Court affirms NDPC’s authority to register major data controllers, processors

The Federal High Court has upheld the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Processors of Major Importance (DCPMIs), in a judgment that strengthens the country’s data protection framework and regulatory oversight.

In a statement issued by the Commission, the court dismissed a suit filed by Emmanuel Harunna, who had challenged the NDPC’s authority to require certain businesses, including Point of Sale (POS) agents, to register as DCPMIs under the Nigeria Data Protection Act (NDPA), 2023.

The case, Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), sought declarations that POS agents should not be classified as Data Controllers or Processors of Major Importance and asked the court to restrain the Commission from enforcing the registration requirement.

However, Justice F.N. Ogazi ruled in favour of the NDPC after examining the provisions of Sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, 2023, as well as the Commission’s Guidance Notice on Registration.

The court held that the Commission acted within the powers granted to it by law in designating organisations that fall within the Major Data Processing – Ordinary High Level (OHL) category as Data Controllers and Processors of Major Importance.

According to the judgment, the registration framework is a legitimate regulatory tool intended to strengthen accountability and transparency in the processing of personal data across Nigeria.

Justice Ogazi stated that the Nigeria Data Protection Act was enacted to promote responsible data governance, adding that registration allows the Commission to identify organisations engaged in significant data processing activities and monitor their compliance with the law.

The court further ruled that the registration requirement does not infringe on the constitutional right to privacy but instead serves as a mechanism for protecting that right through effective regulatory oversight.

The judgment also found that the NDPC’s Guidance Notice aligns with the objectives of safeguarding the privacy and security of data subjects and therefore falls within the protections provided under Section 45 of the 1999 Constitution.

In addition, the court reaffirmed that Section 65 of the Nigeria Data Protection Act gives the legislation overriding effect over any other law that conflicts with its provisions on matters relating to the processing of personal data.

Reacting to the judgment, the NDPC described the ruling as a significant advancement in Nigeria’s data protection jurisprudence and a boost for accountability in the country’s digital economy.

Following the court’s decision,  Vincent Olatunji,  the national commissioner/CEO of the NDPC, directed all organisations classified as Data Controllers and Processors of Major Importance that have yet to register with the Commission to do so immediately.

The commission warned that failure to register could expose affected organisations to legal liabilities under the Nigeria Data Protection Act, while compliance would strengthen public trust and help protect the fundamental rights and freedoms of Nigerians whose personal data is processed.

The ruling is expected to reinforce the NDPC’s enforcement powers as Nigeria continues to strengthen its data governance framework amid increasing digitalisation, fintech adoption and growing concerns over the protection of personal information.