In a ruling on November 22, 2024, the Federal High Court sitting in Kaduna invalidated certain provisions of a notice issued by the Nigeria Data Protection Commission (NDPC) regarding the registration of “controllers of major importance.”
The decision, delivered by Justice Aikawa, followed a legal challenge led by Kaduna-based digital rights lawyer, Frank Ijege.
The NDPC’s notice, issued in February 2024, had been criticized for being overly broad and exceeding the powers granted by the Nigeria Data Protection Act. In his February 2024 article, “We Are All Controllers and Processors of Major Importance: My Brief Comments on the NDPC’s Guidance Notice,” legal expert Olumide Babalola argued that the NDPC’s interpretation of the law was absolute and all-encompassing, leading to regulatory overreach.
The court agreed with these concerns and ruled that several paragraphs of the notice were ultra vires. Justice Aikawa issued the following declarations and orders:
-Paragraph 1(2): Requiring all controllers under fiduciary duty with data subjects to register was declared null and void.
– Paragraphs 2(2)(f) and 2(3)(g): Mandating registration for controllers with legal competence to generate revenue on a commercial scale were struck down.
– Paragraph 2(3)(i): Requiring registration for controllers with accountability obligations was also invalidated.
– The NDPC was directed to clarify which entities are exempt from registration and to provide a comprehensive list of controllers who are not of major importance.
– The court formally struck out the contentious paragraphs.
This decision sets a precedent in Nigeria’s evolving data protection landscape. It reinforces the principle that regulatory bodies must operate strictly within the limits of their enabling laws.
While the NDPC’s efforts to bolster data protection are commendable, the court emphasized the necessity of aligning regulatory actions with the legislative framework to avoid overreach.