A Federal High Court has affirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Data Processors of Major Importance (DCPMIs), in a judgment described as a major milestone for data accountability and regulatory oversight in Nigeria.
The commission disclosed this in a statement issued by its Head of Legal, Enforcement and Regulations, Mr Babatunde Bamigboye.
According to the statement, the judgment was delivered in the case of Emmanuel Harunna v. Nigeria Data Protection Commission (Suit No. FHC/L/CS/1116/2024).
The applicant had sought, among other reliefs, a declaration that Point of Sale (POS) agents were not Data Controllers or Data Processors of Major Importance under the Nigeria Data Protection Act (NDPA), 2023, and an order restraining the commission from registering them.
However, Justice F.N. Ogazi, after examining the provisions of the Nigeria Data Protection Act, 2023, and the commission's Guidance Notice on Registration, ruled that the NDPC acted within its statutory mandate in designating entities classified under the Major Data Processing – Ordinary High Level (OHL) category as Data Controllers and Processors of Major Importance.
The court held that the Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance across the country.
According to the judgment, the registration framework enables the commission to identify organisations engaged in significant data processing activities and effectively monitor compliance with the law.
The court further ruled that the registration requirement does not violate the constitutional right to privacy but rather serves as a statutory mechanism for protecting that right by subjecting data controllers and processors to regulatory oversight.
It also held that the commission's Guidance Notice on Registration was aimed at protecting the privacy and security of data subjects and therefore falls within the constitutional safeguards provided under Section 45 of the 1999 Constitution.
Justice Ogazi further observed that Section 65 of the Nigeria Data Protection Act provides that the provisions of the Act shall prevail over any other law that is inconsistent with its provisions on matters relating to the processing of personal data.
Reacting to the judgment, the commission described the decision as a significant advancement in Nigeria's data protection jurisprudence and a reaffirmation of its regulatory authority.
The National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, subsequently directed all Data Controllers and Data Processors of Major Importance that are yet to register with the commission to do so without delay.
Olatunji warned that failure to comply with the registration requirement could expose affected organisations to legal liabilities under the Nigeria Data Protection Act.
He added that compliance with the registration framework would strengthen public trust while protecting the fundamental rights and freedoms of data subjects in Nigeria.
The NDPC reiterated its commitment to promoting accountability, transparency and responsible personal data governance in line with the provisions of the Nigeria Data Protection Act, 2023. (NAN)
