Regulatory body releases new enrollment guidelines after winning legal battle

The Nigeria Data Protection Commission has issued a directive to all unregistered Data Controllers and Data Processors of Major Importance, ordering them to register immediately in light of a recent Federal High Court judgment that upheld the commission's authority to designate and register such entities.

n

This directive was outlined in a statement released on Tuesday by Babatunde Bamigboye, the Head of Legal, Enforcement and Regulations at the NDPC, who characterized the court's decision as a significant milestone in the realm of data accountability and regulatory oversight in Nigeria.

n

The judgment in question arose from a lawsuit filed by Emmanuel Harunna against the NDPC, specifically case number Emmanuel Harunna v. NDPC (FHC/L/CS/1116/2024), in which the applicant sought to establish that Point of Sale agents did not qualify as Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act.

n

According to the statement, Justice F.N. Ogazi carefully examined the commission's Guidance Notice on Registration alongside relevant sections of the Nigeria Data Protection Act, including Sections 5(d), 6(c), 44, 45, and 65, before concluding that the commission had acted within its statutory powers in designating certain entities as Data Controllers and Processors of Major Importance.

n

The court's judgment emphasized that the Nigeria Data Protection Act was enacted to promote accountability, transparency, and responsible data governance, and that registration enables the commission to identify and monitor entities engaged in significant data processing activities.

n

The statement quoted the court as saying that the registration framework is a statutory mechanism designed to safeguard the right to privacy by subjecting data controllers and data processors to effective regulatory oversight, rather than undermining it.

n

The court also noted that the Guidance Notice is aimed at protecting the privacy and security of data subjects, and that the registration requirement falls within the protective shield of Section 45 of the 1999 Constitution.

n

Furthermore, the court held that Section 63 of the Data Protection Act provides that the act's provisions shall prevail over any other law inconsistent with its provisions on matters relating to the processing of personal data.

n

The commission welcomed the judgment, describing it as a significant boost to Nigeria's data protection regime and appreciating the court's efforts towards advancing the jurisprudence relating to data accountability in Nigeria.

n

National Commissioner and Chief Executive Officer Vincent Olatunji has directed all non-compliant Data Controllers and Processors of Major Importance to register without delay, following the court's ruling.

n

The commission warned that failure to comply with the registration requirement could result in serious legal consequences, while compliance with registration requirements is essential for building public trust and safeguarding the fundamental rights and freedoms of data subjects in Nigeria.