s general goods.79 approach to administering FCCPA’s merger The inclusion of these clarifications will ensure review process as applicable to proposed that harmful transactions in the digital space transactions that are the subject of a merger are identified by the competition authority notification. even when the turnover of the target is not significant. How FCCPC will tackle issues arising from anticompetitive practices, and its approach to mergers and sectoral advocacy, including the digital economy, remain to be seen. If passed and signed into law, the Electronic Transactions ulation to be exempt from. Currently, Nigeria stands to Bill will provide an enabling framework that will clarify realize greater value from addressing its gaps first, before electronic transactions undertaken in Nigeria. At present, considering regulatory sandboxes. cases on core e-commerce and other online business issues are rare, and actors in the digital ecosystem have Collectively, as digital transformation affects virtually to rely on a multiplicity of guidelines and regulations gov- all aspects of life, legal and regulatory reform is often erning traditional businesses. a time-consuming and challenging process. It requires sophisticated reconsideration of almost all corners of the Once the overarching legal and regulatory framework is law and society and takes significant time to actualize. To adequately established, the Government of Nigeria is this end, we recommend that the Government of Nigeria recommended to consider the possibility of “regulatory remain firm in its political commitment, harmonize with sandboxes.”80 Note that the prerequisite for regulatory global best practices, identify new opportunities, and sandboxes is the existence of robust legislation and reg- progress toward fostering its digital ecosystem. 48   Digital Entrepreneurship in Nigeria NOTES 74. Section 84, Evidence Act 75. Section 93, Evidence Act 76. The World Bank, in collaboration with other development agencies, provided inputs to the original Data Protection Bill and to the latest version of the Bill (2020), in the context of the ID4D Project. 77. Primary legislation refers to laws enacted by the legislative branch (for example, acts), whereas a subsidiary legislation refers to laws enacted by the executive or another branch (for example, agencies, ministries), including regulations, decrees, and so forth. Given that many laws, such as national statistics, law enforcement (both procedural and substantive), national emer- gencies, and others, are promulgated as “acts,” they will supersede NDPR. To this end, NDPR already stipulates caveats stating the supremacy of the corresponding laws. However, some unforeseen laws may also conflict with NDPR. 78. Section 50, FCCPA 79. Section 124, FCCPA 80. A regulatory sandbox can be defined as a regulatory approach, typically summarized in writing and published, that allows live, time-bound testing of innovations under a regulator’s oversight (UNSGSA, 2020). Digital Entrepreneurship in Nigeria   49 6 REFERENCES Adetunji, D., Babalola, J., Ayoola, A., and Omotayo, A. GSM Association. (2020). “The Mobile Gender Gap.” (2020). “To Sign or Not to Sign? Evaluating the Validity https://www.gsma.com/mobilefordevelopment/wp-con- of Electronic Signatures Under Nigerian Law Particularly tent/uploads/2020/05/GSMA-The-Mobile-Gender-Gap- Those Affixed through the Use of Electronic Signature Report-2020.pdf. London, United Kingdom. Softwares.” ITA. (2020, September 14). “Protecting Intellectual Prop- https://www.odujinrinadefulu.com/sites/default/files/ erty.” Retrieved from International Trade Administration: O%26A_CFT%20Article%20-%20Electronic%20Signa- https://www.trade.gov/knowledge-product/nigeria-pro- tures.pdf: Odujinrin & Adefulu. tecting-intellectual-property. Ancona, A. (2003). “Intellectual Property and E-Com- Komolafe, D., and Chukwuani, O. (2020, May 01). “Nigeria: merce.” https://www.wipo.int/edocs/mdocs/sme/en/ The Impact of the Finance Act on Digital Taxation in wipo_wasme_ipr_ge_03/wipo_wasme_ipr_ge_03_13- Nigeria.” Retrieved from Mondaq.com: https://www. main1.pdf: WIPO-WASME Special program on Practical mondaq.com/nigeria/tax-authorities/903148/the-impact- IP Issues. of-the-finance-act-on-digital-taxation-in-nigeria. Bartel, A., Ichniowski, C., and Shaw, K. (2007). “How Does Library of Congress. (2020, July 24). “National Parliaments: Information Technology Affect Productivity? Plant-Level Nigeria.” Retrieved from Library of Congress: https:// Comparisons of Product Innovation, Process Improve- www.loc.gov/law/help/national-parliaments/nigeria.php. ment, and