TWO REGULATORS, NO RULE
Supremacy, Coordination and the Unallocated Jurisdiction over Personal Data in Nigeria ABSTRACT Sections 104 of the Federal Competition and Consumer Protection Act 2018 (FCCPA) and 63 of the Nigeria Data Protection Act 2023 (NDPA) address overlapping regulatory concerns. The former gives the FCCPA priority in matters relating to competition and consumer protection, subject to the Constitution; the latter provides that the NDPA prevails where another law relating directly or indirectly to personal-data processing is inconsistent with it. Neither provision, by itself, establishes a comprehensive procedure for allocating responsibility between regulators where the same conduct raises both data-protection and consumer-protection issues. This article examines that institutional problem through the Federal Competition and Consumer Protection Commission’s joint investigation with the Nigeria Data Protection Commission into WhatsApp’s 2021 privacy-policy changes and the resulting Final Order of 18 July 2024. It considers the significance of Article 3 of the Nigeria Data Protection Act General Application and Implementation Directive 2025, which reiterates section 63, and asks whether the existing framework adequately addresses lead-regulator designation, consultation, sequencing and disagreement between agencies. The article argues that statutory overlap and conflict between legal rules are distinct from the allocation and coordination of regulatory powers. It proposes a structured inter-agency mechanism, grounded in a careful examination of sections 5(h) and 63 of the NDPA, Article 4 of the GAID 2025, and section 105 of the FCCPA. The proposed mechanism would identify a presumptive lead regulator, provide for early notification and consultation, and establish a process for resolving disagreement, while preserving the limits imposed by the agencies’ respective enabling statutes. Where those statutes do not authorise the necessary arrangements, legislative clarification would be required. 1. INTRODUCTION Two Nigerian statutes claim the last word. Section 104 of the Federal Competition and Consumer Protection Act 2018 says that, despite any other law but subject to the Constitution, in all matters relating to competition and consumer protection, that Act overrides any other law.1 Section 63 of the Nigeria Data Protection Act, 2023 (NDPA) says that where another law relates directly or indirectly to the processing of personal data, and is inconsistent with the Act, the Act prevails.2 Most of the time the two never meet. But think of a messaging service that changes its privacy policy, shares user data with related companies, and makes continued access depend on accepting the change. Is that a data protection matter or a consumer protection matter? It is plainly both. The conduct is the processing of personal data, and it is equally the terms on which a service is supplied to consumers. Each statute then tells the reader that it, and not the other, governs. This article is about what happens next, and its argument is that the difficulty has been misdiagnosed. A supremacy clause settles a clash of rules. It tells a court which rule to apply when two rules cannot both be obeyed. The problem here is different. Both statutes can be obeyed at once, because neither demands anything the other forbids. What is contested is not which rule applies but which regulator may apply it, and in what order two entitled regulators are to act. That is a clash of jurisdiction, and no supremacy clause in Nigerian law deals with it. The distinction can be put simply. A supremacy clause is a rule about which law wins. What is needed here is a rule about whose case it is. Those are different questions, and the second has not been answered. Part 2 sets out the proceedings against WhatsApp and Meta, which supply the facts. Part 3 examines the two supremacy clauses and how the courts have treated section 104. Part 4 turns to Article 3 of the General Application and Implementation Directive 2025 and asks what it actually supplies. Part 5 sets out what an unallocated jurisdiction costs. Part 6 proposes reform, and Part 7 concludes. The authors work from the two Acts, the Directive, and the Final Order of 18 July 2024, which they have examined. Where the account rests on reporting rather than on an instrument, that is said. 2. THE PROCEEDINGS AS A CASE STUDY In May 2021, the Federal Competition and Consumer Protection Commission opened an inquiry into WhatsApp’s updated privacy policy, which took effect that month. The Commission’s functions include protecting consumer interests and stopping anti-competitive practices.3 The investigation was run jointly with the Nigeria Data Protection Commission.4 On the face of the Final Order, it took about three years. An Investigative Report, an Order and Notice to Show Cause and a Summons were delivered in January 2024. The Meta parties replied in March. A meeting followed in April. A proposed package of remedies was submitted and rejected by May. 5 The Final Order was issued on 18 July 2024, under the competition statute and the Nigeria Data Protection Regulation 2019. It required the restoration of user control, a compliant privacy policy, an end to data sharing until genuine consent was obtained, a return to the 2016 data sharing practices, an end to tying, written assurances, and enforcement of the proposed remedies. It also imposed costs of thirty-five thousand United States dollars and a penalty of two hundred and twenty million.6 Order 3 is the provision that matters most here. It requires any proposed policy to be approved by the NDPC under its Act and by the FCCPC under its own, and says the FCCPC will not approve a policy unless and until the NDPC’s written approval is produced.7 That is a lead-regulator rule. It sets the order of play, gives one regulator a veto, and says who goes first. It was written by one of the two regulators, in one order, for one respondent. Nothing in either statute required it, and nothing in either statute would require it in the next case. The choice of instrument also deserves notice. The Order proceeded under the Regulation of 2019 rather than the Act of 2023 because the conduct began in May 2021. That approach may be justified by the
THE REASONS “THEY” DO NOT HAVE TO GIVE YOU
