Court Rejects Bid to Stop NDPC From Registering PoS Agents

The Federal High Court has dismissed a suit seeking to stop the Nigeria Data Protection Commission (NDPC) from registering Point of Sale (PoS) agents and other organisations classified as Data Controllers and Data Processors of Major Importance (DCPMIs), affirming that the commission acted within the powers granted to it by law.

The judgment strengthens the NDPC’s regulatory oversight under the Nigeria Data Protection Act (NDPA), 2023, and clears the way for continued enforcement of its registration framework for entities engaged in significant personal data processing.

The suit, Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), challenged the commission’s authority to classify PoS agents as Data Controllers or Data Processors of Major Importance. The applicant had asked the court to declare that PoS agents do not fall within that category and sought a perpetual injunction restraining the NDPC from requiring them to register.

However, Justice F.N. Ogazi, after examining the provisions of the Nigeria Data Protection Act and the commission’s Guidance Notice on Registration, ruled that the NDPC acted within its statutory mandate in designating entities under the Ordinary High Level (OHL) category of major data processing as DCPMIs.

The judge held that the Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance, noting that the registration framework enables the commission to identify organisations involved in significant data processing activities and monitor compliance with the law.

According to the court, the registration requirement does not violate the constitutional right to privacy but instead serves as “one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.”

Justice Ogazi also held that the Guidance Notice was aimed at protecting the privacy and security of data subjects, bringing it within the protective provisions of Section 45 of the 1999 Constitution.

The court further observed that Section 65 of the Nigeria Data Protection Act gives the law overriding effect over any inconsistent legislation on issues relating to the processing of personal data.

Reacting to the verdict, the NDPC described the judgment as a significant milestone for data protection regulation in Nigeria and a major affirmation of its legal mandate to ensure accountability in the processing of personal data.

The commission disclosed that its National Commissioner and Chief Executive Officer, Dr. Vincent Olatunji, has directed all Data Controllers and Data Processors of Major Importance that have yet to register with the commission to comply without delay.

It warned that failure to register could expose affected organisations to legal liabilities under the Nigeria Data Protection Act, while stressing that compliance would strengthen public confidence in Nigeria’s data governance framework and safeguard the rights of data subjects.