Worker Skills.” The Quarterly Journal of National Bureau of Statistics. (2020). “Gross Domestic Economics, 122(4), 1721–1758. Product at 2010 Constant Basic Prices (=N=Million).” Blackwood & Stone LP. (2020, August 24). “The Significant National Bureau of Statistics. Abuja, Nigeria. Economic Presence Order 2020.” Retrieved from Black- Obayomi, W., and Adegite, V. (2020, August 24). “INSIGHT: wood & Stone LP: https://blackwoodstone.com/the-sig- Taxation of Digital Economy in Nigeria—Significant nificant-economic-presence-order-2020/. Economic Presence.” Retrieved from Bloomberg Tax: FMoCDE. (2020). National Digital Economy Policy and Strat- https://news.bloombergtax.com/daily-tax-report-inter- egy (2020–2030). FMoCDE. Abuja, Nigeria. national/insight-taxation-of-digital-economy-in-nige- Gibbs-Harris, R., Quartieri, M., Molnar, P., Busch, L., Williams, ria-significant-economic-presence. A., Kazi, A., . . . Kateifides, A. (2020, April 13). “Com- OECD (2009), OECD Guidelines for Consumer Protection in paring Privacy Laws: GDPR v. Nigeria Data Protection the Context of Electronic Commerce, OECD Publishing, Regulation.” Retrieved from OneTrust DataGuidance: Paris. https://www.dataguidance.com/sites/default/files/ OECD (2015), Addressing the Tax Challenges of the Digital gdpr_v._nigeria.pdf Economy, Action 1 - 2015 Final Report, OECD/G20 Base GSM Association. (2019). “E-Commerce in Agriculture: New Erosion and Profit Shifting Project, OECD Publishing, Business Models for Smallholders’ Inclusion into the Paris, https://doi.org/10.1787/9789264241046-en. Formal Economy.” GSM Association. London, United OECD (2020), Abuse of dominance in digital markets, www. Kingdom. oecd.org/daf/competition/abuse-of-dominance-in-digi- tal-markets-2020.pdf 50   Digital Entrepreneurship in Nigeria Olubanwo, F., and Oguntuase, O. (2019, March 11). Täuscher, K. (2016). Business Models in the Digital “Nigeria: Milestone in Electronic Commerce: How the Economy: An Empirical Study of Digital Marketplaces. Cybercrime Act 2015 Impacts Businesses.” Retrieved Leipzig: Fraunhofer IMW.The World Bank Group. November 13, 2020, from Mondaq: https://www. (2019b). Nigeria Digital Economy Diagnostic Report. mondaq.com/nigeria/security/788730/milestone-in-elec- Washington, DC: The World Bank Group. tronic-commerce-how-the-cybercrime-act-2015-impacts- The World Bank Group. (2019a). Comments on the businesses. FCCPC’s proposed merger control thresholds and Osterwarlder, A. (2004). The Business Model Ontology a turnover requirements in Nigeria (Draft for Discussion). Proposition in a Design Science Approach. Lausanne: October 2019. Washington, DC: The World Bank Ecole des Hautes Etudes Commerciales, Université de Group. Lausanne. The World Bank Group. (2020). Digital Economy for Africa OTA. (2019). 2019 Special 301 Report. Office of the United Country Diagnostic Tool and Guidelines for Task Teams States Trade Representative. Retrieved from Executive Version 2.0. Washington, DC: The World Bank Group. Office of the President of the United States: https://ustr. The World Bank Group. (2021). Digital Markets & New gov/sites/default/files/2019_Special_301_Report.pdf. Business Models: Database and Regulations Concept PwC. (2020). “Nigeria Issues Significant Economic Presence Note. World Bank Group. June 08, 2021. Order.” https://www.pwc.com/ng/en/assets/pdf/signifi- UNSGSA. (2020). Briefing on Regulatory Sandboxes. cant-economic-presence-order-may2020.pdf. https://www.unsgsa.org/sites/default/files/resourc- Securities and Exchange Comission, Nigeria (2020). es-files/2020-09/Fintech_Briefing_Paper_Regulatory_ Statement On Digital Assets And Their Classification Sandboxes.pdf And Treatment. September 14, 2020. https://sec.gov. WEF. (2019). “The Global Governance of Online Consumer ng/statement-on-digital-assets-and-their-classifica- Protection and E-Commerce.” https://www.weforum. tion-and-treatment/ org/whitepapers/the-global-governance-of-online-con- Schief, M. (2014). Business Models in the Software Industry: sumer-protection-and-e-commerce. The Impact on Firm and M&A Performance. Springer WEF. (2021, March 24). Global Competitiveness Index. Gabler. Darmstadt, Germany. Retrieved from WEF: http://reports.weforum.org/ Schlie, E., Rheinboldt, J., and Waesche, N. (2011). Simply global-competitiveness-index-2017-2018/countryecon- Seven: Seven Ways to Create a Sustainable Internet omy-profiles/#economy=NGA. Business. New York: Palgrave Macmillan. Sun, J. (2018, September). “Intellectual Property and E-Commerce: Alibaba’s Perspective.” WIPO Magazine, Special issue 