INTRODUCTION TO PERSONAL DATA PROTECTION

In the world today, providing personal information has become almost unavoidable. From registering in school and obtaining a National Identification Number (NIN) to opening a bank account, individuals are constantly required to disclose information about themselves. Businesses also request customers’ contact details, while websites and mobile applications often require access to personal information such as location, photographs and contacts before certain services can be used. Although providing this information is often necessary to access essential services and carry out everyday activities, it raises serious concerns about the privacy and security of the information disclosed.

The concern is not simply about providing personal information, but what happens to that information after it has been collected. Personal details may be accessed by unauthorised persons, disclosed without permission or used for purposes other than those for which they were originally provided. In some instances, personal information may even be used to perpetrate fraudulent activities, such as opening bank accounts in another person’s name without their knowledge or approval. These possibilities make it necessary to consider how individuals can retain some control over their personal information and how the law can protect them against its misuse.

This is where consent becomes important. Consent gives individuals the opportunity to decide whether their personal information may be collected and processed for a particular purpose. It is intended to ensure that individuals are not simply treated as sources of information but are given a measure of control over how their personal details are used. However, the fact that an individual has agreed to the collection of their information does not automatically mean that their privacy is protected. Many people accept privacy policies and grant applications access to their information without fully understanding what they are agreeing to or how far such access may extend. This raises questions about whether consent, as currently obtained, provides meaningful protection.

In Nigeria, the right to privacy is recognised under section 37 of the Constitution of the Federal Republic of Nigeria 1999, while the Nigeria Data Protection Act 2023 establishes a legal framework for the protection and processing of personal data. Against this background, this article examines the role of consent in protecting personal information, the extent to which it gives individuals control over their information, and the limitations that may prevent it from providing adequate protection. It argues that although consent is an important safeguard, it cannot protect personal information effectively in isolation and must be supported by proper regulation, transparency and effective enforcement.

Conceptual Clarification of Personal Information and Consent

Personal Information personal data protection

Personal information refers to information relating to an individual who can be identified directly or indirectly. It includes details such as a person’s name, telephone number, address, date of birth, bank details, identification number, photographs and location data.

Under section 65 of the Nigeria Data Protection Act 2023 (NDPA), the statutory term is ‘personal data’, defined as information relating to an identified or identifiable individual. The Act also recognises sensitive personal data, which includes information relating to an individual’s health, biometric and genetic characteristics, religious beliefs, political opinions, race, sex life and trade union membership. Such information requires particular protection because of the potential harm that may arise from its misuse or disclosure.

Consent personal data protection

Consent refers to an individual’s agreement to the processing of their personal data. It allows individuals to exercise some control over how their information is collected and used.

Section 65 of the NDPA defines consent as a freely given, specific, informed and unambiguous indication of an individual’s agreement to the processing of their personal data. Section 26 further establishes the requirements for valid consent. It places the burden of proving consent on the data controller, requires consent requests to be presented in clear and accessible language, and provides that silence or inactivity does not amount to consent.

Therefore, consent must reflect a genuine and informed decision. An individual’s mere acceptance of a request does not necessarily establish meaningful consent if they do not understand what they are agreeing to or the purpose for which their information will be processed.

Legal Framework Governing Consent and Personal Information in Nigeria personal data protection

The Constitution of the Federal Republic of Nigeria 1999

The Constitution provides the foundation for the protection of privacy in Nigeria. Section 37 guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications. Although the provision does not expressly mention personal data, its protection of privacy provides a constitutional basis for safeguarding individuals against unlawful interference with their private information. This constitutional protection is particularly relevant in an age where personal information is routinely collected and processed by public and private organisations.

The Nigeria Data Protection Act 2023 personal data protection

The Nigeria Data Protection Act 2023 (NDPA) is the principal legislation regulating the processing of personal data in Nigeria. It establishes rules for the lawful collection, use, storage and disclosure of personal data and seeks to protect the rights and interests of individuals whose information is being processed.

Section 25 identifies the lawful bases for processing personal data. These include the consent of the data subject, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public-interest task and legitimate interests. This means that consent is an important lawful basis for processing, but it is not the only one.

Where consent is relied upon, section 26 requires it to be freely and intentionally given. The data controller bears the responsibility of proving that consent was obtained, while silence or inactivity cannot be treated as consent. The section also requires consent requests to be presented in clear and simple language and provides that consent must be given through an affirmative action. Furthermore, section 35 gives individuals the right to withdraw their consent at any time.

