By Olumide Babalola

In February 2024, when the Nigeria Data Protection Commission (NDPC) issued a notice on registration of controllers of major importance, I wrote an article titled “We are all controllers and processors of major importance”: My Brief Comments on the NDPC’s Guidance Notice on the registration of controllers and processors of major importance.”

In the article, I simply argued that contrary to the provision of the Nigeria Data Protection Act, the categories of controllers requiring registration as designated by the NDPC is absolute and all-encompassing, hence some paragraphs of the notice are ultra-vires the NDPC’s powers.

Agreeing with my opinion, a digital rights lawyer based in Kaduna, Frank Ijege approached the court seeking declarations on the offensive paragraphs of the Notice. Hence, in a judgment delivered on the 22nd day of November 2024, the Federal High Court sitting in Kaduna, per Aikawa, J. agreed with the Applicant’s argument that the NDPC’s notice is too all-encompassing and outside the powers provided by the Act. The court consequently made the following orders:

  1. Paragraph 1(2) of the notice requiring all controllers (who are under fiduciary duty with data subjects) to register is null and void.
  2. Paragraph 2(2)(f) and 2(3)(g) requiring all controllers (who have legal competence to generate revenue on a commercial scale) to register is null and void.
  3. Paragraph 2(3)(i) requiring all controllers (with need for accountability) is null and void.
  4. The NDPC ought to provide clarity on entities exempted from registration
  5. NDPC must provide list of entities who are controllers NOT of major importance
  6. Order striking out paragraphs 1(2); 2(2)(f); 2(3)(g) and 2(3)(i) from the Notice.

Conclusion

The Federal High Court’s judgment is a landmark decision for data protection law and practice in Nigeria. It reaffirms the principle that regulatory bodies, such as the NDPC, must operate within the powers explicitly granted to them by law. While the NDPC’s intention to strengthen data protection is laudable, the judgment highlights the critical importance of aligning regulatory actions with the legislative framework. As the data protection landscape in Nigeria continues to evolve, this case serves as a key precedent for ensuring that regulatory practices remain legally sound and transparent.