ABSTRACT Imagine you apply for a loan through a mobile app. Four seconds later, your application is rejected. No human being reviewed it; an automated system made the decision. Under section 27(1)(g) of the Nigeria Data Protection Act 2023, you must be informed that automated decision-making is being used, what it means, what its likely consequences are, and that you have the right to object. Section 34(1)(a)(viii) also allows you to request this information later. But there is one crucial question the law does not expressly give you the right to have answered: Why was your loan rejected? The corresponding GDPR provisions require meaningful information about the logic involved in automated decision-making. Sections 27(1)(g) and 34(1)(a)(viii) of the NDPA contain similar disclosure requirements but omit that express wording. The omission appears in both provisions, although the text alone does not establish why it occurred. Nigeria took the rest of the wording and left that phrase out of both. Because it is missing from the notice duty and the access right alike, this looks like a drafting decision rather than an accident. This article argues that the General Application and Implementation Directive 2025 spotted the gap and filled it in the wrong place. Article 41(2)(c)(ii) requires controllers to disclose what their technology can do, particularly where algorithms are used for profiling. But Article 41 is headed “Data Ethics, Privacy and Dignity of the Human Person”. However, Article 41 does not expressly establish a standalone right to an explanation. Although its transparency provisions may support enforcement under the Act, the route is less direct than a right clearly recognised in the law. The missing safeguard has therefore been partly addressed, but its status as an individual entitlement remains uncertain. Three features make this worse: section 37(1) applies only where a decision is made “solely” by machine, and nothing says what human input removes it from that description; The contract exception in section 37(2)(a) may also limit the protection available in lending and insurance decisions, depending on whether automated decision-making is necessary for the relevant contractual purpose; and the emerging-technology paperwork is filed through returns that only the two largest categories of controllers submit. South Africa provides a useful legislative model: its 2013 law expressly links the right to make representations with access to information about the underlying logic of automated processing. The authors propose measures the Commission may consider under its existing powers, while arguing that an amendment to the Act would provide the clearest basis for establishing an express individual right to an explanation. 1. INTRODUCTION Imagine you apply for a loan through a mobile app. Four seconds later, your application is rejected. No human reviews it; a machine makes the decision. Section 37(1) of the Nigeria Data Protection Act 2023 gives you the right not to be subject to certain decisions made entirely by automated systems, including profiling, where they have legal or similarly significant effects.1 Section 27(1)(g) requires you to be informed beforehand about such decisions, their meaning and likely consequences, and your right to object and challenge them.2 Section 34(1)(a)(viii) also allows you to request this information later.3 But here is the problem: you can learn that a machine rejected your application and understand the consequences, yet still have no clear right to know why. It is like failing an examination and being allowed to appeal without knowing which answers were wrong. The corresponding GDPR provisions require meaningful information about the logic involved in automated decision-making. Sections 27(1)(g) and 34(1)(a)(viii) of the Nigerian Act contain similar disclosure requirements but omit that express wording.4 The omission appears in both provisions, although the text alone does not establish why it occurred. This article examines that omission, the Nigeria Data Protection Commission’s partial response, and the reforms needed to address the gap. It also considers three related weaknesses, compares Nigeria’s framework with those of Kenya and South Africa, and proposes reforms using existing legal powers. The analysis is based on the Nigeria Data Protection Act 2023, the Directive issued in March 2025, and the relevant laws of the two comparator countries. 2. WHAT THE ACT GIVES The structure will be familiar. Section 65 defines automated decision-making as a decision taken only by automated means, with no human involvement at all.5 Section 37(1) gives the right not to be subject to such a decision where it has legal or similarly serious effects. Section 37(2) removes that right in three situations: where the decision is needed to enter into or perform a contract with the controller, where a written law allows it and sets out safeguards, and where the person has consented.6 Section 37(3) then requires the controller to put suitable measures in place to protect the person, including the right to ask for a human to intervene, the right to put her side of the story, and the right to challenge the decision.7 One feature of that structure deserves credit, and it is rarely noticed. Article 22(3) of the European Regulation limits its equivalent safeguards to two of its three exceptions, so a decision authorised by law attracts only whatever safeguards that law happens to provide. Section 37(3) carries no such limit.8 On its wording, the right to human intervention, the right to be heard and the right to challenge apply in every case where section 37(2) is engaged, including the statutory one. That is a real improvement on the model, and an article that criticises the rest of the transposition should say so first. The transparency provisions complete the picture. Section 27(1)(g) is a notice duty owed before data is collected. Section 34(1)(a)(viii) forms part of the right of access. Between them, they ensure a person knows that automated decision-making is happening, understands what it means and what it may lead to, and knows she can object. That is a coherent scheme and, for many purposes, a sufficient one. The difficulty only appears when one asks what the section 37(3) rights are actually worth without the information needed to use