10/2018, https://www.wipo.int/wipo_maga- zine/en/2018/si/article_0006.html. Digital Entrepreneurship in Nigeria   51 7 ANNEXES ANNEX 1. LIST OF INTERVIEWS GOVERNMENT ORGANIZATION NAME TITLE NITDA Kashifu Inuwa Abdullahi Director General NITDA Dr. Vincent Olatunji Director eGovernment Development and Regulatory NITDA Amina Sambo National Coordinator, OIIE NITDA Emmanuel Edet Assistant Director and Head of Legal Services and Board Matters Unit NITDA Usman Gambo Abdullahi Director, Information Technology Development Agency NITDA Kasim Sodangi National Coordinator for the Office for Nigeria Content Development in ICT (ONC) NIPC Dr. Yewande Sadiku Executive Secretary and CEO NIPC Abayomi Salami Deputy Director Ministry of Communications and Dr. Adeluyi Olufemi Technical Assistant (Info Tech) to the Honorable Digital Economy Minister INTERMEDIARY ORGANIZATION NAME TITLE Wennovation hub Osasenaga Enogieru National Program Manager Ventures Platform Emmanuel Mimshach  Executive Director Obioha Mest Ashwin Ravichandran Managing Director 52   Digital Entrepreneurship in Nigeria ANNEX 1, continued DIGITAL FIRM NAME TITLE M’Care Opeoluwa Ashimi CEO Outsource Global Amal Hassan CEO Hello Tractor Jehiel Oliver CEO Andela Omowale David Ashiru Country Director Max NG Aderonke Olubowale HR Manager Chinedu Azodoh Co-Founder and Chief Growth Officer Flutterwave Gbemisola Ajayi Chief Strategy Officer Thrive Agric Uka Eje Founder Konga Nick Imudia CEO WellaHealth Ikpeme Neto Founder RelianceHMO Femi Kuti Director Promane and Promade Ltd Opeoluwa Ashimi CEO ANNEX 2. DATA ANALYSIS METHODOLOGY All web-based sources were acquired using the Python Start-Up Data programming language to extract the relevant informa- • Proprietary sources: tion from each within Nigeria. Machine learning tech- – Pitchbook. niques were used in some instances to learn more about the companies and the ecosystem participants. • Web sources: – i2i African Digital Platforms, • Nigerian Government’s National Information Develop- ment Agency (NITDA). – App Trace, – AngelList, • Web-based sources: – Co Creation Hub Nigeria, – Afrilabs, – Techpoint Base, and – ISNHub, – The Base. – Ventureburn, and – ANDE Global. Digital Entrepreneurship in Nigeria   53 ANNEX 3. CASE STUDIES Flutterware Sector: Financial services HQ: San Francisco, California USA Countries of operation: Nigeria, Kenya, Ghana, South Partnerships with telecom providers: Africa, Uganda Partnerships with telecom providers, that is, MTN, Air- tel, and Tigopesa Description of company: Flutterwave is a payments technology company that helps businesses expand Key revenue stream: Flutterwave Business (B2B) and their operations in Africa and other emerging markets, Barter by Flutterwave (B2C). Users both for the B2B and through a platform that enables cross-border transac- B2C segments are charged a processing fee for transac- tions via one application programming interface (API). tions and onboarding fees.  Flutterwave has processed more than 140 million trans- Main revenue partners: MTN, Airtel, Tigopesa, Uber, actions worth more than US$9 billions to date and Flywire, Arikair.com, Jumia, marketHub, and Booking. serves more than 300,000 businesses, including cus- com. Other clients include TransferWise, Wakanow, and tomers like Uber, Flywire, Booking.com, and so forth. Air Peace. Flutterwave also works with partner banks Geographic scope: infrastructure reach in more than 33 that install its STKs (systems toolkit) for payment pro- African countries, including Nigeria, Ethiopia, Uganda, cessing in-store using the bank’s hardware. GetBarter, Kenya, and South Africa. the company’s C2C product, was launched in partner- ship with Visa. User segments: Skills and financing: Flutterwave did not report major • B2B: Payments technology that allows cross-border issues with recruiting personnel with the right skills. transactions. As the company has grown, it has also leveraged the • C2C: Barter by Flutterwave is a consumer-focused developer community and partnerships to attract talent. product that offers a quick way to send and receive Flutterwave has been very successful in raising funding. money, pay bills, and create virtual dollar cards for Participation in the Y-combinator led to meetings with personal needs from a mobile phone. Venture Capital firms (Green Visor, Grey Croft, Mas- tercard) that took part in the Series A funding round. Year founded: 2016 Additional investors took part in a Series B round that Sectors addressed: No sectoral focus, clients range was co-led by Grey Croft and eVentures, which closed in among travel, ride hailing, e-commerce, and