Guidance Notice on registration of controllers of major importance: Digital Rights Lawyer sues the Nigeria Data Protection Commission (NDPC)
A digital rights lawyer based in Kaduna, Mr Frank Ijege has challenged the powers of the NDPC to issue the Guidance Notice on registration of controllers in a verbose and far-reaching manner. In suit No. FHC/KD/CS/34/2024 between Frank Ijege and Nigeria Data Protection Commission filed at the Kaduna Division of the Federal High Court, the Applicant claims the following reliefs:
1. A DECLARATION that the Respondent’s Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 interferes and is likely to further interfere with the Applicant’s right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria 1999.
2. A DECLARATION that the Respondent’s Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 is confusing and it requires further clarification.
3. A DECLARATION that by virtue of section 65 of the Nigeria Data Protection Act 2024, NOT ALL individuals or entities are data controllers or processors of major importance
4. A DECLARATION that paragraphs 1(2); paragraph 2(2)(f) and (h); paragraph 2(3)(g) and (i); paragraph 3(1)(e)(i); and paragraph 3(1)(e)(iv) of the Respondent’s Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 are ultra vires, null and void.
5. A DECLARATION that the Respondent ought to provide clarity on the entities exempted from the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 is confusing and it requires further clarification.
6. AN ORDER mandating the Respondent to prescribe entities who fall under the category of controllers/processors NOT of major importance as contemplated by section 48(3)(b) of the Nigeria Data Protection Act, 2023.
7. AN ORDER striking out paragraph 1(2); paragraph 2(2)(f) and (h); paragraph 2(3)(g) and (i); paragraph 3(1)(e)(i); and paragraph 3(1)(e)(iv) of the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24.
8. PERPETUAL INJUNCTION restraining the Respondent and/or its agents from mandating individuals and/or entities to register without first prescribing controllers not of importance as contemplated under section 48(3)(b) of the Nigeria Data Protection Act, 2023
9. CONSEQUENTIAL ORDER(S) that this honourable court may deem fit to grant in this suit.
In the written address, the applicant argues that the NDPC lacks powers to designate all controllers and processors as “of major importance” and particularly challenged paragraphs 1(2); 2(2)(f) and (h); 2(3)(g) and (i); 3(1)(e)(i); 3(1)(e)(iv) of the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance as ultra vires, null, void and should be struck out. The suit is yet to be assigned to any Judge in the division.
