Federal High Court (Abuja) – Araka v. Ecart Internet Services Nigeria Ltd & Anor (2025)

Description

This judgment resolves a digital privacy dispute initiated by an individual data subject against Ecart Internet Services Nigeria Limited (operators of the defunct Jumia Food platform) as the first respondent/data controller, and Eat ‘N’ Go Limited (operators of Domino’s Pizza) as the second respondent/data processor. The Applicant alleged that his personal data, shared with the delivery platform solely to facilitate three food orders, was unlawfully retained and weaponized by the restaurant vendor to bombard him with unsolicited marketing messages.

Justice Emeka Nwite delivered a definitive breakdown of foundational data protection compliance, establishing several key parameters under Nigerian privacy jurisprudence:

• Scope of Informational Privacy: Reaffirmed that the constitutional right to privacy under Section 37 of the Nigerian Constitution fully extends to the protection of personal data and digital communications.

• Sufficiency of Written Controller-Processor Agreements: Held that a data controller satisfies its statutory duty of care under Section 29 of the NDPA by executing a valid written service agreement with an engaged processor. Because the first respondent executed a written contract explicitly prohibiting the unauthorized use of customer data and promptly intervened upon receiving the complaint, it was absolved of liability.

• The Absolute Rule of Purpose Limitation: Established that when data is shared under the lawful basis of performing a contract (Section 25(1)(b) of the NDPA), the data processor cannot autonomously repurpose that data for direct marketing. Repurposing data without specific, freely given consent constitutes an independent breach.

• Illegality of Unsolicited Direct Marketing via Third Parties: Ruled that a subsequent transaction on an entirely separate platform (Glovo) does not retroactively re-initiate general marketing consent for previous vendor platforms.

• The “Opt-Out” Fallacy: Decreed that providing an “opt-out” button or unsubscribe option in an unsolicited text message does not validate or clean an initially illegal act. Consent must be obtained before the processing begins, not excused after the fact.

• Remedies and Damages: Ordered the second respondent to permanently erase the Applicant’s personal data, issue a cease-and-desist on all marketing communications, and paid the Applicant ₦3,000,000.00 (Three Million Naira) in general damages for the breach of his fundamental rights.