Clearing the Path for Effective Judicial Enforcement of the Right to Data Protection in Nigeria: The Nigeria Data Protection Act to the Rescue

Description

ABSTRACT

Clearing the Path for Effective Judicial Enforcement of the Right to Data Protection in Nigeria: The Nigeria Data Protection Act to the Rescue

Musa Kalam Abdulkadir*

The Nigerian Data Protection Regulation (NDPR) 2019 sets the stage for a more specialized engagement with the right to data protection in the country. Before the NDPR, the discussion on judicial enforcement of the right was tied to the constitutional provisions on privacy.₁ The assumption was that the right is coequal with the right to privacy under Section 37 of the Constitution and that it should therefore be treated as such. That assumption did not change with the coming of the NDPR and is unlikely to change with the coming of the Nigerian Data Protection Act, 2023. Using extant data protection cases as illustrations, this article evaluates the Nigerian experiment in judicial enforcement of the right to data protection, basing the discussion on the constitutional and normative narratives of the subject matter. It finds that judicial enforcement of the right cannot safely be launched under the framework of the right to privacy on account of fundamental normative differences. It proposes an enforcement approach that gives unique treatment to the right in accordance with its peculiarities. Importantly, enforcement efforts under the new Data Protection Act should not be based on the privacy-centric approach so far adopted in the country.

Keywords: Right to data protection, judicial enforcement, right to privacy, data protection law.

INTRODUCTION
Application of the principles of data protection had gone on quite smoothly in Nigeria, with the regulatory authorities securing a level of compliance and issuing orders and sanctions for erring data controllers.₂ This is because of the less problematic framework for regulatory enforcement of data protection principles under the NDPR which the authorities have diligently applied. This has not been the case concerning judicial enforcement where the experience had been modest and tortuous. In addition to the peripheral position of this aspect of the data protection phenomenon, the judicial enforcement regime in Nigeria inherited the confusion and lack of clarity which had characterized the early European Union (EU) judicial engagement with the right.₃

*LL.B (ABU, Zaria), LL.M (Unilag, Akoka) and a NITDA Scholar under the National Information Technology Development Fund (NITDEF).

1. See Anene v Airtel Nig Ltd. Suit No: FCT/HC/CV/545/2015 (Unreported); Joshua Agbi v MTN Nigeria Suit No: FHC/L/CS/1456/2018 (Unreported); Emerging Market Telecommunication Service v Eneye [2018] LPELR 46193(CA); Godfrey Eneye v MTN Nigeria Communication Suit No: CA/L/136/2009 (Unreported).
2. As of 2021 the supervisory authorities (the NITDA, the Nigerian Data Protection Bureau, NDPB) have received 1229 audit reports, resolved 2080 issues, issued 105 compliance and enforcement notices, started 17 investigations in alleged data breach complaints incidents, etc.
3. In its Court of Appeal submissions in Digital Rights Lawyers Initiative v National Identity Management Commission, the Applicant/Appellant had extensively cited the decisions of both the ECtHR and the Court of Justice of the European Union.

THE GRAVITAS REVIEW OF BUSINESS & PROPERTY LAW Vol.14 No.3