The Nigeria Data Protection Commission (NDPC) has secured a significant legal victory affirming its statutory authority to register Data Controllers and Data Processors of Major Importance (DCPMIs) in Nigeria.
In the case of Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), the applicant approached the Federal High Court seeking, among other reliefs, a declaration that Point of Sale (POS) agents are not Data Controllers or Data Processors of Major Importance under the Nigeria Data Protection Act (NDPA), 2023. The applicant also sought a perpetual injunction restraining the Commission from requiring such agents to register as DCPMIs.
In his judgment, Honourable Justice F. N. Ogazi conducted a detailed judicial examination of the NDPC’s Guidance Notice on Registration, as well as Sections 5(d), 6(c), 44, 45, and 65 of the Nigeria Data Protection Act, 2023. The Court held that the Commission acted within its statutory powers in designating entities classified under the Major Data Processing, Ordinary High Level (OHL) category as Data Controllers and Data Processors of Major Importance (DCPMIs).
Court Upholds NDPC Registration Powers:
“The Nigeria Data Protection Act was enacted to promote accountability, transparency, and responsible data governance. Registration enables the Respondent to identify entities engaged in significant data processing activities and monitor compliance. Far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.
Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thereby bringing the registration requirement within the protective shield of Section 45 of the 1999 Constitution.
Remarkably, Section 65 of the Nigeria Data Protection Act provides that the provisions of the Act shall prevail over any other law that is inconsistent with its provisions on matters relating to the processing of personal data.”
The Commission welcomes this landmark judgment as a significant advancement in Nigeria’s data protection jurisprudence and a major step toward strengthening accountability in the processing of personal data.
To ensure full compliance with the Court’s decision, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, has directed all Data Controllers and Data Processors of Major Importance (DCPMIs) that are yet to register with the Commission to do so without delay.
The Commission emphasizes that failure to register exposes affected entities to significant legal liabilities under the Nigeria Data Protection Act. Conversely, compliance with the registration requirements enhances public trust, strengthens regulatory oversight, and safeguards the fundamental rights and freedoms of data subjects across Nigeria.
Stay informed with the latest news, government updates, business, technology, and public policy developments from across Nigeria and beyond. Visit LouisaOlaniyi.com.ng for more breaking stories and in-depth reports.