The Act also protects individuals through provisions beyond consent. For instance, section 27 requires data controllers to provide individuals with relevant information about the processing of their personal data, including its purpose, the lawful basis for processing, the recipients of the information and the period for which it will be retained.

Section 30 provides additional protection for sensitive personal data by restricting its processing to specified circumstances. These include situations where the individual has given and not withdrawn consent for the specific purpose, as well as other legally recognised grounds such as the protection of vital interests and substantial public interest. This provision recognises the need for greater protection where the nature of the information processed may expose an individual to particular risks.

Similarly, section 34 grants data subjects rights over their personal data. These include the right to obtain confirmation that their information is being processed, access a copy of the information, request correction of inaccurate data, seek erasure and request restriction of processing in specified circumstances. These rights enable individuals to exercise control over their information even after it has been collected by an organisation.

Taken together, these provisions demonstrate that the protection of personal information involves more than obtaining an individual’s consent. It also requires transparency, accountability and respect for the rights of individuals throughout the processing of their personal data.

The Nigeria Data Protection Commission

The Nigeria Data Protection Commission (NDPC), established under section 4 of the NDPA 2023, is responsible for overseeing the implementation and enforcement of the Act. Its functions include regulating data controllers and processors, promoting compliance with data protection requirements and receiving complaints relating to violations of data privacy rights.

The Commission therefore plays an important role in ensuring that the rights recognised under the Act are not merely theoretical but are respected in practice. Its regulatory and enforcement responsibilities are essential to ensuring that organisations handle personal data lawfully and that individuals have avenues for seeking redress where their rights are violated.

The Role of Consent in Protecting Personal Information

Consent plays an important role in protecting personal information by giving individuals control over how their information is collected, used and disclosed. It helps prevent unauthorised processing by requiring organisations to obtain an individual’s agreement where consent is the applicable lawful basis. It also ensures that personal information is collected for specified purposes and not used indiscriminately.

Consent further promotes transparency and accountability by requiring organisations to inform individuals about the information being collected, the purpose of its collection and how it will be used. This enables individuals to make informed decisions before permitting the processing of their information. It also discourages organisations from using personal data for purposes beyond those communicated to the individual.

The importance of consent can also be illustrated by the practice of photographing individuals during religious gatherings. Churches and other religious organisations often take photographs or videos of worshippers and subsequently publish them on their websites and social media platforms for publicity, documentation or content creation. However, attending a religious gathering does not automatically amount to consent to the unrestricted use and publication of an individual’s image. Since identifiable photographs constitute personal data, their collection and subsequent use must comply with the Nigeria Data Protection Act 2023.

It is also important to distinguish between permission to take a photograph and permission to publish or use it for other purposes. An individual may be comfortable being photographed during a service but may not wish to have their image uploaded to social media or used in promotional content. Furthermore, photographs taken in religious settings may reveal information about an individual’s religious beliefs or affiliation, which constitutes sensitive personal data under the Act. Religious organisations must therefore consider the applicable lawful basis for processing, inform individuals about the intended use of their images and obtain consent where consent is the applicable lawful basis.

Another important role of consent is promoting individual autonomy. It recognises an individual’s right to make decisions concerning the use of their personal information. This control extends beyond the initial agreement, as section 35 of the NDPA permits individuals to withdraw their consent at any time. Consent therefore provides individuals with an opportunity to reconsider their decision where they no longer wish to have their information processed on that basis.

Furthermore, consent helps protect individuals against the misuse and unauthorised disclosure of their personal information. By establishing the purposes for which information may be processed, it helps limit the use of such information to what individuals have agreed to, where consent is relied upon. This also strengthens trust in digital transactions, as individuals are more likely to engage with organisations that handle their personal information transparently and responsibly.

Thilla Rajaretnam, in The Right to Consent and Control Personal Information Processing in Cyberspace (2012), questions the adequacy of implied consent in electronic transactions and emphasises the need for individuals to exercise meaningful control over their personal information. His argument highlights that obtaining consent alone does not guarantee adequate privacy protection. Consent must therefore operate alongside effective legal safeguards and regulatory enforcement.

