The Court Of Appeal Settles The Debate On Whether Data Protection Is Now Subsumed Under Right To Privacy In Nigeria

By Olumide Babalola

In my article titled “privacy versus data protection debate in Nigeria: the two schools of thought” published by most law blogs in January 2021, I refrained from taking a position because of a pending appeal on the issue where I had settled the appellant’s brief in favour of data protection as a component of right to privacy under the Nigerian 1999 Constitution.

In what appears the most significant decision on data protection in our country’s history so far, on the 24th day of September 2021, the Court of Appeal sitting in Ibadan extensively ruled on the nature of Nigeria Data Protection Regulation 2019 (NDPR) and the relationship of data protection with the right to privacy guaranteed under section 37 of the 1999 Constitution in the case of Digital Rights Lawyers Initiative (DRLI) and National Identity Management Commission (NIMC), Appeal Number CA/IB/291/2020.

In this case, we approached the High Court of Ogun State challenging NIMC’s levying of N15, 000 on persons seeking rectification of their personal data in the national data base. We contended that rectification of personal data is a data subject’s right under the NDPR and payment should not be ordinarily made to enjoy a right.

At the trial court, although the court declined jurisdiction on the ground that the challenge was against the executive and administrative decision of an agency of the federal government under section 251(1)(p) and (q) of the Constitution, My Lord Justice A.A. Akinyemi graciously admitted that:

“This right to privacy is not limited to his home but extends to anything that is private and personal to him including communication and personal data.”

On appeal, while the Court of Appeal agreed with the trial court on jurisdiction, the court, in an unprecedented manner, extensively considered the nature of data protection under section 37 of the 1999 Constitution thus:

“But the meaning and scope of ‘privacy of citizens’ as guaranteed by the section has not received clear definition/interpretation in the constitution. The trial court had, in my view, rightly heald that the right to ‘privacy of citizens’ as guaranteed under the section includes the right to protection of personal information and personal data.’

On the objective of the NDPR, the Court, per Mohammed JCA, held that:

“As rightly observed in paragraph 26 of the Appellant’s brief of argument, the preamble of the NDPR 2019 indicates that the NDPR was made as a result of concerns and contribution of stakeholders on the issue of privacy and protection of personal data.”

On the nexus between NDPR and right to privacy under the constitution, the court expressly held that:

“On the relationship between the NDPR 2019 and section 37 of the CFRN 1999, it is pertinent for me to state that the CFRN 1999 makes provision in chapter IV guaranteeing the various fundamental rights of citizens. But as I stated earlier, the nature and scope of those rights and even their limitations are in most instances, furthered by other statutes, regulations or other legal instruments. It is in this instance that the NDPR must be construed as providing one of such legal instruments that protects or safeguards the right to privacy of citizens as it relates to the protection of their personal information or data which the trial court had rightly adjudged at page 89 of the record to be part of the right to privacy guaranteed by section 37 of the CFRN.”

Conclusively, this watershed decision has momentarily ended the debate on whether data protection is contemplated under privacy and this is good for the development of the subject pending the passage of a principal data protection legislation that would address the other procedural and substantive concerns omitted in the NDPR.