Overview
IntroductionIn Nigeria, the regulation of data protection and privacy has gained significant attention, particularly since the enactment of the Nigeria Data Protection Act, 2023 (NDPA or NDPA, 2023). The focus includes concerns regarding the Nigerian Data Protection Commission’s (“the NDPC” or “the Commission”) power to make subsidiary legislation and this has resulted in a number of Court cases seeking judicial clarification on the scope of this power. A judgment has recently been passed in this regard by the Federal High Court in the case of Frank Ijege v. Nigeria Data Protection Commission (NDPC). This case essentially examined the legality of the Commission’s Guidance Notice issued in 2024 on the registration of data controllers and data processors of major importance (“the Guidance Notice” or “the Notice”).
The judgment of the Court has legal implications for Nigeria's data protection landscape, emphasising the need for regulatory actions to align strictly with statutory provisions to avoid overreach. This case also underscores the importance of clear and precise regulatory guidelines in the realm of data protection, ensuring that the rights of individuals are safeguarded without imposing unnecessary burdens on data controllers and processors. Background: NDPC’s Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance. The Commission, on February 14, 2024, issued a Guidance Notice on the registration of data controllers and data processors of major importance, directing all designated data controllers or data processors of major importance (“DCDPMI”) to register with the Commission.
The Notice was issued in accordance with the Commission's function under Section 5(d) of the NDPA 2023 to register data controllers and data processors of major importance; its powers to issue regulations, rules, directives and guidance under the Act, and the obligation on DCDPMI to register with the Commission within six months after the commencement of the Act.