others. January 2020, raising US$35 million. Flutterwave raised Series C funding of US$170 million from a leading group Employees: 330+ (65% in core tech functions) of international investors. The latest round was led by Funding: US$225 million, Series C Funding growth-equity firms Avenir Growth Capital (“Avenir”) and Tiger Global Management LLC (“Tiger Global”) Market gap addressed: with participation from new and existing investors. Flutterwave provides payment solutions for individuals and businesses at every stage of their growth cycle. COVID-19 prospects: The pandemic has had a nega- tive impact on business momentum. Although Flutter- Barter by Flutterwave offers a way to send and receive wave focuses on online payments, a substantial amount money globally, seamlessly creating virtual US$ cards of effort goes into educating and onboarding clients to for international payments. get them online. The effect of the pandemic on airlines, Data/digital value proposition: online travel agencies (OTAs), resorts, and other busi- Flexibility in digital payment options. Barter creates nesses has affected the company in the form of reduced added value for users who would otherwise be unable transaction numbers. The company is currently identi- to pay for services that require credit card subscription fying new ways to support clients during this trying such as Spotify. period. As companies were forced to go digital, Flut- terwave has had to help offline customers get online. 54   Digital Entrepreneurship in Nigeria Konga Sector: E-commerce Data/digital value proposition: Product access and HQ: Lagos secure payment mechanism (the latter is proving to be a difficult cultural adaptation) Country of operation: Nigeria Key revenue stream: There are three key streams: 1) Description of company: commission as a percentage of value transacted, 2) a Konga is an e-commerce company offering a third- service fee, and 3) retail. The bulk of the company’s party online marketplace and first-party direct retail revenue comes from e-commerce and retail (50/50). spanning various consumer product categories. Konga also owns many first-party products, controlling The company also encompasses a logistics service, its own brands. Revenue from the B2B segment is Kxpress, which enables the timely shipment and higher. The B2C segment is growing exponentially, delivery of packages to customers and a digital pay- and the company anticipates most of the company’s ments service, Konga Pay. future growth to come from this segment. Geographic scope: National Online payments: Konga’s preferred payments model User segments: B2C and B2B is a pre-paid system. This has huge potential in terms of dynamic business operations; however, it comes Background: 2.5 years of operation with shortfalls, mainly due to Nigerian consumers’ lack Employees: 650 of openness to this form of payment. Investment history: Founded as Konga.com, Infrastructure challenges: Konga’s main challenge acquired by Zinox Technologies, which provides is access to internet. Poor internet infrastructure 100% of current funding represents obvious challenges to all aspects of an e-commerce business model, from reaching potential Market gap addressed: Untapped market of Nige- customers to coordinating staff and deliveries. Cus- rians not previously (or currently) wired into e-com- tomers also face payment challenges. Additionally, the merce lack of quality road infrastructure has traditionally been Business model employed and its characteristics: a problem for Konga. Combination of e-commerce, brick-and-mortar stores, COVID-19 implications: delivery services, and a cutting-edge Central Bank of Konga was classified as an essential service, which was Nigeria licensed payment system. Konga Health and crucial for the company to continue its operations. Konga Food distribution to be launched in the sum- E-commerce has also been a substantial growth area mer of 2021. during this time. However there have been difficulties acquiring and transporting products due to disruptions in key value chains. Digital Entrepreneurship in Nigeria   55 MAX.ng Sector: Ride hailing and financial (leasing) services HQ: Lagos, Nigeria Key revenue stream: Asset financing is approximately 60% of revenue and forms the majority of profits. Ride Country of operation: Nigeria hailing provides 40% of revenue but is mostly rein- Company description: MAX.ng describes itself as a vested in driver bonuses and marketing for ride hailing. mobility company, using motorcycles for ride-hailing Deliveries are a new but growing segment. and delivery