Legal Opinion On The Suit No FHC/IB/CS/18/2024 Challenging The NPDC’s Bid To Register Law Firms As An Overreach Of The Commission's Authority
A. Background
The Nigeria Data Protection Act 2023 (NDPC) on the 14th of February, 2024 released a guidance notice NDPC/HQ/GN/VOL.02/24 for the Registration of Data Controllers and Data Processors of Major Importance brought pursuant to Sections 5d, 6(c), 44, 45, and 65 of the Nigeria Data Protection Act. Following which, Legal Practitioner Jonathan Agbo filed a lawsuit seeking to halt the NDPC from registering all data controllers and processors, including law firms.
B. Issues for Determination
- Whether or not by the combined interpretation of sections 5(d), 44, and 65 of the Nigeria Data Protection Act 2023, the Respondent can issue blanket notice(s) to all controllers to register with it without first designating controllers and processors of major importance?
- Whether or not by the interpretation of section 65 of the Nigeria Data Protection Act 2023, Law Firms qualify as controllers or processors of major importance?
- Whether or not by the combined interpretation of section 37 of the Constitution of the Federal Republic of Nigeria, 1999, and section 1(1) of the Nigeria Data Protection Act 2023, a breach of any of the provisions of the Nigeria Data Protection Act, 2023, and Nigeria Data Protection Regulation 2019 constitute an interference with the right to privacy?
C. Opinions
i. Whether or not by the combined interpretation of sections 5(d), 44, and 65 of the Nigeria Data Protection Act 2023, the Respondent can issue blanket notice(s) to all controllers to register with it without first designating controllers and processors of major importance?
The purpose for the creation of the NDPC is for the protection of data and information of persons in Nigeria. This is codified in Section 2 of the NDPC, giving the Commission authority to make rules and guidelines to enable its duty without hindrance. Section 2(2) of the NDPC Act outlines the classes of persons to which the Act applies. Additionally, Section 3(3) of the Act gives the Commission the right to prescribe a list of persons exempt from compliance with the Act.
Section 65 defines "data controller or data processor of major importance" as a data controller or processor domiciled, resident, or operating in Nigeria, processing personal data of more than a specified number of subjects or having significant importance to the economy, society, or security of Nigeria.
Further, Section 44(4) mandates the NDPC to maintain a record of registered data controllers. Compliance with the Guidance Notice is a condition precedent to executing this provision. The NDPC is justified in issuing a blanket notice to all controllers and processors falling under Sections 2(2) and 5(d) and as prescribed in the Guidance Notice.
ii. Whether or not by the interpretation of section 65 of the Nigeria Data Protection Act 2023, Law Firms qualify as controllers or processors of major importance?
According to Section 65, controllers or processors of major importance must be domiciled or operating in Nigeria, process personal data, and handle data of significant societal, economic, or security value. Law firms meet these criteria and should be regarded as controllers of major importance under the Guidance Notice. This is reinforced by Clause 1(2) of the Guidance Notice, stating that any controller in a fiduciary relationship with data subjects must be under the obligations imposed on controllers of major importance.
iii. Whether or not by the combined interpretation of section 37 of the Constitution of the Federal Republic of Nigeria, 1999, and section 1(1) of the Nigeria Data Protection Act 2023, a breach of any of the provisions of the Nigeria Data Protection Act, 2023, and Nigeria Data Protection Regulation 2019 constitute an interference with the right to privacy?
The right to privacy is a fundamental human right. Prior to the enactment of the NDPA 2023, only the constitution protected this right. The Nigeria Data Protection Act now provides additional protection. Any breach of this Act constitutes an interference with the right to privacy as codified in Section 37 of the Constitution, and any legislation at variance with this is void.
Conclusion
The Nigeria Data Protection Act, 2023, draws its validity from Section 37 of the Constitution. Organizations that fail to register with the NDPC risk infringing on the right to privacy, which the NDPC was created to protect.