Limitations of Consent as a Mechanism for Protecting Personal Information personal data protection

Despite its importance, consent has certain limitations as a means of protecting personal information. One major limitation is consent fatigue, which arises from the frequent presentation of lengthy privacy policies and consent requests. Individuals may accept these terms without reading or understanding their implications. Rajaretnam (2012, pp. 233–234) identifies this problem in relation to bundled consent, where individuals are required to agree to several uses of their personal information without being given the opportunity to make separate choices.

Another limitation is the absence of genuine choice. Some organisations make access to their services conditional upon accepting their data-processing terms, leaving individuals with little practical opportunity to refuse. In such circumstances, the consent obtained may not represent a genuinely voluntary decision, particularly where the individual does not understand the extent of the processing or has no reasonable alternative.

Furthermore, consent is not the only lawful basis for processing personal data under Nigerian law. Section 25 of the NDPA recognises other grounds, including contractual necessity, compliance with legal obligations, vital interests and legitimate interests. Consequently, an organisation may lawfully process personal data without obtaining consent where another recognised lawful basis applies. This demonstrates that consent, although important, cannot independently guarantee the protection of personal information.

Challenges to the Effective Protection of Personal Information in Nigeria personal data protection

Despite the enactment of the Nigeria Data Protection Act 2023, several challenges continue to affect the effective protection of personal information in Nigeria.

One major challenge is the low level of public awareness. Many individuals do not fully understand their data protection rights or the implications of sharing their personal information online. As a result, they may disclose sensitive information without considering how it could be collected, stored, shared or misused. This makes it difficult for individuals to exercise meaningful control over their personal information.

Another challenge is the inadequate compliance of some organisations with data protection requirements. Some organisations collect personal information without providing sufficient information about the purpose of collection or how the information will be used. Others may lack adequate security measures, thereby exposing personal information to unauthorised access, disclosure or data breaches.

The enforcement of data protection laws also presents difficulties. Although the Nigeria Data Protection Commission is responsible for overseeing compliance with the NDPA, effective enforcement requires adequate funding, technical expertise and institutional capacity. Where violations are not properly investigated or sanctioned, organisations may have little incentive to comply with their legal obligations.

Furthermore, the increasing use of digital platforms and online services creates additional difficulties. Personal information can be transferred across borders, shared with third parties and processed by several organisations, making it difficult for individuals to know who has access to their information or how it is being used. These developments make the protection of personal information more complex and demonstrate the need for stronger regulatory oversight.

Recommendations and Conclusion

The effective protection of personal information in Nigeria requires more than the existence of legislation. First, the Nigeria Data Protection Commission should strengthen public awareness through educational campaigns that explain individuals’ data protection rights and the importance of exercising control over their personal information. Organisations should also be required to adopt clear and accessible privacy policies that enable individuals to understand what they are consenting to before their information is collected or processed.

Furthermore, the Commission should strengthen its monitoring and enforcement mechanisms to ensure that organisations comply with the provisions of the Nigeria Data Protection Act 2023. Appropriate sanctions should be imposed for violations, while organisations should adopt adequate technical and organisational measures to prevent unauthorised access, disclosure and misuse of personal information.

There is also a need to promote meaningful consent by ensuring that consent requests are specific, informed and freely given. Organisations should avoid presenting individuals with complicated or bundled consent requests that make it difficult to understand the purposes for which their information will be processed. Individuals should equally be encouraged to understand their rights and exercise caution when sharing personal information, particularly on digital platforms.

In conclusion, consent remains an important mechanism for protecting personal information because it gives individuals a measure of control over how their information is processed. However, consent alone cannot guarantee adequate protection, particularly where individuals lack sufficient information or meaningful choice. Its effectiveness therefore depends on transparency, accountability, regulatory enforcement and respect for the rights of data subjects. Ultimately, the protection of personal information in Nigeria requires a framework in which consent operates alongside effective

CONTRIBUTORS

OJIENOH SEGUN JUSTICE, ESQ.,

LEAD PARTNER, EKO SOLICITORS AND ADVOCATES

OLAONIPEKUN KOFOWOROLA

GRADUATE TRAINEE, EKO SOLICITORS AND ADVOCATES

PERSONAL DATA PROTECTION, PERSONAL DATA PROTECTION ,PERSONAL DATA PROTECTION ,PERSONAL DATA PROTECTION ,PERSONAL DATA PROTECTION ,PERSONAL DATA PROTECTION ,PERSONAL DATA PROTECTION