IN THE HIGH COURT OF IMO STATE OF NIGERIA
IN THE HIGH COURT OF OWERRI JUDICIAL DIVISION
HOLDEN AT HIGH COURT OF JUSTICE, OWERRI
THIS THURSDAY THE 31ST DAY OF OCTOBER, 2024
BEFORE HIS LORDSHIP: – HON. JUSTICE I. M. NJAKA
SUIT NO. HOW/977/2023
BETWEEN:
EMMANUEL T. OKPARA ESQ. APPLICANT
AND
GREEN AFRICA AIRWAYS LIMITED
PAYSTACK PAYMENTS LIMITED RESPONDENTS
JUDGMENT
By ORIGINATING SUMMONS BROUGHT PURSUANT TO:
- SECTION 37 OF THE CONSTITUTION OF THE FEDERAL REPUBLIC OF NIGERIA, 1999
- SECTIONS 24(1); 27(1), (3); 29(1)(C); 32; 39; 40(2)(3); 53(2) AND 65 OF THE NIGERIA DATA PROTECTION ACT 2023.
- ARTICLES 4.1(2) (6) OF THE NIGERIA DATA PROTECTION REGULATION 2019, AND (AS AMENDED)
- ORDER 2, RULES 2-4 OF THE FUNDAMENTAL RIGHTS ENFORCEMENT PROCEDURE RULES 2009; AND
- UNDER THE INHERENT JURISDICTION OF THIS HONOURABLE COURT
The Applicant sought for the determination of the following questions:
- Whether or not by the interpretation of section 37 of the Constitution of the Federal Republic of Nigeria, 1999, a breach of any of the provisions of the Nigeria Data Protection Act, 2023 and Nigeria Data Protection Regulation 2019 constitute an interference with the right to privacy?
- Whether or not by the interpretation of sections 24(1)(c) of the Nigeria Data Protection Act 2023, the Respondents’ multiple requests for different accounts from the Applicant for just one purpose does not violate the principle of purpose limitation and obligation to limit collection of information to adequacy and relevance?
- Whether or not by the interpretation of sections 24(1)(a) of the Nigeria Data Protection Act 2023, the Respondents’ multiple requests for different accounts from the Applicant without solving the problem does not violate the principle of fairness?
- Whether or not by the interpretation of sections 24(1)(a) and 27(1) of the Nigeria Data Protection Act 2023, the Respondents’ collection and storage of the Applicant’s personal data in a database without providing due information to customers or publication of their privacy notices violates the principle of transparency and obligation to provide information to data subjects?
- Whether or not by the interpretation of article 4.1(7) of the Nigeria Data Protection Regulation 2019, the Respondents’ omission to file a data protection compliance audit since 2020 constitutes a breach of their obligation which impacts the right to privacy.
- Whether or not in the event that this court finds the Respondents to have interfered with the Applicant’s right to privacy, the Applicant is entitled to damages without necessarily proving pecuniary losses?
Based on the outcome of the question, the Applicant prays for the following reliefs:
- A DECLARATION that the Respondents’ collection and storage of the Applicant’s personal data in a database, without his consent or due information on data security interferes and/ or likely to further interfere with the Applicant’s right to privacy guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999.
- A DECLARATION that the Respondents’ processing of Applicant’s personal data without compliance with the provisions of the Nigeria Data Protection Act, 2023 and Nigeria Data Protection Regulation 2019 constitute an interference with the Applicant’s right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria, 1999.
- A DECLARATION that the Respondents’ collection and storage of the Applicant’s personal data in a database with an (undisclosed) software violates the principle of transparency provided under section 24(1)(a) of the Nigeria Data Protection Act, 2023.
- A DECLARATION that the Respondents’ collection and storage of the Applicant’s personal data in a database with an (undisclosed) software breaches the Respondents’ obligations to provide adequate information to the Applicant at the time of collection of his personal data in contravention of section 27(1) of the Nigeria Data Protection Act, 2023.
- A DECLARATION that the 1st Respondents’ request for the Applicant’s personal information before processing a refund violates the principle of data minimization provided under section 24(1)(c) of the Nigeria Data Protection Act, 2023.
- A DECLARATION that the Respondents’ collection of two account numbers of the Applicant, without effecting refunds to the Applicant violates the principle of fairness provided under section 24(1)(a) of the Nigeria Data Protection Act, 2023.
- A DECLARATION that the omission or lack of a privacy policy on the 1st Respondents’ website -“https: //www.greenafrica.com/en-us/”, violates the express provision of section 27(3) of the Nigeria Data Protection Act, 2023.
- A DECLARATION that the Respondents’ collection and storage of the Applicant’s personal data in a database with an (undisclosed) software breaches the Respondents’ obligations to provide adequate information to the Applicant at the time of collection of his personal data in contravention of section 27(1) of the Nigeria Data Protection Act, 2023.
- A DECLARATION that the 2d Respondent’s failure to comply with mail titled “Refund processed for transaction” it sent the Applicant on the 10h August, 2023 and withholding of the Applicant’s funds contrary to his demands, is unlawful and has caused the Applicant untold hardship.
- A DECLARATION that the Respondents’ omission to file a data protection compliance audit since 2020 is a violation of the provision of article 4.1(7) of the Nigeria Data Protection Regulation 2019.
- PERPETUAL INJUNCTION restraining the Respondents from further processing (storing and using) the Applicant’s personal data without compliance with the provisions of the Nigeria Data Protection Act, 2023 and Nigeria Data Protection Regulation 2019.
- AN ORDER that the Respondent refund to the Applicant’s account forthwith the sum of N132,000 (One Hundred and Thirty-Two Thousand Naira Only) being the some paid by the Applicant for flight and acknowledged by the Respondents for refund.
- DAMAGES in the sum of N200, 000, 000 (Two Hundred Million Naira).
- CONSEQUENTIAL ORDER(S) that this honourable court may grant in the circumstances.
The GROUNDS UPON WHICH RELIEFS ARE SOUGHT:
- The Applicant is a Nigerian citizen.
- The Applicant is guaranteed the enjoyment of the fundament right to privacy which includes data protection under Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) and relevant provisions of the Nigeria Data Protection Act 2023 and Nigeria Data Protection Regulation 2019.
- The Respondents collected, used and stored the Applicant’s personal data in a software database for their business.
- The 2nd Respondent collected, used and stored the Applicant’s personal data in a software database without the Applicant’s consent.
- The Respondents’ continued non-compliance with relevant privacy laws continues to put the Applicant at risk of privacy invasion, data misuse and data compromise.
In the affidavit filed by Emmanuel T. Okpara, Esq. in support of his application, Emmanuel T. Okpara, booked a flight for himself and his wife on the 1st Respondent’s website to attend a conference in Abuja. During the booking process, he was prompted to enter personal details without being shown a privacy policy. He made the payment via a transfer to Paystack (2nd Respondent), without being informed about data collection, storage, or his data rights.
On July 31, 2023, he received a notification that the flight had been canceled, with no immediate follow-up from the airline’s customer service. The Applicant initiated contact via email, demanding a refund and compensation for the inconvenience caused by the flight cancellations. The Respondents offered a discount on a future flight instead of a refund and denied his claim for compensation.
The 2nd Respondent sent an email titled “Refund processed for transaction,” indicating that a refund would be made within 7 to 12 working days. However, the refund was not processed as promised. The Applicant repeatedly communicated with Mr. Gbenga O. Ajibode Esq., representing the 1st Respondent, who claimed that the delay was due to conflicting account details. The Respondents requested multiple account numbers from the Applicant, but the refund remained unprocessed despite the Applicant providing the requested information.
The Applicant highlighted that there was no privacy policy on the 1st Respondent’s website at the time of booking, indicating a lack of transparency in their data practices. He expressed concerns that his personal data was collected and stored without his consent or adequate disclosure of data management procedures. The Applicant noted that the Respondents had failed to file data protection compliance audits as required by the Nigeria Data Protection Regulation (NDPR) 2019.
The Applicant claims that the Respondents’ actions have caused him economic, emotional, psychological, and mental distress due to the mishandling of his sensitive personal data. He argues that the lack of privacy safeguards exposes him to the risk of data misuse and manipulation, causing him significant anxiety.
As a legal practitioner with knowledge of data protection laws, the Applicant referenced a Federal High Court ruling emphasizing the importance of privacy policies and compliance with data protection obligations. He believes that the Respondents’ non-compliance with data protection laws directly violates his right to privacy as protected under the Nigerian Constitution.
The Applicant provided several pieces of evidence in support of his claims, including screenshots of email communications, details of the website with no privacy policy, and a Federal High Court judgment relating to privacy rights. He asserts that the evidence was generated and printed using properly functioning devices at his office.
In the opinions presented by the Counsel, in support of the application, it is stated that the case is brought pursuant to Section 37 of the Nigerian Constitution, the Nigeria Data Protection Act 2023, and the Nigeria Data Protection Regulation 2019.
The counsel highlights that the right to privacy under Section 37 of the Constitution encompasses data protection, as previously affirmed by Nigerian courts. The Applicant’s case is supported by a 34-paragraph affidavit with six exhibits, which the counsel relies on to substantiate the claims.
The counsel identifies six main issues for determination, focusing on whether the Respondents’ actions constitute a breach of the Applicant’s right to privacy and whether the data processing principles outlined in the NDPA and NDPR were violated.
Issue I: Breach of the Right to Privacy under the Constitution
Counsel argues that Section 37 protects the right to privacy, which includes the protection of personal data, as established in the case of Incorporated Trustees of Digital Rights Lawyers Initiative v. National Identity Management Commission.
It is emphasized that the NDPR and NDPA are legal instruments that expand on the constitutional right to privacy by regulating the processing of personal data.
The Applicant’s counsel refers to Federal High Court decisions confirming that data protection is part of the right to privacy. They stress that data protection laws serve to safeguard citizens’ personal data against misuse, aligning with constitutional guarantees.
The counsel contends that the Respondents’ collection and storage of the Applicant’s data without proper consent and disclosure interferes with his right to privacy. Lack of transparency and failure to inform the Applicant about data usage are argued to be clear violations of his privacy rights.
Issue II: Violation of the Principle of Purpose Limitation
Definition of Purpose Limitation:
Under Section 24(1)(c) of the NDPA, personal data must be collected for a specific, well-defined purpose, and its use must be limited to that purpose. The Respondents’ repeated requests for different bank account details from the Applicant, despite having sufficient information to process the refund, are cited as violations of this principle.
The counsel argues that processing personal data without a defined purpose or for speculative future use is unlawful under data protection laws. They submit that the Respondents’ demands for multiple account details lack justification and violate the obligation to limit data collection to what is necessary.
Issue III: Violation of the Principle of Fairness
Fair and Transparent Processing:
Section 24(1)(a) of the NDPA requires that personal data be processed in a fair, lawful, and transparent manner.
The counsel highlights that the Respondents’ actions in repeatedly requesting different account details from the Applicant, without resolving the refund issue, demonstrate a lack of fairness. The principle of fairness implies that data controllers should act in ways that align with the data subject’s expectations and should be transparent about their data processing activities. The counsel submits that the Respondents’ failure to promptly and transparently handle the refund process is both unfair and unethical, breaching their obligations under the data protection laws.
The counsel stresses that data protection laws like the NDPA and NDPR further the constitutional right to privacy by imposing specific obligations on data controllers and processors. The protection of personal information is argued to be a fundamental aspect of citizens’ autonomy and control over their personal data. Counsel highlights that insufficient data security practices by the Respondents expose the Applicant to risks like identity theft, financial fraud, and cyberstalking.
