The Right to Privacy in the Age of Artificial Intelligence: Are Nigerians Prepared?

Human Rights in a Digital World — Series Article No. 2

Ebuka Williams Obidinma Esq. ACIArb  |  Partner, Synergy Legal Partners

“This article is the second in the Human Rights in a Digital World series. Readers who have not yet read the first article, Beyond the Physical: Exploring the Nexus Between Human Rights and Technology in the Digital Age, are encouraged to do so here, https://www.linkedin.com/pulse/human-rights-technology-digital-governance-part-i-ebuka-obidinma-zgtef/  as it establishes the foundational framework upon which this discussion builds.”

1.0  Introduction

In the preceding article in this series, we established a foundational proposition: that human rights do not end where technology begins. We observed that the digital world is not separate from society but an extension of it, and that the rights which protect individuals in physical spaces must continue to protect them in digital environments. That proposition, broad as it was, was always intended as a beginning, not a conclusion.

If the first article asked the question; ‘What is the relationship between human rights and technology?’, then this article asks the more immediate and personal question that follows: of all the rights that technology now touches, which is most affected, most threatened, and most urgently in need of attention?

This writer is of the opinion that the answer is privacy.

Privacy is not an abstract legal concept reserved for courtrooms and constitutional scholars. It is the right that governs what others may know about you, what they may do with that knowledge, and whether you retain control over the most intimate dimensions of your own life. It is the right that protects the journalist investigating corruption, the activist organising dissent, the patient sharing a diagnosis, the employee disclosing a grievance, and the ordinary citizen simply living without the burden of being watched. Without privacy, the space in which all other rights are exercised begins to shrink.

Yet today, privacy faces pressures that its traditional legal protections were never designed to withstand. Every time a Nigerian citizen registers a SIM card, opens a mobile banking application, steps into a major airport, or simply carries a smartphone through the streets of Lagos or Abuja, data is being generated, collected, processed, and in some cases, exploited. In many instances, this occurs without meaningful awareness, let alone meaningful consent.

The Nigeria Data Protection Act, 2023 represents a significant and commendable legislative response to this reality. But legislation, however well-crafted, is only as effective as the institutions that enforce it and the culture that sustains it. As this article will demonstrate, Nigeria currently has one without the other.

This article examines the right to privacy in the context of artificial intelligence, digital surveillance, data ownership, and the evolving Nigerian legal and regulatory landscape. It does not approach privacy as a technical matter for data scientists or a niche concern for civil society organisations. It approaches it as what it has always fundamentally been: a human rights question. And in the age of artificial intelligence, it is one of the most urgent human rights questions of our time.

Are Nigerians prepared? The honest answer, as we shall see, is that Nigeria has taken important steps. But important steps and adequate protection are not the same thing.

2.0  Privacy as a Human Right

Privacy is one of the oldest recognised rights in the human rights canon, yet it remains one of the most contested in its application. It is a right that resists simple definition, not because its importance is unclear, but because its boundaries are perpetually tested by the realities of the age in which it must operate.

At its core, privacy is the right of every individual to control the narrative of their own life. It encompasses the freedom to develop thoughts without external interference, to communicate without interception, to make personal choices without surveillance, and to exist in both public and private spaces without the constant scrutiny of others. It is, in the words of the United Nations Human Rights Council, a right whose violation strikes at the very foundation of a democratic society.

Internationally, the right to privacy finds expression in Article 12 of the Universal Declaration of Human Rights, which provides that no one shall be subjected to arbitrary interference with their privacy, family, home, or correspondence. The International Covenant on Civil and Political Rights reinforces this guarantee in Article 17, obligating state parties to protect individuals against both arbitrary and unlawful interference with their privacy. The African Charter on Human and Peoples’ Rights, while silent on privacy in explicit terms, has been interpreted by the African Commission to encompass privacy protections within its broader guarantees of dignity and personal liberty.

In Nigeria, the constitutional expression of this right is found in Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended), which provides:

“The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”

The Nigerian courts have also recognised the importance of privacy as a constitutional value. In Incorporated Trustees of Digital Rights Lawyers Initiative v National Identity Management Commission (2021) LPELR-55623(CA), concerns relating to the collection and processing of citizens’ personal data in connection with the National Identification Number (NIN) framework brought renewed attention to the constitutional dimensions of privacy in the digital age. While the legal issues before the court were specific, the broader significance of the case lies in its illustration of an emerging reality: disputes concerning technology are increasingly becoming disputes concerning fundamental rights.

