The Companies and Allied Matters Act, 2020 (CAMA) has made provisions to protect the information of individuals specified by them as private or restricted. This is laudable, considering the recent trends of data breaches, identity theft, fraud which are enhanced by having access to such information and laws enforcing privacy and data protection. Sections 323-329 of CAMA 2020 and Regulations 15 and 16 of the Companies Regulation 2020 contain the guidelines on the restriction of personal and protected information.
This article will give a brief overview of the categories of personal and protected information, instances where one can apply for such information to be protected, and permitted disclosure of such information.
Categories of Personal and Protected Information
The Nigerian Data Protection Regulation 2019 defines personal information as any information that can be used either directly or indirectly to identify a natural person and includes name, identification number, location data, photo, medical information, IP address, Phone number, etc.
It is pertinent to note, that CAMA 2020 only provides for restriction as to use and disclosure of “protected information”. Section 323 of CAMA 2020 states such information to include:
- A company director’s usual residential address
- A company director’s service address which is his usual residential address.
Thus, there is no inclusion of other personal information apart from the address in the category of protected information. However, the Companies Regulation in Regulations 15 refers to personal information. Although it does not also define what constitutes personal information. Sub 4 of the regulation states that the Commission can decline to issue certified true copies of documents that contain information as to:
- The actual date of birth
- Signature
- Identification Number of an individual.
Condition Precedent to Restriction of Use and Disclosure of Protected Information
Regulation 15 of the Companies Regulation 2020 stipulates the condition precedent that must be fulfilled before personal or protected information can be restricted from use and disclosure.
It provides that a director can apply for such if he or someone living with him is:
- Under threat of imminent danger to life
- Is a target of activists
- Is active in the defence industry, security or law enforcement agency
- Is a traceable supplier to the defence industry, security or law enforcement agency
- Their safety would be compromised.
Such application must be accompanied by:
- Extract of police diary where there have attacks in the past
- Documentary evidence of a threat or imminent attack
- Evidence of engagement in the defence industry, security or law enforcement agency which puts a person at risk.
A piece of personal and protected information does not acquire the status of being restricted from disclosure automatically, rather it must be applied for and accompanied with proof of why its disclosure must be restricted.
Permitted Disclosure of Personal and Protected Information
There are certain entities and instances where such information can be disclosed regardless of the restriction placed. They include:
- Public authorities, which are defined to include any person or body having functions of a public nature
- A company can disclose such information to communicate with the director concerned, to comply with the provisions of the Act in terms of particulars to be sent to the registrar and in compliance with the Commission’s decision to put the address on the public record. Sections 324 and 328 CAMA 2020
- Where the director consents to the disclosure of such information. Section 324(2) CAMA 2020.
- Disclosure to a credit reference agency: The Minister is empowered to make regulations restricting disclosure of protected information to such agency as well as guidelines in making an application for disclosure.
- Pursuant to a Court Order: A court can make an order directed at the company or Commission to disclose protected information if it is satisfied that:
- the service address of the director other than his usual residential address is not effective to bring documents to his notice
- it is necessary to enforce an order or decree of a court. This application can be made by a liquidator, creditor, member of the company or any other person the court deems to have sufficient interest. The order must also specify the persons the information should be disclosed to and the purpose of the disclosure. Section 327 of CAMA 2020.
- Disclosure by the Commission in a public record where communications sent by the Commission to the director remain unanswered and evidence that the service address for documents is not effective to bring them to his notice. The Commission is required to notify the director of such a proposal and the director cannot use a different address other than his usual residential address for 5 years from the date of the Committee’s decision. Section 329 of CAMA 2020.
In conclusion, protected information is only disclosed where justifiable reasons have been provided and proved. Currently, the CAC allows individuals to restrict the residential address of the company’s directors or business owners for the sum of N25,000 (Twenty Five Thousand Naira).
Email: info@resolutionlawng.com