The absence of a privacy policy on the Respondents’ website is cited as evidence of their failure to safeguard personal data in compliance with legal standards. Non-provision of information about the collection and use of personal data interferes with the data subject’s ability to make informed decisions, such as the right to object or withdraw consent. The Applicant’s lack of knowledge about the processing of his data robs him of control over his personal information, which is argued to be a direct violation of his privacy rights.
The counsel urges the court to find that the Respondents’ actions have unlawfully interfered with the Applicant’s right to privacy as guaranteed under Section 37 of the Constitution. They request that the court hold that the Respondents violated the principles of purpose limitation, transparency, and fairness under the NDPA and NDPR. The counsel emphasizes that the Applicant is entitled to damages for these breaches of his privacy rights, even without proving specific financial losses.
The Applicant’s counsel argues that the Respondents’ actions constitute a violation of both constitutional rights and statutory obligations related to data protection. They assert that the Respondents failed to adhere to the principles of purpose limitation, fairness, and transparency in their handling of the Applicant’s personal data. The counsel relies on court precedents and statutory provisions to support their argument that data protection is inherently linked to the right to privacy, and they urge the court to award damages and other appropriate reliefs to the Applicant.
Issue IV: Violation of Transparency Obligations and Data Subject Information
The Applicant’s counsel points out that Sections 24(1)(a), 27(1), and 27(3) of the NDPA require data controllers to process personal data in a fair, lawful, and transparent manner. Before collecting personal data, the data controller must inform the data subject of critical information, such as the purpose of processing, the recipients of the data, retention period, and the data subject’s rights. The counsel argues that the Respondents did not provide the Applicant with a privacy policy or any information regarding their data processing practices, which is a clear breach of their transparency obligations.
Section 27(3) specifically mandates that information should be conveyed through a privacy policy that is clear, concise, and easily accessible, which the Respondents failed to provide. The counsel references court rulings, such as Incorporated Trustees of Digital Rights Lawyers Initiative v. Minister of Industry, Trade, and Investment, which highlight the importance of privacy policies in protecting data subjects’ rights.
It is emphasized that the absence of a privacy policy threatens the Applicant’s right to privacy as guaranteed under Section 37 of the Nigerian Constitution.
The counsel stresses that the legal burden has shifted to the Respondents to prove their compliance with data protection laws since the Applicant has already provided affidavit evidence showing the lack of transparency.
Issue V: Omission to File Data Protection Compliance Audit
The counsel refers to Article 4.1(7) of the NDPR, which obligates data controllers processing the personal data of more than 2,000 subjects annually to submit a data protection audit. The Respondents, being large-scale service providers, have failed to file these mandatory audits, which is a violation of their legal obligations under data protection laws.
This failure to conduct compliance audits is argued to increase the risk of privacy breaches for the Applicant and other data subjects. Non-compliance with these regulations also exposes the Respondents to possible fines and penalties as per the provisions of the NDPA and NDPR.
Issue VI: Entitlement to Damages Without Proof of Pecuniary Loss
The counsel cites Section 48(2)(b) of the NDPA, which entitles data subjects to compensation for any injury, loss, or harm suffered due to a violation of data protection laws.
The Applicant claims emotional, psychological, and mental distress due to the mishandling of his personal data by the Respondents.
The counsel references multiple cases, including Skye Bank Plc v. Emerson Njoku & Ors, where the court held that damages are automatically awarded for the violation of fundamental rights, even in the absence of financial loss. Other cases, such as Okoro v. Commissioner of Police Enugu State & Anor, highlight that any breach of constitutional rights, regardless of duration or direct financial impact, warrants compensation.
The counsel argues that the Respondents’ repeated requests for account details without resolving the issue and the lack of transparent communication violated the Applicant’s right to privacy. It is emphasized that, under Nigerian law, compensation for such a violation is justified to serve as redress for the injury to the Applicant’s dignity and discomfort caused by the data mishandling.
The counsel concludes that the Respondents’ actions—specifically, the failure to provide transparent data handling practices, omission to conduct required compliance audits, and mishandling of the Applicant’s personal data—constitute a violation of the Applicant’s right to privacy as enshrined in the Nigerian Constitution and data protection laws. It is respectfully submitted that the Applicant is entitled to damages for the violation of his right to privacy without necessarily proving any pecuniary losses. This position is supported by both statutory provisions and numerous legal precedents.
In the Further Affidavit filed by Emmanuel T. Okpara, Esq. in response to the 1st Respondent’s Counter Affidavit, the Applicant maintains that the 1st Respondent did not have a privacy policy on its website at the time he interacted with it, contradicting the Respondent’s claim that a privacy policy existed since 2018. He asserts that the privacy policy was added to the website as an afterthought to deceive the court and counter his claims.
The Applicant argues that the 1st Respondent’s claim of having a privacy policy in 2018 is implausible since the Nigeria Data Protection Regulation (NDPR), which mandates such policies, was only issued in 2019. He further states that the Respondent’s exhibit showing a screenshot of the privacy policy is not reliable or accurate since it is not a direct printout from the website. The Applicant highlights specific pages on the 1st Respondent’s website (e.g., flight selection, information, baggage, and seat selection pages) where no privacy policy links were present. He annexes evidence in the form of printouts from these pages to support his claim. He argues that even if a privacy policy link was added, it was not present on the pages where his personal data was actually collected.
The Applicant points out that the 1st Respondent did not appoint or provide information about a Data Protection Officer (DPO), which is required under data protection laws. He claims that the 1st Respondent ignored his email inquiry about the status of his personal data, further demonstrating their non-compliance with their own privacy policy. The Applicant asserts that the privacy policy presented by the 1st Respondent indicates they did not obtain valid consent from him before processing his personal information, which is a breach of data protection laws. Contrary to the 1st Respondent’s claims, the Applicant states that he did not receive any money from the 1st or 2nd Respondent until the 27th of October, 2023, more than a month after his refund request.
He also points out inconsistencies in the transaction ID on his bank statement and the ID claimed by the Respondents, indicating a discrepancy in their records. The Applicant highlights contradictions in the 1st Respondent’s statements regarding their access to his account details. They initially claimed to have the information but later stated that the data was masked and not visible to them. He argues that the Respondent ignored the account details he had provided in his initial demand letter, demonstrating negligence in processing his refund.
The Applicant states that data protection audit reports are public documents and should be easily accessible through the Nigeria Data Protection Commission (NDPC) website, yet the 1st Respondent has not filed any such reports.
The Applicant reiterates that the 1st Respondent’s failure to comply with data protection laws, such as filing audit reports and maintaining transparent data practices, is a clear violation of his rights to data protection and privacy.
He claims that due to the 1st Respondent’s mishandling of his personal data and the delay in processing his refund, he suffered financial losses, emotional distress, and inconvenience. The Applicant emphasizes that he was forced to incur significant costs to file this lawsuit and take legal action to protect his rights, highlighting the Respondent’s disregard for proper data handling.
The Applicant concludes that his suit was commenced through a legally recognized mode and is properly before the court, countering any claims by the 1st Respondent challenging the suit’s validity.
The Applicant’s Further Affidavit in response to the 1st Respondent’s Counter Affidavit refutes the Respondent’s claims of compliance with data protection laws. The points include allegations of the Respondent’s deception regarding the existence of a privacy policy, failure to appoint a Data Protection Officer, inconsistent handling of the refund, and general non-compliance with transparency and data protection requirements. The affidavit further asserts that these breaches caused the Applicant financial and emotional harm, necessitating legal action to seek redress for the violations of his privacy rights.
In the Applicant’s Reply on Points of Law and Response to the Preliminary Objection raised by the 1st Respondent, the Applicant addresses the legal arguments questioning the validity of the procedure used to initiate the suit.
The 1st Respondent argued that the suit was improperly commenced using the wrong procedure. In response, the Applicant cites Order II Rule 2, 3, and 5 of the Fundamental Rights Enforcement Procedure Rules (2009), which allows the use of any originating process accepted by the court for enforcement of fundamental rights, without needing prior leave of the court. The Applicant states that an Originating Summons was used, which is a valid originating process recognized by Order 3 Rule 5 and 6 of the High Court of Imo State (Civil Procedure) Rules 2017.
The Applicant confirms that the Originating Summons was accompanied by all necessary documents, including a statement of the Applicant’s details, the relief sought, grounds for the application, a 34-paragraph affidavit, and a Counsel’s Address in support of the application. Based on these submissions, the Applicant argues that the suit has been initiated through the correct legal process and is therefore properly before the court.
The Applicant refers to Section 25(1)(a) of the NDPA, which requires that data processing must be based on the data subject’s consent, provided the consent has not been withdrawn. Section 26 of the NDPA outlines that the burden of proof lies with the data controller (in this case, the 1st Respondent) to establish that consent was obtained freely, specifically, and with clear communication to the data subject.
The Applicant emphasizes that for consent to be considered valid under Section 65 of the NDPA, it must be: Freely given, without coercion or undue influence. Informed and specific, with a clear understanding of the data controller’s identity, purpose of data collection, and processing activities. Unambiguous, requiring affirmative action from the data subject, such as a clear opt-in mechanism.
The Applicant cites decisions from the European Court of Human Rights (ECTHR) and the Court of Justice of the European Union (CJEU), highlighting the importance of obtaining specific and active consent for data processing.
In cases such as Bundesverband der Verbraucherzentralen und Verbraucherverbände v Planet49 GmbH, the court ruled that a pre-ticked checkbox does not constitute valid consent because it does not involve active behavior from the data subject.
The Applicant argues that the 1st Respondent did not seek or obtain the necessary consent from him before processing his personal data, which is a direct violation of the NDPA. It is also pointed out that the Respondent’s use of previously collected information without consent to process the refund constitutes a breach of data protection principles.
The Applicant stresses that when he initially provided his account details for a refund, he did not expect his personal data to have already been collected and processed without his knowledge or consent. The Applicant contends that this practice by the 1st Respondent exemplifies a disregard for data protection laws and principles, further violating his rights.
The Applicant emphasizes that under Section 26 of the NDPA, the data subject must be informed of their right to withdraw consent at any time, which was not done by the 1st Respondent in this case. This lack of information regarding the right to withdraw consent highlights the Respondent’s non-compliance with data protection laws.
The Applicant also argues that consent is personal and non-transferable, meaning that a data subject cannot give consent on behalf of another individual or contact, which further undermines the validity of the Respondent’s data processing practices.
The Applicant refers to case law, such as c, where the court held that data processing without consent constitutes a violation of data protection rights. These cases underscore the legal requirement that data controllers must actively seek and obtain clear, specific consent from data subjects before processing their personal data.
The Applicant concludes that the 1st Respondent’s handling of his personal data, including the collection and processing of information without valid consent, was improper and constitutes a breach of the NDPA. The Applicant urges the court to disregard the Respondent’s objections, affirm the validity of the application process, and grant the reliefs sought by the Applicant due to the 1st Respondent’s clear violations of data protection laws.
The Applicant’s Reply on Points of Law addresses the 1st Respondent’s objection to the procedural validity of the suit, asserting that the suit was properly commenced using the required legal framework. The Applicant then elaborates on the legal principles governing data protection and consent, arguing that the 1st Respondent failed to obtain his valid, specific, and informed consent before processing his personal data. By highlighting these violations, supported by statutory provisions and case law, the Applicant seeks to establish that the Respondent’s actions are unlawful and merit judicial intervention and redress.