services paid for by users via cash, card, Main revenue partner: Hybrid. Ride-hailing service or digital wallets. The asset-financing arm of MAX.ng revenues come from the customers. Delivery revenue consists in leasing motorcycles to “MAX champions” comes from large companies such as Jumia. Asset-fi- (drivers who have gone through rigorous training and nancing revenue comes from driver commissions and screening). Drivers own the motorcycles once the loan lease payments. is paid off. Pricing mechanism: Ride-hailing pricing is calculated Founded: 2015 and monitored through the app and based on distance Employees: 80 to 100 direct employees, 90% work in and time. Deliveries pricing is calculated based on dis- the area of operations tance and three categories of delivery (instant, same day, or next day). For the asset financing business, driv- Geographic scope: National: Lagos, Ibadan, Akure, ers pay back in two ways: commission on each trip and and Kano daily lease for vehicle. Default rate is below 5%. Jobs created: 100 staff and more than 2,700 contractors Major policy opportunities/challenges: User segments: • A recent ban on passenger motorcycles was • B2C: Ride hailing in Akure and Kano (Lagos was the recently implemented in Lagos State, citing secu- company’s largest market, but recent state govern- rity and safety issues. Stakeholders in the industry, ment legislation has banned small passenger vehi- including MAX.ng, were not consulted prior to or at cles including motorcycles) the time the ban was implemented. As a result of this action, 1,500 out of 1,600 MAX champions and 10 • B2B: Commercial deliveries—its largest client is a permanent staff have been rendered unemployed. partnership with Jumia (#1 online store in Nigeria). The state government also repossessed two ware- Smaller clients in the food delivery space. houses worth of motorcycles. No clear yet whether • C2C: Personal deliveries, for example, delivery of concessions are being developed to aid ride-hailing documents between parties, delivery of shoes or businesses to operate again. other items to friends • Cumbersome licensing requirements at both state Market gap addressed: Inefficient transport system in and federal levels (26 different documents required large cities and access to financing for asset purchasing. to register a motorcycle). Ibadan has now required Business model employed and its characteristics: registering all the drivers for fiscalization purposes. • On-demand motorbike ride-hailing service using a • Network and internet connectivity: The lack of digital platform for B2C interactions GPS affected the business initially, but MAX.ng • Vehicle financing for contractors of the ride-hailing surmounted this through the use of sim cards and service upgrading its app to include GPS and map function- ality. XMTP is used instead of HTTP, but most of the Data/digital value proposition: market is 2G or less, so the company has built com- The company’s leaner software package allows it to munication protocols that allow its systems to work work in areas with weak network infrastructure, leaning on lower networks. WhatsApp and point-of-sale on XMTP as much of the coverage area is 2G. machines have also helped to solve communication and transactional challenges, respectively. 56   Digital Entrepreneurship in Nigeria MAX.ng, continued • Capacity constraints are challenging but not insur- mum language requirement of English and fluency mountable. Max.ng builds the required tech for in one other main Nigerian language. At least one its platform, using cloud networks and deep engi- guarantor must come to pick up the bike with the neering teams in-house. While some challenges for driver with photographic evidence, creating social recruiting management-level staff exist, finding the accountability and proof of evidence.  right people at the right price is possible. To screen • COVID-19 implications: As a result of the lock- drivers, MAX.ng created its own processing system down, delivery services picked up again, as people that includes a psychological profile test, a financial were staying home and ordering things online or by quality check (two approved guarantors must be phone. provided), a police background check, and a mini- Digital Entrepreneurship in Nigeria   57 Outsource Global Sector: Outsourcing/offshoring and telemarketing HQ: Abuja Country of operation: Nigeria Description of company: The market gap addressed: Outsource Global describes itself as Africa’s leading • Outsourced services market in Nigeria is underde- business and knowledge process outsourcing