Section 37 CFRN is an important provision. But it is also a provision that was written in 1999, a year in which fewer than 200,000 Nigerians had access to the internet, mobile banking did not exist, social media had not yet been conceived, and the phrase “artificial intelligence” belonged almost exclusively to science fiction. The framers of the Constitution could not have anticipated a world in which a single mobile application would collect more personal data about an individual in one hour than a government surveillance unit could gather in an entire year.

This is not a criticism of the Constitution. It is an observation about the nature of rights in a rapidly changing world. Section 37 remains the foundational anchor of privacy protection in Nigeria. But anchors, by their nature, hold a position. They do not move with the tide.

The question that Section 37 alone cannot answer is this: what does the right to privacy mean when the home is also a server, when correspondence includes encrypted messages and metadata, when telephone conversations are supplemented by voice-activated devices that listen continuously, and when the most intimate details of a person’s life are inferred, accurately, from the pattern of their online behaviour?

This is the question that the digital age has placed before Nigerian law. And it is a question that demands more than a constitutional guarantee written for a pre-digital era. It demands an evolving legal framework, robust institutional capacity, genuine public awareness, and a culture of accountability that treats the data of Nigerian citizens with the same seriousness that the law demands.

2.1  The UN Framework: Privacy and Security as Partners, Not Opponents

One of the most enduring misconceptions in contemporary debates about digital privacy, especially amongst our leaders, is the suggestion that privacy and security are inherently in tension, that protecting one necessarily compromises the other. This framing, convenient as it may be for those seeking to justify expanded surveillance powers, does not withstand legal or philosophical scrutiny.

Joseph Cannataci, the first United Nations Special Rapporteur on the Right to Privacy, addressed this misconception directly in his landmark 2016 report to the Human Rights Council (UN Doc. A/HRC/31/64). The report established two foundational principles: first, that in a world where the internet transcends national borders, privacy safeguards must be available regardless of where a person is located; and second, that remedies for violations of privacy must be equally available across those borders.

Crucially, as the UN Special Rapporteur on the Right to Privacy observed in that report, the relationship between privacy and security should be framed not as “privacy versus security” but as “privacy and security,” emphasising that the two values are complementary rather than competing. Governments that invoke national security to justify mass surveillance of their own citizens are not making a legal argument. They are making a political choice, and one that the international human rights framework does not sanction.

2.2  The Nigeria Data Protection Act 2023: A Closer Look

Nigeria’s most significant legislative response to the challenges of digital privacy is the Nigeria Data Protection Act, 2023 (NDPA), signed into law by President Bola Ahmed Tinubu on 14 June 2023. The NDPA represents a substantial advancement over its predecessor, the Nigeria Data Protection Regulation (NDPR) of 2019, and signals a growing institutional recognition that the data of Nigerian citizens is a matter of fundamental rights, not merely commercial regulation.

Nigeria’s evolving data protection framework should also be understood within a broader global movement toward rights-based digital governance. The European Union’s General Data Protection Regulation (GDPR), which came into force in 2018, has become the most influential contemporary privacy regime, shaping global conversations around consent, transparency, accountability, data minimisation, and the rights of data subjects far beyond Europe’s borders. More recently, the European Union’s Artificial Intelligence Act (Regulation (EU) 2024/1689) has sought to introduce a risk-based framework for regulating AI systems, particularly those that pose threats to fundamental rights. Nigeria need not replicate foreign models wholesale. But these developments are instructive. They reflect an emerging international consensus that technological innovation, however economically valuable, cannot be left to operate without legal structures capable of protecting human dignity, autonomy, and democratic freedoms.

The NDPA establishes the Nigeria Data Protection Commission (NDPC) as an independent regulatory body, empowered to superintend the implementation and enforcement of data protection rules, investigate violations, impose sanctions, and receive complaints from data subjects whose rights have been violated.

At its core, the NDPA grants Nigerian citizens, referred to in the Act as “data subjects,” a suite of enforceable rights over their personal information. These include the right to be informed about how their data is being processed, the right to object to processing, the right to withdraw consent, the right to data portability, and critically, the right not to be subjected to decisions made solely on the basis of automated processing, a provision of enormous significance in an age of algorithmic decision-making.

The penalties for non-compliance are substantial. For data controllers of major importance, the sanction is whichever is greater between ₦10,000,000 and 2% of annual revenue. For others, it is whichever is greater between ₦2,000,000 and 2% of annual revenue. Imprisonment of up to one year may also apply.

