Court Strengthens NDPC Oversight Of PoS Agents, Banks, Telcos, Data Controllers

The Federal High Court has affirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to designate and register Data Controllers and Data Processors of Major Importance (DCPMIs), in a judgment expected to strengthen Nigeria’s data protection and accountability framework.

Head, Legal, Enforcement and Regulations, Babatunde Bamigboye Esq, in a statement, described the ruling as a significant victory for data governance and regulatory oversight in Nigeria.

The case, Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), challenged the Commission’s authority to classify Point-of-Sale (PoS) agents as Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act (NDPA). The applicant also sought a perpetual injunction restraining the Commission from registering such entities.

However, delivering judgment, Justice F.N. Ogazi held that the NDPC acted within the powers conferred on it by the Nigeria Data Protection Act in issuing the Guidance Notice and designating entities engaged in Ordinary High-Level (OHL) data processing activities as DCPMIs.

According to the Commission, the court subjected the Guidance Notice, along with Sections 5(d), 6(c), 44, 45, and 65 of the Nigeria Data Protection Act, to extensive judicial scrutiny before arriving at its decision.

In its judgment, the court held that, “The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance and is far from undermining the constitutional right to privacy.”

The court further ruled that, “The registration framework is one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.”

On the legal status of the Commission’s Guidance Notice, the court stated, “Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of Section 45 of the 1999 Constitution.”

The court also affirmed the supremacy of the Nigeria Data Protection Act on matters relating to personal data processing, declaring,

“Remarkably, Section 63 of the Data Protection Act provides that the provisions of the Act shall prevail over any other law inconsistent with its provisions on matters relating to the processing of personal data.”

The NDPC, in its reaction to the judgment, said the ruling represents a major milestone in the evolution of data protection jurisprudence in Nigeria.

Bamigboye Esq. said the Commission appreciates “the ground-breaking efforts of the court towards the advancement of the jurisprudence relating to data accountability in Nigeria.”

It added that the judgment has further reinforced the Commission’s mandate to regulate organisations processing significant volumes of personal data while ensuring the protection of citizens’ privacy rights.

Meanwhile, the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, has directed all Data Controllers and Data Processors of Major Importance that are yet to register with the Commission to do so without delay.

The statement warned that failure to comply could expose defaulting organisations to legal consequences.

According to Bamigboye, “Failure to register creates serious legal liabilities under the law, while compliance with registration requirements builds public trust and safeguards the fundamental rights and freedoms of data subjects in Nigeria.”

The judgment is expected to provide greater legal certainty for the implementation of the Nigeria Data Protection Act and strengthen the Commission’s regulatory oversight of organisations that process large volumes of personal data across sectors, including financial services, telecommunications, healthcare, digital platforms and other data-intensive industries.