company. veloped, with companies typically focused on the The company has a global reach and founded the first domestic market. Nigerian international call center. It serves the Japanese, The business model employed and its UK, and U.S. markets. characteristics: In addition, its business model focuses on assisting The company differentiates itself by going into partner- women in business and physically challenged individuals. ship with the client (which is distinct from the normal Geographic scope: vendor relationship). It takes up a segment of the part- • International (clients in Japan, the United Kingdom, ner’s business, providing cost-effective solutions. and the United States) Data/digital value proposition: User segments: Data and digital tech to maximize efficiency. Currently • B2B: Provides outsourced call centers for telemar- investing in AI capabilities. keting and customer service. Further development COVID-19 impact: No noted impacts of inroads into legal, finance, software development, medical records, information technology–support Major policy opportunities/challenges: services, data tagging, and artificial intelligence. • The company’s goal is to provide services ranging from legal to accounting. An international operation Value capture: focused on highly technical and highly regulated • Key revenue stream: B2B services services that vary greatly among countries is a huge Background: policy challenge. Business went live in 2016 Top 3 challenges Revenue growth and outlook: 1. Infrastructure The company anticipates growth through acquisition of The cost of power supply and connectivity are major new markets and new business lines/diversified offerings. challenges. The company has resorted to producing Sectors addressed: its own energy through generators, but connectivity • Customer service issues and latency remain an important challenge. • Telesales 2. Branding • Newer additions include legal, finance, and software Changing the relative negative perception of the development “Nigerian brand” abroad has been a challenge. • Moving into AI Much work goes into convincing clients that the Jobs created: More than 100 (50% women) company can be trusted. Investment history: 3. Training on country-specific jobs • Funded by own resources and some unspecified As it works internationally, employees may lack informal sources much sector-specific knowledge, for example, a background in U.S. law. There are difficulties adapt- Ownership structure: Privately held ing to U.S. cases, but the company provides training Intermediary support: to the employees. The same can be said for financial • Participated in several programs, most noticeably with and accounting jobs. Fortune. This helped them access the U.S. market. 58   Digital Entrepreneurship in Nigeria Promane and Promade Sector: Health and nutrition; climate smart agriculture and environmental sustainability HQ: Lagos Investment history: Funded by personal capital, venture capital and angel Country of operation: Nigeria investors. Grants from international sources, the Euro- Description of company: pean Union and the United Kingdom. Additional sup- Promane and Promade Limited is a business optimiza- port from a boot camp, the Tony Elumelu Foundation, tion firm focused on health, environmental sustainabil- and Standard Chartered Bank. ity, nutrition, and climate smart agriculture (machine Ownership structure: learning for irrigation and regenerative farming). The Privately held firm also experiments with robotics and computer vision technology for smart latrines. Intermediary support: Benefited from incubator support. Microsoft and AWS Geographic scope: National healthcare operations and currently provide free hosting. outreach activity in 14 states The market gap addressed: User segments: Integrating online and off-line mediums to ensure • B2B2C: Health operations have reached more than healthcare delivery at the last mile. 550,000 people through partners on the ground. The purchasing power of the target customer is The business model employed and its less than US$2/day. Pulling communities together characteristics: reduces operational costs. Clinical care is delivered with a subscription for the whole community, but there is a service fee for the indi- Value capture: vidual within the community that manages the subscrip- • The three key revenue streams are 1) subscriptions, tion. This fee is flexible—it can be per use or for a set 2) service fees, and 3) retail. The main revenue stream amount of time in the future. is through delivery of health services, from diagno- The company also