On paper, the NDPA is a serious and commendable piece of legislation. The honest assessment, however, is this: a law is only as strong as the institution that enforces it. Gbenga Sesan, Executive Director of Paradigm Initiative, revealed at the organisation’s December 2024 year-end media briefing, as reported by Leadership Newspaper, that the Nigeria Data Protection Commission, the very body charged with enforcing this progressive legislation, operated in 2024 with a budget of zero Naira. That single fact is perhaps the most important data point in this article. Not because it negates the value of the NDPA, but because it illustrates with devastating clarity the gap that currently exists between Nigeria’s legislative ambitions and its institutional reality.

3.0  The Consent Illusion

A friend recently recounted a striking experience. She had been having a casual conversation about flowers, nothing more, when moments later, her Instagram feed began populating with advertisements for flower sales. Her response was immediate and unfiltered: “data privacy to the mud.”

It is easy to dismiss such experiences as coincidence. It is harder to dismiss them when millions of people report the same thing. What Favour encountered is not an accident of digital life. It is a feature of it, a consequence of the invisible data harvesting, behavioural inference, and cross-platform sharing that now underpins the business model of virtually every major digital platform. And the legal mechanism through which all of it is justified is called consent.

Every day, millions of Nigerians give away something extraordinarily valuable without realising it. They do not give it under duress. They are not deceived in any obvious sense. They give it willingly, often eagerly, in exchange for something they want, a free application, a faster service, a more personalised experience, a digital convenience that makes modern life a little easier to navigate. What they give away is their personal data. And the mechanism through which this transfer is legitimised is called consent.

Consent, in theory, is the cornerstone of data protection law. The Nigeria Data Protection Act, 2023 requires that the processing of personal data be grounded on a lawful basis, and for most everyday interactions between citizens and digital platforms, that basis is consent. But here lies the problem. The consent that data protection law contemplates, specific, informed, freely given, and revocable, bears almost no resemblance to the consent that actually occurs in practice.

Empirical research shows that privacy policies impose a substantial reading burden on users. McDonald and Cranor’s Carnegie Mellon study estimated that a typical privacy policy required about 10 minutes to read, while more recent analyses of major websites have put the average closer to 27 to 29 minutes. More importantly, the burden appears to be increasing rather than receding. Large-scale longitudinal studies, including research by Ryan Amos and others published in the Proceedings of The Web Conference 2021, and Isabel Wagner’s 2022 analysis of privacy policies spanning 1996 to 2021, have found that privacy policies have generally become longer and harder to read over time, with noticeable expansion following major regulatory interventions such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). In Nigeria, where digital literacy remains uneven and where many users access digital platforms for the first time on mobile devices with limited screen space, the proportion of users who meaningfully engage with these documents is almost certainly negligible.

This is not a failure of individual responsibility. It is a structural problem. When consent is buried in documents that no reasonable person reads, when “agreeing” is the only pathway to accessing a service that has become essential to modern participation in society, and when the alternative to consenting is exclusion from financial services, employment platforms, entertainment, and/or social connectivity, consent is no longer truly free. It is, at best, a transaction. At worst, it is fiction dressed in legal language.

The Nigeria Data Protection Act acknowledges this concern implicitly by requiring that consent be “specific,” “informed,” and “freely given.” These are meaningful protections. The difficulty, however, is that their practical value depends on active regulatory intervention, sustained public awareness, and the institutional capacity to monitor compliance and sanction abuse, capacity which, as we have seen, remains severely underfunded. A right that exists on paper but is not enforced in practice risks reducing the enforcement agency to a paper watchdog; and for the individual whose data is being harvested, the right becomes largely illusory where there is no meaningful protection.

3.1  The Particular Vulnerability of Nigerian Users

Nigeria’s digital population has grown at a remarkable pace. From fewer than 200,000 internet users in 2001, the country today has over 100 million internet users, a transformation driven primarily by mobile connectivity. This rapid expansion has brought millions of Nigerians online who are navigating digital environments for the first time, often without the foundational digital literacy that would allow them to meaningfully evaluate the implications of the permissions they grant.

At the same time, the platforms they are being asked to consent to are designed by teams of engineers, behavioural psychologists, and legal professionals to maximise data collection. The architecture of consent on most digital platforms is not neutral. It is deliberate. Default settings favour data sharing. Opt-out mechanisms are buried. Permission requests are framed in ways that encourage acceptance. The average user, however intelligent, is navigating a system that has been carefully designed to extract the maximum possible consent with the minimum possible friction.

This asymmetry, between the sophistication of data collection systems and the awareness of the individuals whose data is being collected, gives rise to one of the defining human rights challenges of the digital age.