In the Further Affidavit filed by Emmanuel T. Okpara, Esq. in response to the 2nd Respondent’s Counter Affidavit, the Applicant reiterates that his personal data was processed by the 2nd Respondent when he made a payment through its platform as required by the 1st Respondent, despite the 2nd Respondent’s denial. He emphasizes that neither the 1st nor the 2nd Respondent obtained his consent before processing his personal data, which is a fundamental violation of data protection laws.
The Applicant points out that the 2nd Respondent failed to clarify how it obtained his email address, which it used to communicate with him (as evidenced by Exhibit C). He challenges the 2nd Respondent’s claim that his email address and other details were not directly collected from him, asserting that he only provided his bank or card details for payment. The Applicant highlights discrepancies in the 2nd Respondent’s statements regarding the account details he provided during the refund process. He explains that he was initially asked to provide his Access Bank details, followed by a request for his Zenith Bank account information, creating confusion.
The repeated requests for different account details led the Applicant to believe that the Respondents were mishandling his personal information. The Applicant clarifies that he used an Opay Debit Card to make the payment, and that he was unaware of the specific bank that issued this card. He had simply received the card from Opay and began using it without knowing the backend financial details.
The Applicant disputes the 2nd Respondent’s assertion that it did not know his identity until it received his Access Bank account details. He argues that the 2nd Respondent had already sent him a communication, as seen in Exhibit C, before he even provided those details. He points out that the 2nd Respondent failed to disclose how it obtained his email address and whether it came from him or the 1st Respondent, highlighting a lack of transparency in their data handling process.
The Applicant consistently emphasizes that his personal data was processed without his knowledge or explicit consent.
He argues that the repeated and conflicting requests for different bank account details indicate poor data management and disregard for proper data handling protocols by the 2nd Respondent.
The Applicant’s affidavit highlights the failure of both the 1st and 2nd Respondents to comply with fundamental principles of data protection, particularly regarding transparency and consent. The improper collection and processing of the Applicant’s personal data without obtaining explicit consent violate the requirements of the Nigeria Data Protection Act 2023 (NDPA).
The repeated requests for different account details from the Applicant, along with the lack of clear communication regarding data collection methods, are argued to infringe upon the Applicant’s rights as a data subject. The Applicant asserts that these actions not only breached data protection laws but also caused him unnecessary confusion and inconvenience.
The Further Affidavit filed by the Applicant challenges the 2nd Respondent’s assertions regarding the handling of his personal data. The points made include the improper processing of his data without consent, the 2nd Respondent’s failure to explain how it obtained his contact information, and the inconsistencies in their data management practices. The Applicant’s response indicates that the 2nd Respondent’s actions did not comply with data protection laws, supporting his claim that his rights to privacy and data protection were violated.
In the Applicant’s Reply on Points of Law and Response to the Preliminary Objection raised by the 2nd Respondent, the Applicant addresses the 2nd Respondent’s objections concerning the validity of the suit. The 2nd Respondent argues that the Applicant’s suit fails to disclose any reasonable cause of action against it. The Applicant asserts that a reasonable cause of action exists because the 2nd Respondent processed his personal data when he was redirected to a platform where he entered his information for payment, as evidenced in Exhibit M.
The Applicant points out that the 2nd Respondent itself acknowledged sending an email to the Applicant, using the email address linked to his debit card, proving that the 2nd Respondent was aware of the Applicant’s identity and had engaged in processing his personal data.
The Applicant refers to the definition of personal data under Section 65 of the Nigeria Data Protection Act 2023 (NDPA), which includes any information that can identify an individual, directly or indirectly, through data such as a name, identification number, or online identifier. Since the 2nd Respondent processed the Applicant’s debit card information and used his email address, it engaged in data processing without obtaining his consent, which violates the data protection principles under the NDPA.
The 2nd Respondent contends that the Applicant’s case is purely contractual, relating to the cancellation of a flight and the refund of N132,000, which should not be heard under the Fundamental Rights Enforcement Procedure Rules 2009.
The Applicant clarifies that the central issue in the case is the breach of his right to privacy and data protection, not just the contractual dispute regarding the refund. He argues that the delay in refund and other contractual issues are ancillary to the fundamental rights violations caused by the unauthorized processing of his personal data. The Applicant emphasizes that when a breach of privacy rights leads to other consequences, such as economic loss or inconvenience, those claims can be pursued within the framework of a fundamental rights enforcement action.
Even if the court considers the refund claim outside the scope of fundamental rights, the Applicant argues that it does not defeat the validity of the entire suit. The court has the discretion to strike out only the relief related to the refund while proceeding with the remaining claims about data protection violations.
The 2nd Respondent objects that the suit failed to comply with Sections 97 and 99 of the Sheriffs and Civil Processes Act, which pertain to the service of court processes outside the jurisdiction. The Applicant argues that the Fundamental Rights Enforcement Procedure is sui generis (unique in nature) and is not governed by the same technical rules that apply to regular civil matters.
He cites the decision in IGP & Ors v. Julius Berger (Nig) PLC & ANOR (2018) LPELR-46121(CA), where the court held that the provisions of the Sheriffs and Civil Processes Act do not apply to fundamental rights enforcement proceedings. The Applicant contends that the purpose of service is to ensure that the party being sued is aware of the suit, and since the 2nd Respondent has already responded to the suit, any minor technical issues with service should not invalidate the proceedings.
The Applicant emphasizes that the essence of the case is the violation of his constitutional right to privacy, as protected under the Nigeria Data Protection Act 2023 and the Constitution. He argues that the court has jurisdiction to address these violations because data protection laws explicitly protect the right to privacy, making it a fundamental rights issue.
The Applicant highlights that Nigerian courts have previously held that issues relating to data privacy and protection fall within the purview of fundamental rights, allowing such cases to be brought under the Fundamental Rights Enforcement Procedure Rules.
The Applicant concludes that the suit has been properly filed under the Fundamental Rights Enforcement Procedure Rules 2009 and that it includes all necessary elements to establish a cause of action against the 2nd Respondent.
The technical objections raised by the 2nd Respondent regarding compliance with the Sheriffs and Civil Processes Act are irrelevant to fundamental rights cases, which are governed by their own procedural rules.
The Applicant urges the court to dismiss the 2nd Respondent’s preliminary objections, hear the case on its merits, and address the data protection and privacy violations alleged in the suit.
The Applicant argues that the core issue in this case is the breach of his right to privacy through the unauthorized processing of his personal data. The contractual aspects, such as the delayed refund, are secondary to this fundamental rights violation. He requests the court to focus on whether the 2nd Respondent processed his personal data without consent and to strike down the 2nd Respondent’s preliminary objections, allowing the case to proceed on its substantive issues.
In the Further and Better Affidavit filed by Emmanuel T. Okpara, Esq. in response to the 1st Respondent’s Counter Affidavit, the Applicant challenges the 1st Respondent’s claim that it had a privacy policy in place before the issuance of the Nigeria Data Protection Regulation (NDPR) 2019, pointing out that the Respondent fails to cite any specific law that required the policy at that time. The Applicant argues that it is unlikely that the 1st Respondent would have a privacy policy before the NDPR’s introduction, questioning the legitimacy of such a claim.
The Applicant points out that even the most recent version of the 1st Respondent’s privacy policy (as attached in Exhibit EK3) does not reference the Nigeria Data Protection Act 2023, despite the Act’s enforceability since July 2023. This failure to update the policy is used to argue that the 1st Respondent is not genuinely committed to complying with relevant data protection laws. The Applicant accuses the 1st Respondent of editing its website and adding new elements, such as checkboxes for accepting terms and conditions, after the Applicant raised these issues in earlier affidavits. The Applicant provides evidence that these changes were made only recently, implying that they were intended to mislead the court by creating a false impression of compliance with data protection requirements. The Applicant highlights that the original privacy policy (Exhibit EK3) provided by the 1st Respondent did not mention a Data Protection Officer (DPO) or provide contact details for such a person. It is pointed out that the 1st Respondent subsequently updated its privacy policy to include a DPO email address (dpo@greenafrica.com), suggesting that this was added solely to counter the Applicant’s claims. The Applicant calls attention to the inconsistency in the policy updates, noting that this addition was made after the initial evidence had been submitted to the court, casting doubt on the authenticity of the 1st Respondent’s practices. The Applicant maintains that he provided his account details in his initial letter of demand but the 1st Respondent repeatedly asked for different account information, which he believes demonstrates incompetence or deliberate evasion.
The Applicant notes that the transaction reference numbers provided by the 1st Respondent do not match the actual transactions on his bank statement, which raises further questions about the credibility of the Respondent’s claims. The Applicant criticizes the 1st Respondent for failing to provide any evidence of having conducted a data protection audit, despite multiple opportunities to do so.
The Applicant contrasts the 1st Respondent’s behavior with that of the 2nd Respondent, who promptly provided their data protection audit report, emphasizing that the 1st Respondent’s evasiveness highlights its lack of compliance with data protection laws.
The Applicant accuses the 1st Respondent of using special characters (such as asterisks [*]) in its privacy policy as a means to falsely imply the existence of clickable icons or legitimate data points. He points out that these characters do not constitute proper icons and were likely used to give a misleading appearance of a more robust privacy policy than actually existed.
The Applicant clarifies that he is not obligated to report any infringement of his right to privacy to the 1st Respondent before seeking redress in court. He asserts his right to take legal action directly without needing to give the Respondent an opportunity to address the issue beforehand, especially given the Respondent’s non-compliance with data protection standards.
The Applicant’s affidavit strongly emphasizes that the 1st Respondent has engaged in retroactive website alterations and policy updates solely to defend against the Applicant’s claims, which undermines the credibility of their defense. The Applicant argues that the 1st Respondent’s failure to mention or comply with current data protection laws, even in their updated privacy policy, indicates a lack of genuine effort to protect user data and comply with legal standards.
The lack of evidence regarding the appointment of a DPO and the absence of compliance with data audit requirements serve as central points in the Applicant’s criticism of the 1st Respondent’s approach to data protection. The Applicant requests the court to recognize these deficiencies and manipulations by the 1st Respondent and to proceed with the case, acknowledging the breaches of data protection and privacy laws that have been alleged.
The Further and Better Affidavit reinforces the Applicant’s position that the 1st Respondent has acted in bad faith by tampering with its privacy policy and website content to appear compliant with data protection laws. It also highlights the 1st Respondent’s failure to genuinely implement the necessary measures for data protection, such as appointing a DPO or conducting data protection audits. The Applicant urges the court to see through these manipulations and rule in favor of upholding the Applicant’s right to privacy and data protection.
The Counter-Affidavit filed by Gbenga Olanrewaju Ajibade, on behalf of the 1st Respondent (Green Africa Airways Limited), opposes the claims made by the Applicant in the originating summons. The affidavit addresses issues regarding the handling of the Applicant’s flight booking, data protection practices, and the legitimacy of the privacy policy, as well as procedural objections to the suit. Below is a detailed summary of the key points and arguments made by the 1st Respondent in its opposition.
The 1st Respondent confirms that the Applicant booked a flight on their website on 31st May 2023 using a Zenith Bank card through the 2nd Respondent’s payment gateway. The flight was subsequently canceled for operational reasons, and this cancellation was communicated to the Applicant through text messages.
Upon the Applicant’s request for a refund, which was communicated on 7th August 2023, the 1st Respondent claims to have promptly initiated the refund process on 10th August 2023 through the 2nd Respondent. The 1st Respondent states that it provided proof of the refund transaction (Exhibit EK7), claiming that the refund was successfully processed to the Applicant’s account.