operates a typical retail model for sis to care. These are coordinated with community pharmaceuticals and personal and protective equip- groups as the target customer has low purchasing ment manufacturers. power. As noted, 27% of revenue runs though just one community. Data/digital value proposition: Using data and machine learning to optimize its solu- • Main revenue partners: The company has multiple tions (e.g., identifying communities to distribute med- healthcare partners on the ground. It works with icine to). communities to ensure operational costs are mini- mized and products are affordable for the consumer. COVID-19 implications: Community workers’ activities were affected as a result Background: of the lockdown. The company was back on track by Founded 2015 June, although with strained finances. Revenue growth and outlook: Major policy opportunities/challenges: The company reached the break-even point in 2019 and Security challenges pose an important risk on the adop- is expecting to profit in 2020. tion of emerging technologies in Nigeria (e.g., drones Sectors addressed: for health logistics), which creates an opportunity for Environmental sustainability regulatory authorities to proactively set standards for Health information and communication technology, security, and data management. Jobs created: 500 field workers and 50 executives. The company is committed to providing jobs for low-income groups. Digital Entrepreneurship in Nigeria   59 Promane and Promade, continued Top 3 Challenges 1. Infrastructure Given the specific focus of the company, effective in terms of adaptation of these technologies. This is infrastructure is a necessity. This extends to both dig- particularly true for the older generation. ital infrastructure such as internet access and to phys- 3. Financing ical infrastructure such as roads. This reflects the dual Financing was major issue, particularly in the early needs of the company’s operation, given its digital years. It took three or four years to get the interest of innovation and face-to-face health operations. venture capital firms. There was also an initial issue 2.  Lack of human capital/technical skills/digital skills of understanding which investors to approach and The lack of digital skills and digital penetration is a how to pitch. Though a significant number of hubs constraint for business growth. The company has and incubators operate in Nigeria, there is a service found that there has been a difficult learning curve gap for impact-driven tech companies serving the less than US$2 a day market Reliance Health Sector: Healthcare HQ: Lagos • Pricing mechanism: Driven by providing affordabil- Country of operation: Nigeria ity to the consumer. Cheapest plan is US$3/person/ month. Description of company: Reliance Health is a technology-driven health insurance Background: company. It uses artificial intelligence and data sci- Formed in 2016 as Kangpe, renamed in 2017, and ence for personalized and preventative healthcare that began selling insurance in 2018. reduces hospital admissions. Revenue growth and outlook: Geographic scope: National Substantial growth, both current and expected. Reported average rate of return of US$3 million at the User segments: end of 2020. The company’s business model is to provide health insurance to both individuals and companies, although Sectors addressed: Healthcare most of its costumers are concentrated in the B2B seg- Employees: 103 ment. • B2C: 15% Investment history: Initial funding from own resources/family. Afterwards, • B2B: 85%, of which 70% did not offer health insur- the company won a pitch competition through Y-com- ance to their employees before binator in 2017, followed by investments from venture Value capture capital and angel investors. • Key revenue stream: Health insurance plans for indi- Ownership structure: Private viduals and private companies. The company’s use Intermediary support: of technology allows packages to be affordable and Office support from the government, in the form of attracts clients through accessibility (e.g., apps). workspace and internet. 60   Digital Entrepreneurship in Nigeria Reliance Health, continued The market gap addressed: Furthermore, duplication exists in regulation and Gap of affordable health insurance in Nigeria registrations between federal and state. The business model employed and its Top challenges characteristics: The company offers monthly, quarterly, and annual pay- Lack of human capital/technical skills/ digital skills 1.  