3.2  Convenience, Consent, and the Question of Balance

It would be intellectually dishonest to suggest that data collection serves no legitimate purpose. The question is not whether data should ever be collected. The question is whether the current framework adequately protects the individual while permitting these benefits to flow. The answer, at present, is no, not because the legal framework is deficient in its principles, but because the balance is tilted. Convenience is the default. Privacy has become its price.

In a genuinely rights-respecting digital ecosystem, that balance should be reversed. Privacy should be the default. Data collection beyond what is strictly necessary for the service requested should require active, specific, and meaningful consent, not a 47-page Terms of Service document that nobody reads.

As the UNESCO Recommendation on the Ethics of Artificial Intelligence, adopted by all 193 member states including Nigeria in November 2021, makes clear: data for AI systems must be collected, used, shared, archived, and deleted in ways that are consistent with international human rights law. Until that standard is consistently applied in the Nigerian digital marketplace, the consent that Nigerian citizens give to digital platforms will remain, in too many cases, not a genuine exercise of autonomy but an illusion of it.

4.0  Artificial Intelligence and the New Privacy Frontier

If the consent problem represents the visible surface of the digital privacy challenge, artificial intelligence represents what lies beneath it. AI does not merely collect data. It transforms data, drawing inferences, identifying patterns, predicting behaviour, and making decisions about individuals that those individuals may never know are being made. It is this capacity, to know more about a person than they have chosen to reveal, and to act on that knowledge without their awareness, that makes artificial intelligence the most significant privacy challenge of our time.

When a Nigerian opens a mobile banking application, the data collected is not merely transactional. It includes the time of day the application is opened, the frequency of use, the location from which it is accessed, the speed of navigation through its interface, and hundreds of other data points that, individually, seem innocuous. Aggregated and processed by an AI system, however, these data points can reveal, with remarkable accuracy, a person’s financial situation, daily routine, social relationships, health status, political preferences, and psychological disposition. None of this information was explicitly provided. All of it was inferred.

4.1  Behavioural Profiling: The Invisible Decision-Maker

Behavioural profiling is the process by which AI systems construct detailed models of individual behaviour based on accumulated data, and use those models to predict future behaviour or make decisions. It operates largely invisibly. Most individuals have no awareness that a profile of their behaviour exists, let alone that it is being used to make consequential decisions about their lives.

In the Nigerian context, behavioural profiling is already present in fintech platforms assessing creditworthiness, advertising platforms determining which content users see, and insurance companies exploring risk assessment. In each of these contexts, decisions are being made about Nigerian citizens on the basis of profiles they did not knowingly create and cannot easily challenge or correct.

The NDPA 2023 grants data subjects the right not to be subjected to decisions based solely on automated processing where those decisions produce legal or similarly significant effects. This is a meaningful protection. Its practical enforceability, however, remains to be truly demonstrated as at today.

4.2  Automated Decision-Making: When the Algorithm Decides

The use of automated systems to make or assist with decisions affecting individuals is one of the fastest-growing applications of artificial intelligence in Nigeria. It is also one of the least regulated. In the financial sector, credit-scoring algorithms are increasingly determining who receives loans, at what interest rates, and on what terms. As explored in the preceding article in this series, these systems, trained on historical data that reflects existing social inequalities, risk disproportionately disadvantaging rural populations, women, and low-income earners.

Viewed through the lens of privacy, algorithmic credit decisions are also a transparency problem: individuals subjected to automated decisions frequently have no meaningful insight into why they were approved or rejected, what data was used, or how the system reached its conclusion. Beyond finance, automated decision-making is beginning to appear in employment screening, healthcare diagnostics, and public administration, in each context raising the same unanswered questions about awareness, challenge, and compliance with the NDPA.

4.3  Facial Recognition: Technology Without a Legal Framework

Of all the emerging technologies that intersect with privacy, facial recognition is perhaps the most immediately intrusive. Unlike behavioural profiling, which operates on data that an individual has generated through their own actions, facial recognition operates on the human face itself. It identifies, tracks, and records the physical presence of individuals in public and private spaces, often without their knowledge, and always without their explicit consent.

Nigeria is not a country that is merely considering the deployment of facial recognition technology. It is a country where that deployment is already well underway, and where the legal framework to govern it does not yet exist. Reports indicate that Chinese technology companies have provided “safe city” surveillance products to the Nigerian Government, deploying extensive CCTV infrastructure with facial recognition capabilities across Lagos and Abuja. According to TechAfrica News, in Lagos State alone, a large-scale initiative launched in 2016 resulted in the deployment of approximately 13,000 CCTV cameras, later expanded in 2019 with an additional 10,000 high-definition cameras equipped with facial recognition capabilities. At the federal level, TechAfrica News further reports that Nigeria has invested in a National Public Security Communication System, a $470 million project jointly financed by the Nigerian government and a China Eximbank loan.

