NDPC Secures Landmark Ruling Affirming Power to Register Major Data Controllers
The Nigeria Data Protection Commission (NDPC) has achieved a significant legal victory, with the Federal High Court upholding its authority to designate and register Data Controllers and Processors of Major Importance (DCPMIs) in Nigeria. This ruling clarifies the regulatory landscape for entities handling substantial personal data and reinforces the NDPC’s mandate under the Nigeria Data Protection Act, 2023.
The legal challenge, brought before the Federal High Court in Emmanuel Harunna v. NDPC (FHC/L/CS/1116/2024), sought to challenge the NDPC’s power to classify entities such as Point of Sale (PoS) agents as DCPMIs and to restrain the Commission from registering them. The applicant argued that PoS agents did not fall within the scope of major data controllers or processors.
However, in a judgment delivered by Honourable Justice F.N. Ogazi, the court conducted a thorough judicial review of the NDPC’s Guidance Notice on Registration and relevant sections of the Nigeria Data Protection Act, 2023, including sections 5(d), 6(c), 44, 45, and 65. The court unequivocally affirmed that the NDPC acted within its statutory powers in designating entities engaged in significant data processing activities as DCPMIs.
The court’s reasoning underscored the foundational purpose of the Nigeria Data Protection Act, stating, “The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance.” The judgment highlighted that the registration framework is a crucial mechanism for identifying entities involved in significant data processing, enabling effective monitoring of compliance, and ultimately safeguarding the constitutional right to privacy. The court further noted that the Guidance Notice itself is designed to protect the privacy and security of data subjects, bringing its registration requirements under the protective ambit of Section 45 of the 1999 Constitution. Crucially, the ruling reinforced Section 65 of the Data Protection Act, which stipulates that the Act’s provisions shall supersede any other law inconsistent with its provisions concerning personal data processing.
The NDPC has expressed its appreciation for the advancement of data accountability jurisprudence in Nigeria demonstrated by this judgment. In response to the ruling, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, has directed all DCPMIs yet to register with the Commission to do so immediately. Non-compliance carries significant legal liabilities, while adherence to registration requirements is vital for building public trust and protecting the fundamental rights and freedoms of data subjects across Nigeria. This decision provides much-needed clarity for businesses and legal professionals navigating data protection obligations.