The 1st Respondent asserts that its privacy policy has been in place since the website’s design in 2018 and that it is visible and accessible on their website’s homepage. They provide a printed screenshot of the homepage and the privacy policy (Exhibits EK2 and EK3) to support their claim.
The 1st Respondent argues that it has complied with all necessary data protection laws and that the privacy policy was updated as needed. They further state that the 2nd Respondent was engaged as a payment gateway vendor only after ensuring that the 2nd Respondent also had a privacy policy in place (Exhibits EK5 and EK6).
The 1st Respondent disputes the Applicant’s claim that he made a payment via bank transfer, asserting instead that the payment was made using a Zenith Bank ATM card, and provides evidence of this transaction (Exhibit EK4).
The 1st Respondent claims that the delay in processing the refund was due to discrepancies in the Applicant’s account information and that multiple requests for accurate details were necessary to ensure the funds were returned to the correct account. They allege that despite their efforts to assist the Applicant, he was reluctant to provide matching account details, which caused further delays in resolving the issue.
The 1st Respondent maintains that the information collected from the Applicant was limited to what was necessary for booking the flight and processing the refund, in accordance with its terms and conditions and privacy policy. They argue that the additional information requested was solely to trace the refund and not as a condition for issuing the refund.
The 1st Respondent contends that it has a designated Data Protection Officer (DPO), despite the Applicant’s allegations to the contrary. However, they do not provide specific evidence to conclusively prove the appointment of a DPO in their exhibits.
The 1st Respondent points out that the Applicant eventually acknowledged receipt of the refund on 29th October 2023, contradicting his earlier claims of not receiving the payment. They provide email evidence to confirm that the refund was indeed processed on 10th August 2023 but that the delay in notification was attributed to network issues at Opay, the wallet company linked to the Applicant’s payment.
The 1st Respondent challenges the Applicant’s choice to initiate the suit using an Originating Summons, arguing that it is an inappropriate procedure for this type of case, which they characterize as involving contractual issues rather than fundamental rights enforcement.
The 1st Respondent asserts that the court lacks jurisdiction to entertain the suit due to the improper commencement method and claims that the suit is frivolous, vexatious, and without merit. The 1st Respondent states that it refused the Applicant’s demand for compensation because providing such compensation would be in violation of aviation regulations and its own terms and conditions.
They mention that, in good faith, they offered the Applicant a discount voucher as a gesture of goodwill, but he declined to accept it.
Data Protection Compliance: The 1st Respondent maintains that it has consistently complied with data protection regulations and that its privacy policy has been in place since 2018, updated in line with applicable laws. Refund Processing: The 1st Respondent insists that the refund was promptly initiated and successfully processed but was delayed due to technical issues related to the payment processor and the Applicant’s reluctance to provide consistent account details. Jurisdiction and Procedural Issues: The 1st Respondent challenges the use of Originating Summons as the method of commencing this suit, arguing that the case is more about contractual issues than a breach of fundamental rights. Alleged Tampering and False Claims: The 1st Respondent rejects the Applicant’s claims of website tampering and disputes the accusations of manipulating privacy policy information, insisting that its data protection practices are genuine and transparent.
The Counter-Affidavit submitted by the 1st Respondent seeks to undermine the Applicant’s claims by presenting evidence of compliance with data protection laws, prompt refund processing, and adherence to their own terms and conditions. The Respondent’s arguments aim to portray the Applicant’s case as being improperly grounded in a contractual dispute rather than a fundamental rights issue, calling for the dismissal of the suit on procedural and substantive grounds.
In the Written Address of Counsel for the 1st Respondent opposing the Applicant’s Originating Summons, the 1st Respondent’s legal team argues that the suit should be dismissed on procedural and substantive grounds. The arguments center around the appropriateness of using Originating Summons for the case, the nature of the Applicant’s claims, and the alleged lack of merit in the Applicant’s assertions. Below is a detailed summary of the key points and arguments made by the 1st Respondent.
The 1st Respondent argues that the Applicant’s use of Originating Summons is inappropriate for the nature of this case. They cite Order 3 Rule 5 and 6 of the High Court of Imo State (Civil Procedure) Rules, 2017, which prescribes the use of Originating Summons for cases involving the interpretation of written laws or documents where there are no substantial disputes of fact.
They assert that this case involves contentious and hostile issues, such as the alleged breach of data protection laws and a dispute over a flight refund, which require a trial with oral evidence rather than relying solely on affidavit evidence.
The 1st Respondent references the case of Olomoda v. Mustapha & Ors (2019) LPELR-46438(SC), where the Supreme Court held that Originating Summons should only be used where there are no disputes of fact. They argue that since the parties in this case are not in agreement on the facts, such as the existence of a privacy policy, the use of Originating Summons is inappropriate. The 1st Respondent emphasizes that contentious matters like those in this suit require the use of a writ of summons and a full trial to resolve the factual disputes, citing Doherty v. Doherty (1968) NWLR 241 as supporting precedent.
The 1st Respondent contends that the Applicant’s claims of a privacy policy breach are unfounded, as they have consistently maintained a privacy policy on their website (Exhibit EK3) that complies with relevant data protection laws. They argue that their actions, including requesting account details from the Applicant, were conducted in compliance with the Nigeria Data Protection Act 2023 (NDPA), specifically citing Section 39 (2)(a) which allows for the pseudonymization of data to protect privacy.
The 1st Respondent highlights that the refund process for the Applicant’s cancelled flight was initiated promptly and successfully completed on 10th August 2023, and any delays were due to external factors related to the Opay wallet service and not due to any fault on their part. They emphasize that their repeated requests for specific account details from the Applicant were solely to verify the correct account for the refund, arguing that these requests were reasonable and did not constitute a breach of data privacy.
The 1st Respondent argues that the Applicant is bound by the terms and conditions of the service, which he accepted when booking the flight. They reference Section 24(1)(c) of the NDPA, stating that their processing of the Applicant’s personal data was done for a specific, well-defined purpose and in compliance with the law. They also cite Larmie v. Data Processing Maintenance & Services Ltd (2005) LPELR-1756(SC), arguing that parties are bound by the terms of their agreement, and the Applicant cannot complain of breaches that he agreed to under the terms of the contract.
The 1st Respondent accuses the Applicant of acting with malice and vexation, seeking to exploit the situation by making unfounded allegations that there was no privacy policy on their website and falsely claiming a non-receipt of the refund despite the evidence provided. They argue that the Applicant’s refusal to provide the necessary details to assist in tracing the refund demonstrates a lack of good faith and portrays the Applicant as intentionally obstructing the process to support his claims.
The 1st Respondent points out inconsistencies in the Applicant’s statements regarding the payment method, specifically that the Applicant initially claimed to have paid via bank transfer, while the evidence shows that the payment was made using a Zenith. They use this to argue that the Applicant’s misleading statements undermine the credibility of his entire claim.
The 1st Respondent concludes by urging the court to dismiss the suit, labeling it as baseless, frivolous, and vexatious. They argue that the suit lacks merit both on procedural and substantive grounds, and therefore, it should be dismissed with substantial costs awarded against the Applicant.
The 1st Respondent argues that the Applicant’s use of Originating Summons is improper for a case involving disputed facts, suggesting that a writ of summons is the correct procedural tool. They maintain that they have complied with all relevant data protection regulations, had a privacy policy in place, and acted within the bounds of the law while handling the Applicant’s data. The 1st Respondent accuses the Applicant of making false and misleading allegations, acting in bad faith, and attempting to manipulate the situation for personal gain. They conclude that the case is without merit and request that the court dismiss it, emphasizing that the Applicant’s allegations are not only legally baseless but also frivolous and malicious.
The 1st Respondent’s Written Address argues strongly against the validity of the Applicant’s case on both procedural and substantive grounds. They maintain that the Originating Summons was improperly used for a case involving factual disputes and emphasize their compliance with data protection laws. They challenge the credibility of the Applicant’s claims and request the court to dismiss the suit as baseless and vexatious, suggesting that the Applicant’s allegations lack both legal and factual support.
In the Further Counter Affidavit filed by Gbenga Olanrewaju Ajibade, on behalf of the 1st Respondent (Green Africa Airways Limited), the 1st Respondent insists that a privacy policy has been in place on its website since its domain was created in 2018, in line with international standards and the Nigeria Data Protection Regulation (NDPR) of 2019. They argue that their privacy policy has been regularly updated to comply with relevant data protection laws and deny the Applicant’s claim that the policy was added or edited during the pendency of the suit.
The Respondent clarifies that the privacy policy was last updated in 2021 to reflect compliance with existing regulations, and they maintain that these updates were publicly notified on their website. The 1st Respondent denies the Applicant’s claims that they edited their website to include privacy policy details and a tickbox for accepting terms and conditions during the course of the litigation. They provide evidence (Exhibit EK14) showing the webpage where users must click a tickbox to accept the terms and conditions, including the privacy policy, before proceeding with transactions.
The 1st Respondent claims that they have a designated Data Protection Officer (DPO) whose contact details are included in their privacy policy (Exhibit EK3). They argue that this information has always been available on their website. They allege that the Applicant’s attempt to search for a non-existent issue by contacting them after the affidavit was served is merely a strategy to manufacture evidence.
The 1st Respondent reiterates that any delays in the refund process were due to issues with the Opay wallet service, which they claim was beyond their control. They highlight the Applicant’s unwillingness to provide consistent account details, which hindered their ability to expedite the refund process. They refute the Applicant’s claims about discrepancies in transaction references, attributing these to differences in processing methods between financial institutions.
The 1st Respondent maintains that they only requested the Applicant’s account details to verify and trace the refund properly, which was necessary due to the payment method’s complications.
The 1st Respondent states that they have consistently adhered to data protection laws and argue that their actions were in line with the requirements set forth in the Nigeria Data Protection Act (NDPA) and their privacy policy. They assert that the Applicant’s rights were not violated and that the Applicant has not provided any substantial evidence of non-compliance with data protection regulations. The 1st Respondent challenges the Applicant’s assertion regarding data protection audit reports, arguing that such information falls under the purview of public institutions like the Nigeria Data Protection Commission (NDPC) and is not subject to individual requests unless sought through appropriate channels like the Freedom of Information Act.
The 1st Respondent denies infringing on the Applicant’s right to privacy, asserting that all actions taken were in compliance with the constitution and relevant data protection laws. They argue that the Applicant never formally reported any breach of privacy to them, further supporting their position that no rights were violated.
The 1st Respondent reaffirms the existence of its privacy policy on its website since 2018, stating that it has been regularly updated to meet international and local data protection standards. They strongly deny any allegations that the website or its content was altered during the legal proceedings, emphasizing that the privacy policy and tickbox for acceptance have been part of their website infrastructure since its inception.
The 1st Respondent maintains that the delays in the refund were due to technical issues with the Opay wallet service and that the Applicant’s refusal to provide necessary details further complicated the resolution. They argue that their actions are in line with their data protection obligations, as outlined in the NDPA, and that the Applicant’s claims of privacy violations are unfounded.
The 1st Respondent challenges the Applicant’s procedural approach and emphasizes that they have operated within the bounds of the law, seeking to dismiss the claims as baseless and devoid of merit.
The Further Counter Affidavit submitted by the 1st Respondent aims to address and refute the new issues raised by the Applicant, particularly those related to the existence of a privacy policy, data protection practices, and procedural compliance. The 1st Respondent defends their position by providing evidence of adherence to data protection laws and industry standards, arguing that the Applicant’s claims are misleading, baseless, and an attempt to manufacture a case where no breach of rights exists. They urge the court to dismiss the Applicant’s suit as lacking in substance and merit.