ment plans for health insurance packages. Primarily, the company has struggled with finding the management/executive experience to lead an Data/digital value proposition: organization. Building the leadership pool and pro- The company owns the core health insurance admin- ducing a vision and strategy was also a challenge. istration technology to optimize operations, improve Its experience has been that employees need more service provision with clients, and reduce costs. Its tech- support and supervision than is ideal. nology also features heavily in its client interface, and all The company’s entry-level recruitment strategy is interactions with customers can be performed through to find and attract talent with appropriate skills in crit- the online platform. ical thinking, who can work independently, problem COVID-19 implications: solve, and write documents. Basic technology skills, Growth in the telemedicine services. However, there is such as using office and outlook have been crucial. also a decline in people going to hospitals, so fewer 2.  Current regulations claims are being paid out. Reliance HMO has also found the tax and regulation Major policy opportunities/challenges structures in Nigeria a barrier to its operation. The Overall, regulations at the federal level are unclear, for company also noted issues regarding data protec- example, obscure health regulations that are difficult to tion in Nigeria. understand and not enforced. Lagos State regulations are more straightforward. Digital Entrepreneurship in Nigeria   61 WellaHealth Sector: Healthcare HQ: Abuja, holding company in Ireland Ownership structure: Private Country of operation: Nigeria Intermediary support: Support from an accelerator in the United States Description of company: WellaHealth provides affordable micro-insurance for The market gap addressed: high-occurrence diseases starting with malaria in Providing an affordable product through reducing Nigeria. It has built customer relations management transaction costs. The company also provides social for pharmacies and helps patients finance healthcare. value. Its main focus is on diagnosis and treatment of malaria. The business model employed and its Geographic scope: National, 30 states covered characteristics: The model is based on collecting premiums and User segments: reducing transaction costs by using cloud technology • B2B2C: Process fulfillment orders that telemedi- and web, desktop, and telephone interfaces when cine providers can plug into. Operation through a appropriate. microfinance institution that serves farmers. Data/digital value proposition: • B2C: Point-of-care testing and drugs provision. Using data for business operations: collecting to track The company’s target group is ”digital youth.” and get insight on how to retain customers and grow. • B2B: Software that caters to the needs of pharma- cies to keep records, check drug interactions, and COVID-19 implications: provide business fulfillment for other outfits. Overall, positive, as COVID-19 is driving digital inter- actions (e.g., staying home, paying online) and due to Value capture: the nature of the sector as a whole. • Key revenue stream: Subscription-based system. Some direct sales agents, most of which are female, The company’s B2C arm relies on premiums. were made redundant. • Main revenue partner: Health providers and phar- Major policy opportunities/challenges: macies. Partnership with insurance company allows the com- • Pricing mechanism: Subscription based on a stan- pany to focus on its core competence, while insurance dard price for a basic product offered to all cus- companies handle policy/regulatory aspects. tomers. Top 3 challenges Background: Founded in 2017, working on customer relations Access to infrastructure workspace equipment 1.  management before moving into new fields or material inputs This includes core elements such as electricity and Revenue growth and outlook: internet. Not currently making profit, but expecting significant growth in future years. Planning on product and geo- Lack of human capital/technical skills/ digital 2.  graphical expansion. skills` There have been difficulties acquiring the right tal- Sectors addressed: Healthcare ent to support operations. A significant amount of Employees: 18 handholding is needed, which slows the growth of the entire company. Investment history: Initially funded by own resources and supported by 3. Access to finance friends and family. Received angel investor support WellaHealth has also found accessing finance to and grants from Google and the European Union. be a challenge in developing its operations. 62   Digital Entrepreneurship in Nigeria