Nigeria Data Protection Commission Directs Registration After Court Victory

The Nigeria Data Protection Commission (NDPC) has issued a new directive compelling all significant data controllers and processors to register with the agency. This action follows a crucial Federal High Court judgment that validated the commission's statutory authority to designate and register such entities.

“

The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance.

The court's decision arose from a lawsuit filed by Emmanuel Harunna, who sought to prevent the NDPC from registering Point of Sale agents as 'Data Controllers or Processors of Major Importance.' However, Justice F.N. Ogazi affirmed the commission's powers, citing the Nigeria Data Protection Act and the commission's Guidance Notice on Registration. The judge emphasized that the Act aims to promote accountability, transparency, and responsible data governance, with registration serving as a mechanism to monitor entities engaged in significant data processing.

“

Far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.

The court further stated that the registration framework is designed to safeguard privacy rights by subjecting data handlers to effective regulatory oversight. The judgment highlighted that the Guidance Notice aligns with constitutional protections for privacy. The NDPC hailed the ruling as a major milestone for data accountability and regulatory oversight in Nigeria, underscoring its importance for the nation's data protection regime.

“

Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of Section 45 of the 1999 Constitution.