Lawyer Challenges NPDC’s Bid To Register Law Firms, Other Sundry Data Controllers, Seeks Court Declaration Of Notice Of Illegal Overreach

A legal practitioner, Jonathan Agbo, has filed a lawsuit seeking to halt the Nigeria Data Protection Commission (NDPC) from registering all data controllers and processors, including law firms.

In Suit No. FHC/IB/CS/18/2024 submitted on February 14th, 2024, Agbo contends that the NDPC’s notice requiring universal registration overreaches the Commission’s legal authority.

In the suit, Jonathan asked the court to resolve the following questions:

i. Whether or not by the combined interpretation of sections 5(d), 44 and 65 of the Nigeria Data Protection Act 2023, the Respondent can issue blanket notice(s) to all controllers to register with it without first designating controllers and processors of major importance?

ii. Whether or not by the interpretation of section 65 of the Nigeria Data Protection Act 2023, Law Firms qualify as controllers or processors of major importance?

iii. Whether or not by the combined interpretation of section 37 of the Constitution of the Federal Republic of Nigeria, 1999 and section 1(1) of the Nigeria Data Protection Act 2023, a breach of any of the provisions of the Nigeria Data Protection Act, 2023 and Nigeria Data Protection Regulation 2019 constitute an interference with the right to privacy?

As a consequence of the prayers, the Lawyer seeks the following relifes:

1. A DECLARATION that the Respondent’s notice requiring all controllers including the Applicant to register with the Respondent is likely to interfere with the Applicant’s right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria 1999

2. A DECLARATION that by virtue of section 65 of the Nigeria Data Protection Act 2023, Law Firms do not qualify as data controllers or processors of major importance

3. A DECLARATION that by virtue of section 5(d) and 44 of the Nigeria Data Protection Act 2023, the Respondent lacks the powers to register all controllers except the controllers and processors of major importance.

4. A DECLARATION that by the combined provisions of sections 44 and 65 of the Nigeria Data Protection Act 2023, until the Respondent designates controllers and processors of major importance, it cannot exercise its powers of registration over all types of controllers and processors.

5. A DECLARATION that the Respondent’s call for registration without prescription of controllers and processors of major importance is ultra vires.

6. PERPETUAL INJUNCTION restraining the Respondent from requiring the Applicant’s Law Firm to register under the Act.

7. PERPETUAL INJUNCTION restraining the Respondent from registering controllers and processors until it has issued notices designating controllers and processors of major importance.

8. CONSEQUENTIAL ORDER(S) that this honourable court may deem fit to grant in this suit.

The case is yet to be assigned to any judge in the divison.