In the Written Address of Counsel for the 1st Respondent (Green Africa Airways Limited), the counsel contends that the suit was wrongly commenced through an Originating Summons. They argue that such a procedure is appropriate only when the facts are not in dispute and when the court’s role is primarily to interpret legal provisions or documents.
They claim that the present case involves contentious issues and disputes of fact, particularly regarding the existence and implementation of a privacy policy, which makes it unsuitable for resolution through affidavit evidence alone. Citing case law like Olomoda v. Mustapha and Doherty v. Doherty, they argue that cases with conflicting facts should be brought through a Writ of Summons rather than an Originating Summons.
The 1st Respondent asserts that the Fundamental Rights Enforcement Procedure Rules are meant solely for cases alleging breaches of rights directly protected under the Constitution or the African Charter on Human and Peoples’ Rights. They argue that the Applicant’s case focuses primarily on data protection laws rather than any direct infringement of a constitutional right, specifically the right to privacy under Section 37 of the Constitution. They maintain that unless a fundamental right is at the core of the complaint, such cases cannot be appropriately brought under this procedure.
The Respondent highlights the absence of evidence showing how the Applicant’s private communications, correspondence, or personal information were violated. They argue that the Applicant’s claims center more on procedural issues related to data protection laws rather than a direct violation of constitutional privacy rights.
The 1st Respondent argues that all data collected from the Applicant was done with his consent, in line with their privacy policy and terms and conditions, which the Applicant accepted before proceeding with the transaction. They cite Section 23(1) of the Nigerian Data Protection Act 2023, which legitimizes data processing when the data subject consents or when processing is necessary to perform a contract. The 1st Respondent suggests that the Applicant’s suit is motivated by a personal grievance over the cancellation of the flight rather than any genuine violation of his privacy rights.
They argue that the Applicant’s failure to approach the Data Protection Officer (DPO) or to provide necessary evidence before initiating legal action weakens the credibility of his claims.
The 1st Respondent criticizes the Applicant for attempting to gather evidence after the initiation of the lawsuit. They argue that evidence procured during the pendency of a suit is not admissible, referencing the case Anagbado v. Faruk to support their position. They highlight inconsistencies in the Applicant’s account, particularly regarding the method of payment (claiming a transfer instead of card payment) and refusal to provide bank details to facilitate the refund. The 1st Respondent contends that these inconsistencies indicate that the Applicant’s claims lack a factual basis and are aimed at misleading the court.
The 1st Respondent reaffirms that its privacy policy has been in place since 2018 and is accessible on its website. They assert that the Applicant was aware of and consented to this policy when making the booking. They argue that their data protection practices are in compliance with both international standards and Nigerian data protection laws, including pseudonymization and encryption measures as stipulated in Section 39(2)(a) of the Nigerian Data Protection Act 2023.
The 1st Respondent clarifies that their repeated requests for account information were in line with their privacy policy and were aimed at resolving the Applicant’s refund issue, not at violating his privacy. They state that the delays in processing the refund were due to Opay’s internal issues, which were beyond their control.
The 1st Respondent cites Incorporated Trustees of Digital Rights Lawyers Initiative v. NIMC to argue that claims based on data protection breaches do not inherently fall within the scope of fundamental rights enforcement unless directly linked to a constitutionally protected right. They submit that the suit should be dismissed, as the facts do not substantiate a claim of a constitutional violation.
The 1st Respondent concludes by urging the court to dismiss the suit with substantial costs, describing the Applicant’s claims as baseless, vexatious, and not properly founded on any direct infringement of fundamental rights. They argue that the procedural errors in commencing the suit and the lack of substantial evidence on privacy violations further render the case unsuitable for determination under the current procedure.
The suit should not have been commenced using an Originating Summons due to its contentious nature and should not be pursued under the Fundamental Rights Enforcement Procedure Rules. The 1st Respondent asserts that the Applicant has failed to demonstrate a direct breach of his constitutional right to privacy as guaranteed under Section 37. The 1st Respondent maintains that the Applicant consented to all data collection and processing in line with their privacy policy and applicable laws. The Respondent seeks the dismissal of the suit, asserting that the Applicant’s claims are based on personal grievances, lack factual support, and were improperly initiated.
The Written Address of Counsel for the 1st Respondent urges the court to view the Applicant’s suit as a misuse of the legal process and to dismiss it, given the lack of evidence, procedural improprieties, and the baseless nature of the claims.
The counsel stated that the 2nd Respondent is a payment processor and switch, licensed by the Central Bank of Nigeria (CBN) to process online payment transactions for its customers. It acts as a gateway that facilitates payments for various merchants, including the 1st Respondent (Green Africa Airways Limited), without collecting or storing any personal data of the customers. The 2nd Respondent emphasizes that it is not a data controller but merely processes transactions securely through its platform.
During the transaction, the 2nd Respondent only requested the debit card information (PAN) of the Applicant to link his bank to the receiving bank of the 1st Respondent. This data handling is limited to the first six digits and last four digits of the debit card, with no further collection of personal identifiers. The 2nd Respondent maintains a privacy policy on its website to guide its merchants and third-party users, ensuring compliance with data protection regulations. The Applicant did not interact directly with the 2nd Respondent’s website or provide personal data to it.
The 2nd Respondent claims it did not collect, store, or handle any personal data from the Applicant beyond what was necessary for processing the payment. The Applicant’s payment was processed through the 2nd Respondent’s platform using a debit card issued by Opay (supported by Zenith Bank). The payment was identified and tracked through a unique Reference Retrieval Number (RRN). Following the cancellation of the Applicant’s flight by the 1st Respondent, the 2nd Respondent received a request from the 1st Respondent on 10th August 2023 to refund the sum of ₦132,000 to the Applicant.
The refund was promptly processed via the Zenith Bank Cyber source rail to ensure the funds were returned to the original payment method. This standard process usually takes 7 to 12 working days.
The 2nd Respondent asserts that it was not privy to the direct interactions or communications between the Applicant and the 1st Respondent regarding the flight cancellation and refund requests. The refund was routed back to Opay, the institution that issued the debit card used by the Applicant, which is consistent with the standard processing method. The 2nd Respondent states that the delay in the Applicant receiving the refund was due to the internal processes of Opay.
The 2nd Respondent clarifies that it requested the Applicant’s bank account details through the 1st Respondent to verify and expedite the refund process, but the Applicant refused to provide the relevant information. The 2nd Respondent denies any claims of mishandling the Applicant’s data or breaching data protection laws. It emphasizes that all processing activities were conducted in line with applicable regulations, including the Nigerian Data Protection Regulation (NDPR) 2019.
It has consistently filed its data protection compliance audit reports annually and remains committed to maintaining secure data handling practices. The 2nd Respondent explains that the refund delay was not due to its actions but rather related to Opay’s internal processes. Despite the Applicant’s refusal to share his Zenith Bank account details for further investigation, the 2nd Respondent took steps to verify the refund status with all relevant financial institutions.
It contends that the refund was processed back to the Opay account on 11th August 2023 as per its standard operating procedures. The 2nd Respondent argues that there is no reasonable cause of action against it in this suit as it had no direct contractual or legal obligation towards the Applicant. It requests the court to dismiss the Applicant’s claims against it with costs, asserting that the 2nd Respondent has always acted within the bounds of the law and in compliance with all data protection regulations.
The 2nd Respondent asserts that its role was strictly limited to processing the Applicant’s payment and that it never directly handled or stored any of the Applicant’s personal data. It maintains that it complies fully with relevant data protection laws, including the NDPR, and did not breach the Applicant’s right to privacy.
The 2nd Respondent seeks the dismissal of the Applicant’s claims against it, arguing that there is no legitimate cause of action and that the Applicant’s grievances are solely with the 1st Respondent. The 2nd Respondent’s Counter-Affidavit provides a comprehensive defense against the allegations made by the Applicant, emphasizing its limited involvement in data handling and strict adherence to regulatory standards while arguing that the suit lacks merit and should be dismissed.
In the written address, the 2nd Respondent argues that the court lacks the jurisdiction to entertain the suit against it for the following reasons: The Applicant has not demonstrated how the 2nd Respondent violated their rights or processed their data without consent. The matter relates to a contractual disagreement and should not be adjudicated under the Fundamental Rights Enforcement Procedure Rules (FREP Rules), 2009. The suit fails to comply with the mandatory procedural requirements for service outside of jurisdiction.
The Applicant failed to provide any evidence that the 2nd Respondent collected or stored their personal data. The website referenced by the Applicant in their claims belongs to the 1st Respondent, not the 2nd Respondent. The 2nd Respondent maintains that it only acted as a payment processor, facilitating the transaction without storing or managing the Applicant’s personal data. The 2nd Respondent argues that no direct contractual or data relationship existed with the Applicant. According to the Nigeria Data Protection Act, 2023, personal data must be identifiable or linkable to an individual. Since the 2nd Respondent did not collect identifiable data from the Applicant, it contends that there is no basis for a data breach claim.
In Dada & Ors V. Ogunsanya & Anor (1992) LPELR-908(SC): The court must examine pleadings to determine if they disclose any cause of action or if they raise questions appropriate for judicial consideration. Ajayi v. Military Administrator, Ondo State (1997): A case must demonstrate some chance of success, even if the claims appear weak, for it to be considered as having a reasonable cause of action.
The 2nd Respondent argues that the Applicant’s claim is essentially a breach of contract related to a failed refund, rather than a fundamental rights issue. Therefore, it should not be adjudicated under the FREP Rules. Govt of Delta State & Anor V. Mauritz Walton (Nig) Ltd & Ors (2023): The court held that contractual disputes should not be disguised as fundamental rights cases and must be handled through appropriate civil procedures.
The suit was served on the 2nd Respondent, whose headquarters is outside the jurisdiction of the Imo State court, without proper compliance with the mandatory provisions of the Sheriffs and Civil Processes Act. The lack of proper endorsement on the originating summons renders it fundamentally defective and void, thus depriving the court of jurisdiction over the matter.
Owners of MV “Arabella” v. Nigeria Agricultural Insurance Corporation (2008): Non-compliance with procedural requirements for service outside jurisdiction is a fundamental defect that warrants dismissal of the suit.
The 2nd Respondent reiterated that it only processed the payment transaction through a secure system without collecting any personal data from the Applicant. It maintains strict adherence to data protection laws, including filing annual data protection compliance audit reports as required by the Nigerian Data Protection Regulation (NDPR) 2019.
The 2nd Respondent fulfilled its duty by processing the refund promptly through the original payment channel, but delays occurred due to issues with the Applicant’s bank (Opay).
The 2nd Respondent concludes that the Applicant’s claims do not disclose any reasonable cause of action against it since the Applicant’s data was not collected or stored by the 2nd Respondent. The suit involves a contractual dispute, not a fundamental rights breach, and should be dismissed as it falls outside the purview of the FREP Rules. The failure to comply with procedural requirements for service outside jurisdiction constitutes a fatal flaw, rendering the entire suit incompetent. The 2nd Respondent urges the court to dismiss the suit with costs against the Applicant, considering it as vexatious, frivolous, and an abuse of the judicial process.
The counsel raised a sole issue for determination as: Whether the Applicant is entitled to the reliefs sought in the Originating Summons?
