Africa: Privacy

The Nigeria Data Protection Commission's controversial Guidance Notice requiring registration of Data Controllers and Processors of Major Importance sparked legal challenges and widespread debate over regulatory authority, privacy rights, and compliance obligations. A landmark Federal High Court ruling has now clarified the scope and validity of these registration requirements, establishing binding precedent on who must register and under what circumstances.

Nigeria's adoption of AI-powered facial recognition at major airports and automated credit scoring by digital lenders raises urgent questions about constitutional privacy protections. With Section 37 of the 1999 Constitution drafted before modern biometric surveillance existed, can its guarantee of privacy extend to algorithmic profiling and mass data collection?

Nigerian data protection law remains silent on what happens to personal data after death, creating a legal vacuum that has allowed the posthumous exposure of sensitive information belonging to prominent figures. This article examines whether privacy rights should extend beyond biological death, drawing on recent high-profile cases and proposing legislative reforms to protect the deceased and their surviving families.

Nigeria's adoption of AI-powered facial recognition at major airports and automated credit scoring by digital lenders raises urgent questions about constitutional privacy protections. With Section 37 of the 1999 Constitution drafted before modern biometric surveillance existed, can its guarantee of privacy extend to algorithmic profiling and mass data collection?

When Nigerian Breweries used crowd footage from a sponsored event in its advertising campaign, it triggered a landmark data protection ruling. The Lagos High Court determined that identifiable photographs constitute personal data under Nigeria's 2023 Data Protection Act, and that generic venue notices cannot authorize commercial use of attendees' images.

The introduction of registration requirements for certain data controllers and data processors under the General Application and Implementation Directive (GAID) has significantly altered the compliance landscape of Nigeria's data protection regime. However, the registration framework has also given rise to a common misconception among organisations that fall below the prescribed registration thresholds or otherwise qualify for an exemption: namely, that exemption from registration translates into exemption from data protection obligations.