Description
This extensive judgment resolves a public interest lawsuit initiated by an incorporated NGO against a private medical facility for alleged infractions of Sections 24, 27, and 28 of the Nigeria Data Protection Act (NDPA) 2023. The plaintiff asserted that the hospital failed to display clear privacy notices on its website and facility premises, collected personal data via patient intake forms without proper consent, utilized unflagged CCTV surveillance, and omitted mandatory Data Protection Impact Assessments (DPIAs).
Justice Abubakar Hussaini Musa delivered a balanced ruling. On the threshold issues, the Court recognized the NGO’s locus standi to initiate the action, extending the public interest litigation principles of environmental law to the realm of digital data privacy. However, on the substantive merits, the Court ruled in favor of the hospital. It determined that the plaintiff’s country director had voluntarily provided his information and that paying a “General Registration” fee constituted an affirmative, unambiguous action of consent to process personal data under Section 25 of the Act. Additionally, the website’s cookie tracking icon was deemed a valid notice, and the facility’s CCTV array was held to be a lawful security exemption excluded from the NDPA’s primary restrictions.
Reviews
There are no reviews yet.