The 2nd Respondent argues that the Applicant has failed to present any substantial facts or evidence to support the claims made in the originating summons. The Applicant’s claims are primarily declaratory, meaning he must provide solid evidence to substantiate his entitlement to the reliefs sought. The Applicant cannot rely on any perceived weaknesses in the 2nd Respondent’s case but must prove his own case independently. Relied on Akaninwo & Ors V. Nsirim & Ors (2008) LPELR-321 SC emphasizes that the Applicant must succeed on the strength of his own case, even if the Respondent does not provide a defense.
The 2nd Respondent contends that it did not collect, process, or store any personal data of the Applicant during the transaction, as it only requested the Applicant’s card details to facilitate payment through the bank. This fact negates the Applicant’s claim of a privacy violation under the Nigeria Data Protection Act, 2023.
The Applicant argued that the 2nd Respondent’s request for multiple account details to process the refund breached Section 24 of the Data Protection Act, which limits the collection of data to what is necessary for the intended purpose. The 2nd Respondent countered that it only requested account details related to the payment to track the refund status due to the absence of the Applicant’s data in its records.
The 2nd Respondent emphasized that it was necessary to request the correct originating account details to perform its contractual obligations properly, and this did not exceed the scope of the purpose for which the data was originally collected.
The 2nd Respondent asserted its role as a data processor rather than a data controller. Under the Nigerian Data Protection Act, 2023, data processors do not determine the purposes for which data is processed but act on behalf of the data controller, in this case, the 1st Respondent. A data processor does not have the same obligations as a data controller, such as maintaining a privacy policy, since it only processes data as instructed by the data controller. Contrary to the Applicant’s claim, the 2nd Respondent provided evidence that it has consistently complied with the Nigerian Data Protection Regulation (NDPR) 2019 by filing data protection compliance audit reports, as demonstrated through Exhibit F.
The Applicant’s claim for N200,000,000 in damages for alleged psychological, economic, or emotional injury was dismissed as lacking in substance. The 2nd Respondent argued that the Applicant failed to produce any medical reports or credible evidence to support these claims. According to the counsel, Eyiboh v Mujaddadi & Ors (2021) LPELR-57110 (SC) establishes that a party cannot act inconsistently by making conflicting claims. The 2nd Respondent pointed out that the Applicant refused to provide the required account details but then claimed data misuse, which is contradictory.
The 2nd Respondent accused the Applicant of “blowing hot and cold” by refusing to provide account details necessary for processing the refund while simultaneously accusing the 2nd Respondent of misusing his data. This conduct was described as inconsistent and undermines the Applicant’s credibility. The 2nd Respondent stated that it had processed the refund of N132,000 as instructed by the 1st Respondent and confirmed that the refund was sent to the Applicant’s Opay account. The 2nd Respondent emphasized that any failure to receive the refund should be addressed by the Applicant’s bank, not the 2nd Respondent, which acted only as a payment processor. The burden lies on the Applicant to provide evidence showing that the refund was not received, as stipulated in Section 131(1) and 133 of the Evidence Act, 2011.
The 2nd Respondent concluded its argument by stating that the suit lacks a reasonable cause of action and does not disclose any legal rights that the Applicant is entitled to enforce against the 2nd Respondent. The 2nd Respondent did not process or store the Applicant’s personal data, and therefore, the claim of a privacy breach is unfounded. The Applicant failed to provide any credible evidence of economic or psychological injury or any misuse of data by the 2nd Respondent. The 2nd Respondent urged the court to dismiss the suit as frivolous, lacking in merit, and an abuse of the court’s process, and to award substantial costs against the Applicant.
Based on the review of the affidavits submitted by the Applicant, the 1st Respondent, and the 2nd Respondent, along with the written arguments of their respective counsel, the following issues emerge that the court must address to resolve the dispute. The distilled issues for determination are as follows:
- Whether the suit against the 1st and 2nd Respondents was properly commenced under the Fundamental Rights Enforcement Procedure Rules, 2009.
- Whether the Applicant’s originating summons discloses a reasonable cause of action against the 1st and 2nd Respondents.
- Whether the procedural requirements of Sections 97 and 99 of the Sheriffs and Civil Processes Act were complied with in initiating this suit.
- Whether the Applicant has established that the Respondents breached their data protection obligations under the Nigerian Data Protection Act, 2023 and therefor violated his rights under section 37 of the Constitution.
Issue 1: Whether the suit against the 1st and 2nd Respondents was properly commenced under the Fundamental Rights Enforcement Procedure Rules, 2009.
The Applicant commenced this suit under the Fundamental Rights Enforcement Procedure Rules, alleging a violation of his right to privacy and misuse of his personal data. The 1st and 2nd Respondents argue that the suit does not fall under the purview of fundamental rights claims but instead involves a contractual dispute and should not have been initiated under these rules.
The Fundamental Rights Enforcement Procedure Rules, 2009 are designed to address violations of rights expressly guaranteed by the Nigerian Constitution and the African Charter on Human and Peoples’ Rights.
The fact remains that violation of rights do not fall out of blues; it is always based on a kind of relationship between parties. A trial court will only have jurisdiction to proceed to enforce a fundamental right of an applicant guaranteed under Chapter IV of the Constitution if the main relief discloses a breach of the Fundamental right of the Applicant. See AMALE VS. SOKOTO LOCAL GOVERNMENT COUNCIL (2012) 1 KLR PT. 3014, 99 R.I. Hence where a breach of the provisions of Chapter 1V is the principal claim, the Fundamental Rights Procedure can be invoked even though there are other ancillary reliefs claimed. See the cases of: OKECHUKU VS EFCC (2015) 18 NWLR (PT.1490) 1 AT 11; DIN VS A.G.OF THE FEDERATION (1988) 4 NWLR (PT.87) 147 AND BORNO RADIO TELEVISION CORPORATION VS BASIL EGBUONU (1991) 2 NWLR 81 AT 89.
A claim under the common law can properly be joined in an application under section 42 of the 1979 constitution, where such a claim is secondary, ancillary or incidental to the complaint of a breach of fundamental rights. It is also trite that the infraction complained about may also constitutes tortuous act. The alleged victim has a choice of seeking redress through Fundamental Right Enforcement procedure or normal civil action. See ABDULHAMID V. AKAR (2006) ALL FWLR (PT.321) 1191 AT 1208 – 1209 (SC); (2006) 13 NWLR (PT.996)146; NIGERIA UNION OF TEACHERS & ORS v. CONFERENCE OF SECONDARY SCHOOL TUTORS (CSST) & ORS (2006) NWLR (Pt. 974) 590, (2006) All FWLR (Pt 295) 656 at 673, Onwo v. Oko & Ors (1996) 6 NWLR (Pt.456) 584 at 603-604.
The court has in cases like NIGERIAN SOCIAL INSURANCE TRUST FUND V ADEBIYI [1999] 13 NWLR (PT 633) 16; ABUBAKAR TATARI ALI POLYTECNIC V ALI [2005] ALL FWLR (PT 284) AT 250; EGBONU V BRTC [1997] 12 NWLR (PT 531) AT 29; DAVID-OSUAGWU V ATTORNEY GENERAL OF ANAMBRA STATE [1993] 4 NWLR (PT 285) AT 13 found the fundamental right enforcement as ancillary, hence striking out the cases. The common thread in these cases is a claim on lack of or denial of fair hearing.
Is the fundamental right enforcement relief, in this case, the main relief or ancillary relief? The Duhaime’s Law Dictionary defines Ancillary Relief as Secondary relief claimed by a litigant which is subordinate or subservient to a principal claim. It made reference to GWYN V MELLEN (1978) 90 DLR 3D 191, where the British Columbia Supreme Court stated as follows:
“What does ancillary mean? “It is derived from the Latin word for handmaid and the primary meaning, … is ‘subservient, subordinate (to)’.”The message the word conveys to me is that a secondary matter or event follows a primary matter or event. The secondary matter or event cannot come into existence until the primary matter or event exists. The servant must first have a master to serve. “To put it another way, the ancillary matter is something grafted on to the primary matter. In both Ducharme and Needham the primary matter was a divorce decree and the ancillary matter was the order for maintenance which followed pronouncement of the decree. Both courts held that if decree or primary stock was not viable then the shoot grafted to it would die with it.”
In view of the above the court will bring forth some cases where this question of ancillary relief has been raised. In ONYIRIUKA v. A-G ENUGU STATE (2018) LPELR-45104(CA) the reliefs sought were:
- A declaration that the purported disengagement of the Applicant by the Enugu State Government on the ground that the Applicant is not from Enugu State is a violation of the Applicant’s right to freedom from discrimination as enshrined in Section 42 of the 1999 Constitution, as amended.
- A Declaration that the Applicant as a citizen of Nigeria is entitled to work in any part of the country whether public or private establishment and as such treated as a citizen of Nigeria.N20,000,000 (Twenty Million Naira) General Damages against the Respondent as monetary compensation to the Applicant for the violation of her right to freedom from discrimination, agony and loss of income by reason of the purported disengagement.
The court on objection raised said:
“I have perused the reliefs sought for by the appellant, set out earlier in this judgment. It is clear to me that the crux and crucible of the appellant’s claim is anchored on Section 42(1) & (2) of the 1999 Constitution of the Federal Republic of Nigeria, as amended, aimed at the protection of her fundamental rights, from discrimination on the ground of her place of birth or ethnicity. To my mind, that is the real meat and main claim of the appellant. None of the reliefs pertained to a claim for her salaries, pension and gratuity. I am unable to see anywhere in the reliefs and the grounds upon which the reliefs are predicated, where the appellant mentioned the question of a claim for her salaries, pension and gratuity. The only remote mention of a monetary claim is relief C and ground (iii) which are to the effect that because of the alleged unconstitutional disengagement from the services of Enugu State Government, by the latter, she needed to be compensated, for the breach of her fundamental right, of freedom from discrimination.
In the case of PHARMABASE (NIG) LTD v. OLATOKUNBO (2019) LPELR- 48043 CA the reliefs sought were:
- A DECLARATION that the arrest, humiliation and detention of the applicant on 24th April, 2014 and the planned arrest and/or trail of the applicant for arrest by police officers from Anthony Police Station, Lagos in connivance with officers of Oba-Ile Divisional Police Station of Ondo State Police Command any moment from now acting for and under the instruction of the 1st Respondent on a false allegation and/or on a debt the 1st Respondent unjustifiably claimed the applicant owed her is or/are illegal, unlawful and an infraction of applicant’s constitutional rights to dignity and liberty of persons.
- AN ORDER of this honourable Court restraining the 1st Respondent, his agents, representatives, privies and anybody acting for her from further molesting, harassing and embarrassing the applicant on a debt the 1st Respondent unjustifiably claimed the applicant owed her.
- AN ORDER of perpetual injunction restraining the 1st– 2nd and 3rd Respondents either by themselves or through their representatives, privies and agents from further molesting, harassing, intimidating, indicting, incriminating, and arresting the applicant on a debt the 1st Respondent unjustifiably claimed the applicant owed her or on any unsubstantiated allegation(s).
- AN ORDER of this Honourable Court directing the 1st, 2ndand 3rd Respondents jointly to pay to the applicant the sum of N5, 000, 000.00 (Five Million Naira) only being damages for the false allegation, unlawful arrest, detention, molestation, harassment and grievous body injuries caused the applicant and discomfort caused him and his family by his arrest and detention on 24th April, 2014 and his plan re-arrest.”
