A Federal High Court sitting in Kaduna has mandated the Nigeria Data Protection Commission(NDPC) to provide clarity on the entitles exempted from the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance.
The court made the order while delivering judgment in an Originating Motion filed by Frank Ijege seeking a declaration of the court that the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GNNOL.02/24 issued by the NDPC interferes with his right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria 1999.
Some of the reliefs sought by the applicant are in the suit argued before Justice Aikawa were;
A declaration that contrary to the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24, issued by the NDPC, not all individuals or entities are data controllers or processors of major importance.
A declaration that the NDPC ought to provide clarity on the entitles exempted from the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24.
An order mandating the NDPC to prescribe entities who fall under the category of controllers/processors NOT of major importance.
In his judgment, the Honourable Court held as follows:
On the whole therefore. I find merit in this action. Accordingly. l hereby grant the following reliefs:
- I hereby declare paragraph that 1 (2); paragraph 2(2) (f) and (h); paragraph 2(3)(g) and (i ); paragraph 3 (1 )(e)(i); and paragraph 3( 1 )(e)(iv) of the Respondent’s Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 are ultra vires, null and void.
- That I hereby declare that the Respondent ought to provide clarity on the entitles exempted from the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 1s confusing and it requires further clarification,
- That I hereby order mandating the Respondent to prescribe entities who fall under the category of controllers/processors NOT of major importance as contemplated by section 48(3)(b) of the Nigeria Data Protection Act, 2023.
- That I hereby order the striking out paragraph 1(2); paragraph 2(2) (f) and (h); paragraph 2(3)(g) and (i); paragraph 3(l)(e)(i); and paragraph 3(l)(e)(iv) of the Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24.