The Nigeria Data Protection Commission (NDPC) has secured a legal victory confirming its authority to register data controllers and processors of major importance (DCPMIs).

In a judgment delivered by Justice Friday Ogazi of the Federal High Court, Lagos, in Emmanuel Harunna v. NDPC, the court dismissed a suit seeking to restrain the commission from registering point of sale (POS) agents and key data processors.

In a statement yesterday by the NDPC Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, the court ruled that NDPC’s regulatory oversight strengthens data security and upholds citizens’ constitutional rights to privacy.

It further reaffirmed that the Nigeria Data Protection Act, 2023, overrides any conflicting laws concerning personal data handling.

Following the ruling, NDPC National Commissioner, Dr Vincent Olatunji, has ordered all unregistered major data controllers and processors to register forthwith or risk statutory penalties.

According to the court, “the Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. Registration enables the respondent to identify entities engaged in significant data processing activities and monitor compliance.

“Far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.”

Among others, it noted that “There is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of section 45 of the 1999 Constitution.”

Meanwhile, to ensure full compliance with the judgment, the NDPC National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed all DCPMIs that are yet to register with the Commission to do so forthwith or face serious legal liabilities.