The court on the objection raised stated:
“In my humble view, all these are claims for enforcement of fundamental rights. It does not include any other claim or relief nor is it merely an ancillary relief to another claim outside fundamental rights. —————This takes us to the other ancillary issue of whether the issue before the Court was an employer/employee relationship thereby giving the National Industrial Court exclusive jurisdiction in the matter. ———-There is also no argument that the hitherto relationship between the appellant and the respondent was that of employer/employee. However that was not the claim of the respondent in the Court below. The claim as stated earlier is for enforcement of the respondent’s fundamental right.————- However a person who alleges infraction of his fundamental right need not invoke the constitutional procedure of under the Fundamental Rights (Enforcement Procedure) Rules. He may initiate an ordinary civil claim under the relevant rules of court. See NUT V COSST (SUPRA) and ONWO V OKO & ORS (1996) 6 NWLR PT 456, 584 AT 603-604. ————–The point must also be made here that in this procedure, it is not the facts that constitute the claim under the procedure for Fundamental Rights Enforcement Procedure Rules. Rather it is the allegation of infraction of the fundamental rights of the claimant that is relevant. It therefore does not matter what really the relationship is as long as that is not what constitutes the claim. Of necessity infraction of fundamental right must arise from some form of relationship or failure of such relationship. It is therefore in my view completely irrelevant whether or not in this case there was employer/employee relationship as long as the claim or relief is not a fall out of that relationship but a claim for enforcement of fundamental rights…” Per MAHMOUD, J.C.A. (Pp. 15-23, Paras. B-D)
In FIRST BANK OF NIGERIA PLC. & ORS. v. ATTORNEY-GENERAL OF THE FEDERATION & ORS. (2013) LPELR-20152(CA) the reliefs sought are:
- A declaration that the claim of the 2ndRespondent to a refund of the sum of N500 million for an alleged non-performance by Julius Berger Nigeria Plc and Nigeria Westminister Dredging and Marine Limited of a contract for the dredging of the lower River Niger under an Advance Payment Guarantee issued by the 1st Applicant in spite of disputed claims of Julius Better Plc and Nigerian Westminister Dredging and Marine Ltd against the 2nd Respondent is a dispute referable to the civil court only in accordance with the Constitution.
- A declaration that the 2ndRespondent having returned the Advance Payment Guarantee issued by the 1st Applicant is no more entitled to ask the 1st Applicant to refund any money.
- A declaration that the dispute as to who is owing who as between the 2ndRespondent and Julius Berger Nigeria Plc and Nigeria Westminister Dredging and Marine Limited is a civil and not a criminal matter.
- A declaration that the 3rd– 5th Respondents have no jurisdiction to arrest or detain the 2nd – 5th Applicants over a contractual matter or at all.
- A declaration that the arrest and detention of the 2nd– 5th Applicants between 9th September and 10th September, 2004 at Lugbe Police Station and the Airport Police Station, Abuja by the 3rd – 5th Respondents at the instance of the 2nd Respondent constitutes a violation of the 2nd – 5th Applicants’ fundamental rights guaranteed under sections 34, 35 and 41 of the 1999 Constitution and Articles 1, 4, 5, 6 and 12 of the African Charter on Human and Peoples’ Rights (Ratification and Enforcement) Act Cap 10, Laws of the Federation of Nigeria 1990 and is therefore illegal and unconstitutional.
- A declaration that the action of the 3rd – 5th Respondents forcing the 2nd Applicant to issue an undertaking to pay the sum of N600 Million within a month as a condition for bail of the 2nd – 5thApplicants after detaining them for two days is unknown to law, irregular, unconstitutional, null and void.
- An order setting aside the undertaking extracted forcefully and under duress from the 2ndApplicant on the 10th September, 2004 by the 3rd – 5th Respondents as a condition for the bail of the 2nd – 5th Applicants for being unknown to law, unconstitutional, irregular, null and void.
- An order of injunction restraining the Respondents either by themselves, their agents, privies, assigns or anybody howsoever described from further arresting, detaining, threatening, harassing or molesting the Applicants over the contractual transaction between the 2ndRespondent and the 1st Applicant’s customers or enforcing the undertaking issued by the 2nd Applicant or demanding or further demanding from the 1st
- Aggravated and exemplary damages against the Respondents jointly and/or severally in favour of each of the Applicants for the unlawful and unconstitutional arrest and/or detention of the Applicants as claimed in the statement of facts attached to this application.”
The trial Federal High Court struck out 1, 2, 3, 5, 7 and 8.
The Court Appeal on appeal per TINUADE AKOMOLAFE-WILSON JCA stated:
A calm consideration of the combination of the reliefs sought, the grounds for the reliefs and the facts relied upon by the Appellants shows clearly that the principal claim of the Appellants is predicated upon the breach of the fundamental right of the Appellants. ………………………………. Thus in my view, reliefs 1, 3, 6, 7 and 8 can safely be taken along with reliefs 4, 5 and 9. The learned trial Judge was therefore, wrong to have struck out reliefs 1, 3, 7, 6 and 8 of the Appellants’ motion on notice on the ground that these reliefs are not cognizable under the Fundamental Right Procedure.
As a further hint that the court may grant only the reliefs that can be accommodated or covered under the Fundamental Right Enforcement procedure, the court in ATTORNEY-GENERAL OF THE FEDERATION v. CHIEF (DR.) ZEBOLUM MESCHECH ABULE (2004) LPELR-7330(CA) stated:
However, that is not the problem with relief No. 4 granted along with the others in the ruling. Relief No.4 is an order of certiorari which usual y brings up to the High Court, for the purposes of being quashed, the decision, of the inferior court or tribunal. In fact it is an order by way of judicial review usual y exercised by the High Court under its supervisory jurisdiction of inferior courts or tribunals. This is very trite. That being the case, it is my considered view that the lower court, had no jurisdiction to grant relief No 4 as it did by virtue of the provisions of section 1(5) of Decree No. 18 of 1994. That even though you can enforce fundamental rights by way of declarations, you cannot definitely do that by way of certiorari. I therefore hold the view that to the extent that the lower court granted an order of certiorari in an application to enforce fundamental rights, the lower court lacked the jurisdiction to grant such an order and therefore strike out the said relief No.4 for being incompetent.
In my view, the trend of the decided cases is not that a fundamental right application is thrown out just because it contains some reliefs not accommodable under the rules.
The Applicant among other things complained about breach of the provisions of Nigeria Data Protection Act, 2023 (NDPA) and the Nigeria Data Protection Regulation, 2019 (NDPR) as it relates to his fundamental right provided under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended).
Now, the Nigeria Data Protection Regulation (The Regulation) was enacted in 2019 by the NITDA using the authority granted by Section 6 of the NITDA Act 2007. According to Regulation 1.2, the Regulation covers all transactions involving the processing of personal data as well as all Nigerians both inside and outside the nation. The Regulation defines personal date as “Any information relating to an identified or identifiable natural person (‘Data Subject’)”
The guiding principles for data protection are outlined in Part Two of the Regulation. Specifically, personal data must be: (a) collected and processed in line with a specific, legitimate, and lawful purpose consented to by the data subject, as stated in Regulation 2.2, and cannot be transferred to any third party by a data controller; (b) adequate, accurate, and respectful of human dignity; (c) stored for the only amount of time that is reasonably necessary; and (d) secured against all foreseeable hazards and breaches of any kind.
The Regulation also ensures that individuals providing data will be informed about the following: why their data is being collected, their rights prior to collection, how to withdraw consent, and the circumstances under which it may be shared to a third party.
All platforms used for the collection or processing of personal data are required by Regulation 2.5 to present a clear and uncomplicated privacy policy. Additionally, data controllers must make sure they take precautions to guarantee the security of the data they own.
Now, among the objectives of Nigeria Data Protection Act, 2023 (NDPA) are to (a) safeguard the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999; (e) protect data subjects’ rights, and provide means of recourse and remedies, in the event of the breach of the data subject’s rights.
Some of the section relevant to this application in my view are reproduced hereunder:
Section 3(1) This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes: Provided that such processing for personal or household purposes does not constitute a violation of fundamental right to privacy of a data subject.
Section 24 establishes the fundamental principles governing personal data processing in Nigeria, creating a comprehensive framework of obligations for data controllers and processors.
Section 25 establishes when data processing is lawful, primarily through consent or five alternative grounds, while placing clear limits on the use of legitimate interests as a processing basis.
Section 26 establishes strict standards for obtaining valid consent, emphasizing that it must be active, informed, freely given, and properly documented, with the controller bearing the burden of proof.
Section 27 mandates transparent communication about data processing through clear privacy notices, whether collecting data directly or indirectly, with specific requirements for content and presentation.
Section 29 mandates that when engaging processors, there must be proper documentation and guarantees of compliance, with specific obligations for security, assistance, and transparency, all formalized in written agreements.
Section 36 establishes two types of objection rights: a general right that controllers can override with sufficient justification, and an absolute right regarding direct marketing that must be honored without exception.
Section 37 protects individuals from purely automated decisions that significantly affect them, while allowing such decisions under specific conditions and with mandatory safeguards including human oversight and appeal rights.
- A data subject, who suffers injury, loss, or harm as a result of a violation of this Act by a data controller or data processor, may recover damages from such data controller or data processor in civil proceedings.
‘consent” means any freely given, specific, informed, and unambiguous indication, whether by a written or oral statement or an affirmative action, of an individual’s agreement to the processing of personal data relating to him or to another individual on whose behalf he has the permission to provide such consent;
“personal data” means any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual;
“personal data breach” means a breach of security of a data controller or data processor leading to or likely to lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
Taking into consideration the enumerated sections and articles of NDPA and NDPR, a breach of the provisions of the Nigeria Data Protection Act, 2023 (NDPA) and the Nigeria Data Protection Regulation, 2019 (NDPR) can constitute an interference with the right to privacy as guaranteed under Section 37 of the Constitution of the Federal Republic of Nigeria, 1999.
Section 37 of the Nigerian Constitution guarantees the right to privacy, which includes the privacy of homes, correspondence, telephone conversations, and telegraphic communications. The NDPA and NDPR were established to protect personal data and ensure privacy in the digital age. Data protection is a component of the right to privacy under Section 37.
Therefore, any breach of the NDPA or NDPR can be seen as an interference with the constitutional right to privacy, as these regulations are designed to safeguard personal data and, by extension, the privacy of individuals.
In my view the scope of protection under section 37 is that it protects multiple aspects of privacy:
- Personal/individual privacy
- Home privacy
- Communication privacy (correspondence, phone calls, telegrams)
The section begins with “The privacy of citizens” before listing other aspects. The comma after “the privacy of citizens” indicates that this is a separately protected category. Grammatically, it appears to protect both general privacy of citizens AND the specific enumerated aspects. It uses strong language (“guaranteed and protected”) which is absence in other sections. Even the right to life is not couched in such strong terms.
Section 37 is, therefore, elastic enough to cover General personal information privacy, Bodily privacy, Privacy of personal choices, Privacy of personal relationships, Privacy of personal data
I am of the view that the Constitution should be interpreted to meet the modern trends and development without necessarily amending the constitution.
