THE Nigeria Data Protection Commission (NDPC) has secured a legal victory confirming its authority to register Data Controllers and Processors of Major Importance (DCPMIs).

In a judgment delivered by Hon. Justice F.N. Ogazi at the Federal High Court, Lagos (Emmanuel Harunna v. NDPC), the court dismissed a suit seeking to restrain the Commission from registering Point of Sale (POS) agents and key data processors.

In a statement, Tuesday, signed by NDPC Head, Legal, Enforcement & Regulations, Babatunde Bamigboye, the court ruled that NDPC’s regulatory oversight strengthens data security and upholds citizens’ constitutional rights to privacy. Further, the court re-affirmed that the Nigeria Data Protection Act, 2023 overrides any conflicting laws concerning personal data handling.

Following the ruling, NDPC National Commissioner, Dr Vincent Olatunji, has ordered all unregistered major data controllers and processors to register forthwith or risk statutory penalties.

The court memorably held that: “The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance, far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanism designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.

“Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of section 45 of 1999 Constitution…. Remarkably, Section 65 of the Data Protection Act provides that the provisions of the Act shall prevail over any other law inconsistent with its provisions on matters relating to the processing of personal data.”

The Commission appreciated the advancement of the jurisprudence relating to data accountability in Nigeria as demonstrated in this case.

To ensure full compliance with the judgment of the court, the NDPC’s National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed all DCPMIs that are yet to register with the Commission to register forthwith.

Olatunji said failure to register creates serious legal liabilities under the law; while compliance with registration requirements builds public trust and safeguards fundamental rights and freedoms of data subjects in Nigeria.