Internet Platform Regulation in Nigeria: Data Privacy and Fundamental Rights

The second challenge internet platforms face in Nigeria, relates to the early development of data protection law in Nigeria. Data protection law in Nigeria is developing, in part, through human rights organisations seeking declarations from the courts that violations of data protection rights were actionable as violations of the constitutional right to privacy under section 37 of the Constitution.

Nigeria does not have a separate constitutional right to data protection in the manner in which the European legal framework has developed the right to data protection. The Nigerian courts have, however, accepted that data privacy can generally be enforced through the constitutional right to privacy under section 37. The implications of such broad formulations are quite significant for internet platforms in Nigeria.

First, fundamental-rights proceedings enjoy a relatively accelerated procedure in Nigeria. The Fundamental Rights (Enforcement Procedure) Rules contemplate an expedited process, with the respondent generally required to be served with the originating processes and hearing notice not less than five days before the hearing. This is very different from the ordinary pace of commercial litigation. Human rights litigators understand the strategic value of this and frequently use the fundamental-rights procedure where they believe that a matter can properly be brought within the constitutional framework.

This also changes the litigation strategy available to claimants. A claimant does not necessarily have to wait for the data protection regulator to investigate or for the regulator to take enforcement action before approaching the courts. Where the facts support it, the claimant can seek to enforce the alleged privacy violation directly as a fundamental right.

Second, once a data privacy complaint is framed as a violation of a fundamental right, the range of conduct that can potentially become the subject of constitutional litigation becomes considerably wider. The issue is no longer limited to whether a company has breached a particular provision of the data protection legislation. The claimant may seek to establish that the conduct itself amounts to an infringement of the constitutional right to privacy. This has produced some interesting litigation. Nigerian courts have been asked to consider, among other things, whether the absence or inadequacy of a privacy policy can constitute an infringement of the constitutional right to privacy. Human rights NGOs have brought privacy-related complaints as fundamental rights actions, alleging that the failure of a company to have an appropriate privacy policy amounted to an infringement of the constitutional right to privacy.

Third, an internet platform may think that the appropriate consequence of a deficient privacy notice, an unlawful processing activity or another data-protection failure is a regulatory investigation or a claim under the data-protection legislation. In Nigeria, the same conduct can potentially become a fundamental rights action.

Fourth, a global platform may have a sophisticated privacy programme designed around the GDPR, U.S. privacy laws and other international regimes. However, that does not necessarily answer the Nigerian constitutional question. The platform must also consider how a Nigerian claimant may frame the same conduct under section 37 of the Constitution, the Nigeria Data Protection Act and the Fundamental Rights Enforcement Procedure.

For internet platforms in Nigeria, this means that data protection compliance in Nigeria should not be approached solely as a regulatory compliance exercise. It is also a constitutional litigation risk. In Nigeria, a data-protection problem can therefore become a fundamental-rights problem.

Next in the series

This is Part 2 of Balogun Harold's three-part series on Internet Platform Regulation in Nigeria. In Part 3, we consider the development of data protection law in Nigeria and how data privacy claims can become fundamental rights claims against internet platforms.

Read Part 3: Internet Platform Regulation in Nigeria: Intermediary Liability & Publisher Immunity