By Olumide Babalola
The “ill-considered” and nearly wholesale legal transplantation of the European
General Data Protection Regulation (GDPR) into the Nigeria Data Protection Act 2023 (NDPA) by the drafters may continue to haunt us all except the courts come to our imminent rescue. I have done an academic paper on my perceived shortcomings of the NDPA; hence this is not a regurgitation of my observations therein, but a testimony of the leeway provided by the Supreme Court in Federal Republic of Nigeria v. Nnamdi Kanu (2024) 11 NWLR (Pt. 1949) 231 towards the enforcement of privacy rights breached during criminal investigation and/or arrests.
Copying and pasting under the NDPA
The drafters of NDPA copied many ‘interesting’ provisions of the GDPR without interrogating the reasons for such inclusion or the availability of safeguards. The one relevant to this article is the provision of section 3(2)(a) of the NDPA which exempts the application of the Act from processing activities “carried out by a competent authority for the purposes of the prevention, investigation, detection, prosecution, or adjudication of a criminal offence or the execution of a criminal penalty, in accordance with any applicable law”
This provision is copied from article 2(2)(d) of the GDPR which exempts the regulation from personal data processing by “competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”
Unlike the NDPA which squarely exempts its provisions from criminal investigation etc, the GDPR provides an understandable basis and somewhat justification for such exemption. For context, recital 19 explains that there exists a dedicated legislation regulating the processing of personal data for prevention, investigation etc of criminal activities. (see Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data and repealing Council Framework Decision 2008/977/JHA).
So rather than copy the exemption provision from the GDPR without adequate qualifications, the drafters of the NDPA ought to have considered the absence of any dedicated Nigerian legislation on processing data for criminal investigations especially considering our law enforcement agents’ propensity to routinely violate fundamental rights. This was acknowledged by the Supreme Court in Kanu’s case (supra) that: “… criminal law enforcement officers routinely engage in unlawful actions and brazen violations of the fundamental rights of suspects in the investigation and prosecution of virtually all criminal complaints coming to them.” (page 378 para E)
Redress for privacy breach during criminal investigation
Regardless of the exemption provision in the NDPA, the Supreme Court’s decision in FRN v Kanu (supra) represents a ray of hope to victims of privacy violations during police investigations or arrest. In that case, Nnamdi Kanu who was arrested in Kenya, taken to Nigerian and charged for various offences before the Federal High Court, filed an objection seeking to quash the charges on the ground that his extra-judicial arrest violated his right to privacy among other grounds. When the matter got to the Supreme Court, the apex court interestingly held that:
“So the established caselaw in Nigeria is that violations of the fundamental rights of an accused and any illegality in pre-trial or extrajudicial processes in relation to an accused should not affect the jurisdiction of the court to try the ensuing criminal case and the validity or such case. That is the basis for the admission of relevant evidence obtained from illegal searches and seizures or searches and seizures that violate the accused’s fundamental right to privacy. In Nigeria, there is hardly any case where the jurisdiction of a court to try a case is declared to be ousted by or the validity of the case declared vitiated by the unlawful arrest and detention of an accused at the pre-trial stage of the case or by any unlawful extrajudicial actions of the prosecution after arraignment during the pendency of criminal proceedings in court. … But the reality in the Nigeria peculiar situation is that no allegation of commission of a crime would be tried, if the courts decline jurisdiction to try a criminal case or invalidate it because of the violations of the fundamental rights of the accused and other unlawful actions of the prosecution that occurred in the process of investigating a criminal complaint against him or in the process of initiating the criminal case arising from such complaint or in the process of bringing him to court or in dealing with him in while he is standing trial in court. I think that the better judicial response is to hold the lawless law enforcement officers personally liable in damages and other remedies by civil actions and institutional administrative disciplinary measures and allow the prosecution and trial of the allegation of commission of crime to continue in accordance with the due process of law so that the objectives of law and society of effective criminal law enforcement is not defeated.”
In light of the foregoing, it is evident that while the Supreme court recognizes the importance of unthwarted investigations and prosecution in national interest, this does not obliterate citizens entitlement to their right to privacy. Instead, the court emphasizes the need for accountability by holding erring law enforcement officers personally liable through civil remedies and institutional disciplinary measures. This approach ensures that while objective of criminal justice – ensuring that allegations of crime are adjudicated upon – remains uncompromised, the sanctity of fundamental right (especially privacy) is also protected in the process. Consequently, the proper recourse for an accused person who has suffered privacy violations lies in seeking appropriate civil redress in fundamental rights suit. Hence, the intervention above clearly pronounces on the liability of errant officers for privacy violations during crime prevention or investigation.