A TEST NOBODY HAS TO TAKE
ABSTRACT The Nigeria Data Protection Act 2023 relaxes certain obligations when a competent authority processes personal data for criminal law enforcement, the control of a national public health emergency or national security, and other listed cases. The relaxation is narrower than often assumed. Section 3(2) preserves the principles of processing, the lawful basis requirement, the duty to appoint a Data Protection Officer and the duty to notify personal data breaches. The General Application and Implementation Directive 2025 confirms that the rights of data subjects under Part VI survive, confines the exemption to the obligations it names, and directs the Nigeria Data Protection Commission to weigh six factors, including constitutional limits, necessity and proportionality, when it assesses exempted processing. The authors argue that the framework has one practical weakness. The six-factor test is addressed to the Commission, not to the authority relying on the exemption. That authority must act necessarily and proportionately, and must keep general records of its processing, but nothing expressly requires it to record which limb of the exemption it relies on, to state why the processing is necessary when it begins, or to notify anyone that the exemption has been invoked. When the Commission assesses the decision, there may be no contemporaneous record against which to test it. The breadth of the definition of “competent authority”, which extends to foreign governments and bodies outside Nigeria, makes the gap more significant. The authors propose three measures within the Commission’s existing powers: a duty to record reliance on an exemption, anchored in the accountability duty that survives it; guidance on how necessity and proportionality are to be demonstrated; and publication of aggregated information on the use of exemptions. The difficulty lies not in the existence of exemptions but in the absence of any record of their use. 1. INTRODUCTION The Nigerian Government is one of the largest data controllers in the country. It holds the national identity database, the voters’ register, tax and customs records, the criminal records system, health records across public hospitals, and the data of every citizen who has applied for a passport, a driver’s licence or a public benefit. Much of that processing is capable of falling within an exemption, and under the present framework nobody can say how much does. Section 3(2) of the Nigeria Data Protection Act 2023 disapplies most of the obligations in Part V where a competent authority processes personal data for the prevention, investigation, detection, prosecution or adjudication of a criminal offence or the execution of a criminal penalty; for the prevention or control of a national public health emergency; or as is necessary for national security. It also covers publication in the public interest and the establishment, exercise or defence of legal claims.1 It would be easy to argue that this is too wide, that it has no proportionality control, and that public bodies therefore process data without supervision. Each of those claims overstates the position, and this article does not make them in that form. The exemption is narrower than its reputation suggests, and the Commission has narrowed it further by directive. Where the scheme is genuinely wide, in its definition of competent authority, the authors say so in Part Five. The argument here is different, and the authors suggest it is more useful. The framework contains a proportionality test of real quality, and it places substantive duties of necessity on the authority itself. What it does not contain is any duty on that authority to create, at the time, a record against which the test can be applied. The test exists. The material it would work on need not. That is the gap. Part Two shows how narrow the exemption already is. Part Three examines the proportionality test. Part Four explains why it does not bite. Part Five looks at the definition of competent authority, the widest part of the scheme. Part Six proposes reform. 2. HOW NARROW THE EXEMPTION ALREADY IS Section 3(2) does not switch off the Act. It disapplies the obligations in Part V other than those in sections 24, 25, 32 and 40, the principles of processing, the lawful basis requirement, the appointment of a Data Protection Officer, and breach notification. Section 40 in fact sits in Part VII, which the exemption does not reach, so its inclusion is a matter of caution rather than substance. The whole subsection is expressed to be subject to the rights and freedoms in the Constitution.2 Those survivals matter. A public authority processing under exemption must still process data fairly, lawfully and transparently; collect it for specified and legitimate purposes; limit it to the minimum necessary; retain it no longer than necessary; keep it accurate; and keep it secure. It owes a duty of care and must demonstrate accountability for those principles.3 It must still have a lawful basis, still designate a Data Protection Officer, and still notify the Commission of a qualifying breach within seventy-two hours.4 An authority that thinks the exemption frees it from the principles has misread the section. Article 5 of the Directive goes further in three ways.5 First, Article 5(1) requires a person relying on an exemption to abide by the provisions that are not exempted, closing off any argument that section 3 disengages the Act as a whole. Secondly, Article 5(2) confirms that the whole of Part VI survives. On the text of the Act, Part VI was never within the exemption, since section 3(2) reaches only Part V; but the confirmation forecloses any argument that the rights fall away with the duties that support them. The rights of access, rectification, erasure, restriction, withdrawal of consent, objection, protection against solely automated decision-making and portability can all be exercised against a public authority processing under exemption.6 Thirdly, Article 5(3) confines the exemption to the obligations in “Chapter V” (the Directive’s term for Part V) other than those named, and provides that the Commission will hold the controller accountable for the infraction of any other provision. Put together, a public authority relying