The commission said it had received reports of individuals taking pictures and recording videos of unsuspecting members of the public and sharing them on social media.

According to the regulator, such actions violate the privacy rights of citizens protected under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria and the Nigeria Data Protection Act, 2023.

Officials pointed to a recent case involving a content creator who stands by the roadside in Lagos and records members of the public as part of what she describes as a “reality show”.

The commission stated that using people’s images in that way requires consent unless the creator can clearly justify it under other lawful grounds for processing personal data.

Preliminary checks by the NDPC found that the activity amounts to a deliberate invasion of citizens’ privacy. The commission said the recordings do not serve a public interest or any legitimate purpose.

It also noted that those being filmed do not expect their images to be captured and shared online by a stranger.

Following the development, the National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, directed major social media platforms to strengthen enforcement of their community rules.

Platforms mentioned include TikTok, X (formerly Twitter) and Meta Platforms.

The commission said these companies must act quickly when harmful content appears on their platforms. If they fail to respond on time, the regulator warned that it may impose sanctions under the Nigeria Data Protection Act.

The NDPC also reminded content creators that they are responsible for what they publish online. According to the commission, anyone who violates the privacy rights of citizens may face legal consequences, including criminal prosecution.

The complaints centre on concerns about transparency and the processing of children’s data on the Microsoft platform, potentially violating the European Union’s General Data Protection Regulation (GDPR).

The first complaint alleges a lack of transparency around data processing. noyb asserts that Microsoft’s contracts with schools attempt to shift responsibility for GDPR compliance onto them. 

Schools, however, lack the capacity to monitor or enforce Microsoft’s data practices, creating a situation where children’s data may be processed in ways that don’t comply with GDPR.

noyb further criticizes Microsoft for providing “consistently vague” information regarding data collection practices within Microsoft 365 Education. This lack of transparency makes it difficult, if not impossible, for parents and children to understand how their data is being used.

The second complaint highlights the use of tracking cookies within Microsoft 365 Education software. These cookies reportedly collect user browsing data and analyze user behaviour, potentially for advertising purposes. 

noyb says such tracking practices occur without the consent of users or the knowledge of the schools themselves, and there appears to be no legal justification for it under GDPR.

The GDPR mandates strong protections for children’s data, emphasizing transparency and accountability. Violations can result in significant fines, potentially reaching up to 4% of a company’s global annual turnover, which could translate to billions of dollars for Microsoft.

noyb has requested that the Austrian DPA investigate the complaints and determine the extent of data processing by Microsoft 365 Education. The company has also urged the authority to impose fines if GDPR violations are confirmed.

Microsoft has yet to respond to the complaints. While the company has a European headquarters in Ireland, noyb emphasizes the “locally relevant” nature of the complaints due to its focus on Austrian schools and children. This could lead to a faster investigation and potential enforcement action by the Austrian DPA.

The GDPR has resulted in hefty penalties for violations involving children’s data in the past, with major social media platforms like Meta and TikTok facing fines. 

Microsoft’s cloud services have also faced investigation in Europe, with the European Data Protection Supervisor raising issues about the EU’s own use of Microsoft 365. These latest complaints add to the ongoing legal complexities surrounding Microsoft’s cloud products in the European Union.