The Digital Rights Lawyers Initiative have filed an action at the Federal High Court against the Federal Minister of Industry, Trade and Investment for processing citizens data on their portal (https://www.survivalfund.gov.ng/) without complying with the provisions of the Nigeria Data Protection Regulation 2019.
In Suit No. FHC/AWK/CS/116/2020 filed by their lawyer Izuckuwu Umeji, Esq., the Applicant prays for thirteen reliefs as follows:
- A DECLARATION that by virtue of articles 1.1(a), 2.2, & 2.3 of the Nigeria Data Protection Regulation (NDPR) 2019, data protection is guaranteed under right to private and family life provided under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- A DECLARATION that the Respondents’ processing of personal data under MSME Survival Fund (https://www.survivalfund.gov.ng/) is likely to interfere with the Applicant’s members’ right to private and family life guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- A DECLARATION that the Respondents’ failure to publish a privacy policy on their portal (https://www.survivalfund.gov.ng/) constitutes a violation of regulation 1.1(a) and 2.5 of the Nigeria Data Protection Regulation (NDPR) which provision safeguard the right to privacy guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- A DECLARATION that the Respondents’ failure to provide information on its portal (https://www.survivalfund.gov.ng/) relating to processing of personal data in a concise, transparent, intelligible form constitutes a violation of regulation 3.1(1) of the Nigeria Data Protection Regulation (NDPR) which provision safeguards right to privacy guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- A DECLARATION that the Respondents’ failure to provide information on their portal (https://www.survivalfund.gov.ng/) relating to contact details of its Data Protection Officer, legal basis of processing, recipients of personal data etc constitutes a violation of regulation 3.1(7) of the Nigeria Data Protection Regulation (NDPR) which provision safeguards right to privacy guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- A DECLARATION that the 1st Respondent’s failure as a Data Controller to designate a Data Protection Officer with respect to its processing of personal data on its portal (https://www.survivalfund.gov.ng/) through the Federal Ministry of Industry, Trade and Investment) constitutes a violation of regulation 4.1(2) of the Nigeria Data Protection Regulation (NDPR) which provision safeguards right to privacy guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- A DECLARATION that the 1st Respondent’s processing of personal data on the (https://www.survivalfund.gov.ng/) portal without developing security measures to protect data, storing data securely with access to specific authorized individuals, employing data encryption technologies, developing organizational policy for handling personal data constitutes a violation of regulation 2.6 of the Nigeria Data Protection Regulation which provision safeguards right to privacy guaranteed under section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended).
- AN ORDER mandating the 1st Respondent to immediately publish a privacy policy for its MSME Survival Fund on a conspicuous part of its portal (https://www.survivalfund.gov.ng/) upon the delivery of judgment herein.
- AN ORDER mandating the 1st Respondent to designate a Data Protection Officer (DPO) for its MSME Survival Fund (https://www.survivalfund.gov.ng/) and publish his/her contact on the said portal.
- AN ORDER mandating the Respondents to comply with provision of regulation 3.1(7) of the Nigeria Data Protection Regulation (NDPR) by immediately providing comprehensive information on its https://www.survivalfund.gov.ng/ portal relating to:
a). the identity and the contact details of the Controller;
b) the contact details of the Data Protection Officer;
c) the purpose(s) of the processing for which the Personal Data are intended as well as the legal basis for the processing;
d) the legitimate interests pursued by the Controller or by a third party;
e) the recipients or categories of recipients of the Personal Data, if any;
f) the period for which the Personal Data will be stored, or if that is not possible,
g) the existence of the Data Subject’s rights
h) the existence of automated decision-making, including profiling and, at least, in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject;
i) m) Where the Controller intends to further process the Personal Data for a purpose other than that for which the Personal Data were collected, the controller shall provide the Data Subject prior to that further processing with information on that other purpose, and with any relevant further information
- AN ORDER mandating the 3rd Respondent to ensure that the 1st and 2nd Respondent comply with the provisions of the Nigeria Data protection Regulation and/or other relevant data protection legislation while processing personal data via its https://www.survivalfund.gov.ng/ portal.
- PERPETUAL INJUNCTION restraining the Respondents and/or their agents from further processing (collection and retention) of Bank Verification Numbers (BVN) until its publishes its privacy policy and designates a Data Protection Officer (DPO).
- CONSEQUENTIAL ORDER(S) as this honourable court may deem fit to make in the circumstance.
The matter is yet to be assigned to a Judge in the division.
