The Nigeria Data Protection Commission, NDPC, recently secured a significant victory in the legal dispute over the power of the Commission to register Data Controllers and Processors of Major Importance, DCPMIs, in Nigeria.
In Emmanuel Harunna Vs NDPC FHC/L/CS/1116/2024, the Applicant approached the Federal High Court to, among others, seek: a declaration that a Point of Sale Agent is not a Data Controller or Processor of Major Importance under the Nigeria Data Protection Act, and a perpetual injunction restraining the Commission from registering these agents.
His Lordship, Justice F.N. Ogazi, subjected the Guidance Notice on Registration and section 5(d) 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, 2023 to a thorough judicial analysis and gave judgment to the effect that the Commission acted within its statutory powers in designating entities within the categories of Major Data Processing – Ordinary High Level (OHL) as Data Controllers and Processor of Major Importance (DCPMIs).
The Court memorably held that:
The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance….. Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance….. far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanism designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight….. Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of section 45 of 1999 Constitution…. Remarkably, Section 65 of the Data Protection Act provides that the provisions of the Act shall prevail over any other law inconsistent with its provisions on matter relating to the processing of personal data.
The Commission appreciates the advancement of the jurisprudence relating to data accountability in Nigeria as demonstrated in this case.
To ensure full compliance with the judgment of the court, Dr Vincent Olatunji, the NDPC’s national commissioner/CEO, has directed all c that are yet to register with the Commission to register forthwith.
“Failure to register”, Babatunde Bamigboye, head, Legal, Enforcement & Regulations at NDPC said, “creates serious legal liabilities under the law; while compliance with registration requirements builds public trust and safeguards fundamental rights and freedoms of data subjects in Nigeria”.