In INCORPORATED TRUSTEES OF DIGITAL RIGHTS LAWYERS INITIATIVE & ORS v. NIMC (2021) LPELR-55623(CA)
“In highlighting the absence of a clear scope of the right to “privacy of citizens” as guaranteed under Section 37 of CFRN, 1999, this Court, per Agim, JCA (as he then was, now JSC), had held in the cited case of NWALI v. EBSIEC (2014) LPELR-23682(CA) at pages 27 – 29, para. E, as follows: The meaning of the term “privacy of citizens” is not directly obvious on its face. It is obviously very wide as it does not define the specific aspects of the privacy of citizens it protects. A citizen is ordinarily a human being constitution of his body, his life, his person, thought, conscience, belief, decisions (including his plans and choices), desires, his health, his relationships, character, possessions, family, etc. So how should the term “privacy of citizens” be understood? Should it be understood to exclude the privacy of some parts of his life? This can be seen from its holding that the right includes “privacy in private family life and incidental matters when this aspect is not expressly provided for in that Section and that meaning is not patently obvious from the text of that Section…The privacy of home, privacy of correspondence, privacy of telephone conversations and privacy of telegraphic communication are clear and particular as to the nature of privacy protected or the area or activity in respect of which a person is entitled to enjoy privacy… It is glaring that the phrase “Privacy of Citizens” is general and is not limited to any aspect of the person or life of a citizen. It is not expressly defined by the Constitution and there is nothing in the Constitution or any other statute from which it’s exact meaning or scope can be gleaned.” Per MOHAMMED, J.C.A.
What right to privacy entails –
“In declining jurisdiction to entertain the Appellants’ Originating Summons, the trial Court had, at pages 89 -90 of the Record of Appeal, considered the decisions of this Court in FRN v. DANIEL (2011) LPELR-4152(CA) and NWALI v. EBSIEC (2014) LPELR-23614(CA), on which the Appellant relied, and held as follows: These two decided cases clearly explain the scope and ramifications of the right guaranteed under Section 37 of the Constitution. The kernel of both the provision of Section 37 of the Constitution and these illuminating decisions is to my mind, that privacy of a citizen of Nigeria shall not be violated. From these decisions, privacy to my mind can be said to mean the right to be free from public attention or the right not to have others intrude into one’s private space uninvited or without one’s approval. It means to be able to stay away or apart from others without observation or intrusion. It also includes the protection of personal information from others. This right to privacy is not limited to his home but extends to anything that is private and personal to him including communication and personal data.” Per MOHAMMED, J.C.A.
Internationally, the right to privacy is recognized in documents such as the Universal Declaration of Human Rights (UDHR) and the International Covenant on Civil and Political Rights (ICCPR). c states that no one shall be subjected to arbitrary interference with their privacy, family, home, or correspondence, and everyone has the right to the protection of the law against such interference. Similarly, Article 17 of the ICCPR protects individuals from unlawful or arbitrary interference with their privacy
In Joined Cases C-92/09 and C-93/09 Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen European Court Reports 2010 I-11063 it is stated: The right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, concerns any information relating to an identified or identifiable individual. Legal persons can thus claim the protection of Articles 7 and 8 of the Charter only in so far as the official title of the legal person identifies one or more natural persons. That is the case where the official title of a partnership directly identifies natural persons who are its partners.
See also Case C-131/12 Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] QB 1022 (CJEU).
The Applicant’s claims, does not focus primarily on a refund. Alleged misuse of personal data, are fundamental right related and is covered under the Constitution of the Federal Republic of Nigeria. The protection of natural persons in relation to the processing of personal data is a fundamental right. The attempt to frame these as fundamental rights violations align with the established jurisprudence under the enforcement procedure rules. Therefore, this suit is properly commenced as a fundamental rights enforcement action.
Issue 2: Whether the Applicant’s originating summons discloses a reasonable cause of action against the 1st and 2nd Respondents
The 2nd Respondent argues that the Applicant has not established a reasonable cause of action since he did not directly engage with the 2nd Respondent or provide his personal data to it.
A cause of action must disclose facts sufficient to show the existence of a legal right and the infraction of that right by the defendant, as established in Dada v. Ogunsanya (1992) LPELR-908(SC).
The Applicant’s primary interaction was with the 1st Respondent’s website, not the 2nd Respondent’s. Since the 2nd Respondent’s role was limited to processing payments, the Applicant’s claim does not establish a direct legal nexus with the 2nd Respondent regarding the alleged data breach.
In an action commenced by originating summons or originating motion, the affidavit in support serves as the statement of claim. See DEC OIL & GAS LTD. V. S.N.G. LTD. (2021) 11 NWLR (PT. 1786) 75 AT 108, PARAS. F-G) REFERRING TO UWAZURUONYE V. GOV., IMO STATE (2013) 8 NWLR (PT. 1355) 28; P.D.P. V. EZEONWUKA (2018) 3 NWLR (PT. 1606) 187; LAU V. P.D.P. (2018) 4 NWLR (PT. 1608) 60; OWURU V. ADIGWU (2018) 1 NWLR (PT. 1599) 1; C.B.N. V. ARIBO(2018) 4 NWLR (PT. 1608) 130
A plaintiff whose statement of claim discloses a cause of action should be allowed to have his case tried, unless it can be shown that his conduct in bringing the action is clearly frivolous, vexatious or otherwise an abuse of the process of the court. See AKILU V. FAWEHINMI (NO. 2) (1989) 2 NWLR (PT. 102) 122 (P. 171, PARAS. G-H). In determining whether the plaintiff’s case discloses a cause of action, consideration must be given not only to the claim as formulated but the case as disclosed by the claim, the pleadings and the evidence led. See ESEIGBE V. AGHOLOR (1990) 7 NWLR (PT. 161) 234 AT 245, PARAS. C-D).
So long as the statement of claim or the particulars disclose some cause of action or raise some question fit to be decided by a Judge or jury, the mere fact that the case is weak and not likely to succeed is no ground for striking it out. The court can not go into the question as to whether or not the claim of the plaintiff would succeed, even if it appears to be weak. The court is not entitled to so do. See THOMAS V. OLUFOSOYE (1986) 1 NWLR (PT.18) 669, OGUNSANYA V. DADA (1990) 6 NWLR (PT. 156) 347 AT 361, PARAS. D & F).
Under Nigeria’s Data Protection Act, 2023 (NDPA) and the Nigeria Data Protection Regulation, 2019 (NDPR), data controllers and processors are required to implement technical and organizational measures to ensure the confidentiality, integrity, and security of personal data. These measures help protect data against unauthorized access, breaches, or loss. Both NDPA and NDPR stress that data controllers and processors are accountable for the effectiveness of these measures. Having considered the duties and responsibilities imposed on the data controllers and processors, vis-a-vis the claims/reliefs of the Applicant, I am unable to agree with the respondents that there is no disclosure of reasonable cause of action.
Issue 3: Whether the procedural requirements of Sections 97 and 99 of the Sheriffs and Civil Processes Act were complied with in initiating this suit
The counsel to the 1st and 2nd Respondents opined that the court lacks the jurisdiction to entertain this matter on the ground that service was effected on Respondents outside jurisdiction without the leave of court sought and obtained based on section 97 of Sheriff and Civil Process Act. Section 97 of Sheriffs and Civil Process Act, Chapter 407 Laws of the Federation of Nigeria 1990 provides:
“Every writ of summons for service under this Part out of the State or the Capital Territory in which it was issued shall, in addition to any other endorsement or notice required by the law of such State or the Capital Territory, have endorsed thereon a notice to the following effect (that is to say)-“This summons (or as the case may be) is to be served out of the …………… State (or as the case may be) …………… and in the ………………….. State (or as the case may be).”
The court of appeal in the case of PHILIP V. AKINOLA & ORS (2018) LPELR-43966(CA) after reviewing the holding in Owners of The MV Arabella v. NAIC (2008) 11 NWLR (PT 1097) 182 @ 207 stated:
“I hold that failure to endorse a writ of summons, let alone an originating summons as in this case, in compliance with Section 97 of the Sheriffs and Civil Process Act is neither fatal nor capable of rendering a writ or originating summons incompetent.
It is to be noted that fundamental right enforcement proceeding is a special kind of proceedings. Categorically it has been stated that it does not apply to fundamental right enforcement proceedings. Hence in SKYE BANK v. NJOKU & ORS (2016) LPELR-40447(CA) the court stated:
“Appellant’s main grouse with the decision of the trial Court was that the objection to the competence of the suit should have been upheld, because Appellant was served with the processes at Lagos (by courier service), outside the jurisdiction of the trial Court, without any prior seeking and obtaining of leave to issue the process and serve outside jurisdiction. In my opinion, those arguments cannot sail, because they are strange to matters of enforcement of fundamental rights, where-of the 2009 Rules have provided sufficient procedure for service of Respondents with the processes, and the Respondents had been duly served with the originating processes, and they had filed their counter-affidavit to oppose the application, as well as the preliminary objection. Appellant cannot therefore complain about service, or of not being properly served. By submitting to jurisdiction and taking part in the trial, the alleged non compliance with the Rules becomes a mere irregularity, going by Order IX Rule I of the FREPR. More-so, the Sheriff and Civil process Act, regarding services out of jurisdiction, which Appellant relied on, is not part of the provisions of fundamental rights enforcement laws.
The Applicant’s failure to comply with the mandatory provisions of the Sheriffs and Civil Processes Act does not renders the suit procedurally defective. The non-compliance does not affect the court’s jurisdiction over the matter.
Issue 4: Whether the Applicant has established that the Respondents breached their data protection obligations under the Nigerian Data Protection Act, 2023 and therefor violated his rights under section 37 of the Constitution.
The Applicant alleges that both Respondents violated his right to privacy by collecting and processing his personal data without his consent. Section 37 of the Nigerian Constitution guarantees the right to privacy, including protection against unauthorized use of personal information.
The 1st Respondent stated that its website had a privacy policy in place and that the Applicant consented to the terms and conditions, which include data processing permissions. The 2nd Respondent’s involvement was limited to payment processing, and it stated that it did not collect or store the Applicant’s personal data beyond what was necessary for the transaction.
The Applicant alleges that the Respondents failed to comply with data protection principles, particularly regarding consent and data minimization. The principles of data minimization and purpose limitation require data controllers to only collect data that is relevant and necessary for a specific purpose.
The 1st Respondent’s collection of data was for the explicit purpose of booking the Applicant’s flight and processing the payment, which is standard practice.
The Applicant argues that the repeated requests for his bank details by the 1st Respondent violated the data protection principle of purpose limitation. The evidence shows that these requests were made to confirm the correct bank account for the refund and were not excessive or unrelated to the original transaction purpose.
The requests for bank details were relevant and within the lawful scope of purpose limitation as they were directly related to resolving the refund issue. There was no breach of data protection principles by the 1st Respondent.
The 2nd Respondent did not collect any unnecessary data, as it only handled the transaction information relevant for payment processing.
The Applicant has not established that the Respondents breached their data protection obligations. The data collected was consistent with the legitimate purpose of the transaction and was handled according to the data protection principles. The Applicant has not proven that the Respondents violated his right to privacy. The data processing by the 1st Respondent was consented to, and the 2nd Respondent did not exceed its lawful role. Therefore, the Applicant’s claim of a privacy violation is unfounded.
The Applicant claims damages for economic, emotional, and psychological injuries. Damages for emotional or psychological injuries must be supported by evidence, such as medical records or clear proof of harm. The Applicant has not presented sufficient evidence to demonstrate any psychological or economic injury caused by the Respondents’ actions. The Applicant is not entitled to the N200,000,000 damages due to a lack of supporting evidence.
The delay in refunding, where it is so, is condemnable. However, delay in refunding is not connected to violation of personal data privacy. There are other issues raised such as non designation of Data Protection Officers (DPOs) etc. This should be taken up by the Nigeria Data Protection Bureau (NDPB).
The suit is dismissed as lacking in merit.
I so hold
I.M.Njaka
Judge
31-10-2024
Appearances:
Emmanuel T Okpara in person for the Applicant
Ekezie K Onumajulu for the 1st Respondent
OJ Udokwu Esq., with the brief of US Nnadozie Esq for the 2nd Respondent