Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Frank Ijege challenged the Nigeria Data Protection Commission's (NDPC) guidance notice on data controller registration, arguing it infringed on his right to privacy and exceeded the NDPC's legal authority. The court ruled in Ijege's favour, declaring certain paragraphs of the guidance notice invalid. The court ordered the NDPC to clarify exemptions and define entities not considered "major" data controllers.

Facts

The case was a fundamental rights action brought by Frank Ijege, trading under the name Springfield Law Practice, against the Nigeria Data Protection Commission (NDPC).

The case challenged the NDPC’s Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24, arguing it interfered with Ijege's right to privacy guaranteed by section 37 of the Nigerian Constitution.

Ijege also argued that certain paragraphs in the guidance notice were ultra vires (beyond the NDPC's legal power or authority).

The NDPC, represented by Kabir Momoh ESQ., responded with a preliminary objection, claiming that Ijege lacked the legal standing to bring the suit. The NDPC argued that Ijege did not demonstrate personal injury or damage from the guidance notice and, therefore, had no personal interest to protect.

However, the court, presided over by Justice R.M. Aikawa, rejected the NDPC’s preliminary objection. The court held that Ijege, as his law firm’s data protection officer, had a clear interest in the matter as the registration would require him to submit his personal data, impacting his privacy.

The court also cited the Fundamental Rights (Enforcement Procedure) Rules 2009, which encourages public interest litigation in human rights cases and disallows dismissal for lack of standing.

The court then proceeded to examine the merits of the case, reviewing sections 5(d), 44, and 65 of the Nigeria Data Protection Act 2023. It specifically analyzed the NDPC's power to exempt certain entities from registration as data controllers or processors of major importance, especially regarding the definition of “data controller or data processor of major importance” under section 65.

The court found that while the NDPC had listed industries categorized as data controllers and processors of major importance, it had not clarified exemptions as empowered by section 44(6) of the Act.

The court deemed this clarification necessary, distinguishing between “exclusion” and “exemption,” emphasizing the NDPC's discretionary power to grant exemptions.

Furthermore, the court scrutinized paragraphs 1(2), 2(2)(f)(h), 2(3)(g)(i), and 3(1)(e)(i) of the guidance notice, focusing on the introduction of "fiduciary relationship" as a criterion for categorizing entities as data controllers of major importance.

The court agreed with Ijege that this criterion, absent in section 65, could potentially encompass every citizen, broadening the scope beyond the Act's intention.