In March 2023, the Federal Government announced plans to deploy facial recognition technology at the Murtala Muhammed International Airport in Lagos and the Nnamdi Azikiwe International Airport in Abuja, through a grant agreement with the Japanese Government and NEC Corporation, with plans to extend the system to airports in Port Harcourt, Enugu, and Kano, as reported by Biometric Update.

The concern is not merely that surveillance exists. It is that the legal framework to govern it does not. A 2018 study by Joy Buolamwini and Timnit Gebru of the MIT Media Lab, published as the Gender Shades report in the Proceedings of Machine Learning Research, evaluated three major commercial facial recognition systems and found error rates of up to 34.7% for darker-skinned women, compared to a maximum error rate of just 0.8% for lighter-skinned men. A subsequent 2019 study by the United States National Institute of Standards and Technology, analysing 189 facial recognition algorithms, found that false positive rates were between 10 and 100 times higher for faces of African and Asian descent compared to white faces. In a country where facial recognition systems are being deployed across airports, highways, and urban centres without specific governing legislation, and without published human rights impact assessments, these error rates are not a statistical abstraction. They are a human rights concern.

4.4  Deepfakes and Synthetic Identity: The Emerging Frontier

No examination of artificial intelligence and privacy would be complete without acknowledging the threat of deepfakes, AI-generated synthetic media that creates realistic but entirely fabricated images, audio recordings, and video footage of real individuals. A deepfake does not merely invade privacy in the traditional sense. It creates a false reality about a person and distributes it, potentially to millions, in a form increasingly indistinguishable from authentic content.

Nigerian law does not yet contain provisions specifically addressing synthetic media or AI-generated content targeting individuals, a gap that policymakers will need to address as a matter of urgency. Deepfakes represent the outer edge of a broader challenge: that artificial intelligence is not only processing data about individuals, but is increasingly capable of fabricating it, and that our legal frameworks have not yet caught up with either capability.

5.0  Government Surveillance and the Limits of Power

There is a conversation that governments around the world have been having with their citizens for decades, and it goes something like this: trust us with your privacy, and we will keep you safe. Give us the ability to watch, to intercept, to monitor, and in return, we will protect you from the threats that you cannot see and cannot defend against alone. It is a compelling offer. It is also, without adequate legal safeguards, an extraordinarily dangerous one.

The international human rights framework is unambiguous. The right to privacy guaranteed under Article 17 of the ICCPR is not absolute. States may derogate from it subject to conditions of necessity and proportionality. But surveillance that is broader than necessary, that lacks independent oversight, and that targets individuals on the basis of their political views, journalistic activities, or civic engagement, is not a legitimate exercise of state power. It is a violation of human rights, regardless of the security justification advanced in its support.

Joseph Cannataci, the UN Special Rapporteur on the Right to Privacy, emphasised in his 2016 report that privacy and security are not opposing values to be traded against each other, but complementary ones that must be pursued together. A state that sacrifices the privacy of its citizens in the name of security does not thereby become more secure. It becomes, instead, a state in which the instruments of security have been converted into instruments of control.

5.1  The Legal Standard: What Surveillance Requires

For surveillance to be lawful under international human rights law, it must be authorised by law, pursue a legitimate aim, be necessary, and be proportionate. Crucially, it must be subject to independent oversight. The body authorising surveillance must be genuinely independent of the executive branch conducting it. Oversight exercised by the same branch of government that is doing the watching is not oversight at all. It is permission.

In Nigeria, the starting point is the Constitution itself. Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended) guarantees the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications. This guarantee, however, is not without qualification. Section 45 of the same Constitution permits derogation from certain fundamental rights, including the right to privacy, where such derogation is reasonably justifiable in a democratic society in the interest of defence, public safety, public order, public morality, or public health.

The critical word in Section 45 is “reasonably justifiable.” It is not enough that a government invokes defence or public safety. The interference must be proportionate to the threat it seeks to address, and must be capable of withstanding scrutiny in a genuinely democratic society. Section 45 is a permission within the bounds of law, not a blank cheque.

Beyond the Constitution, the Cybercrimes (Prohibition, Prevention, Etc.) Act, 2015 grants law enforcement agencies significant powers to intercept communications and access stored electronic data. The Nigerian Communications Act empowers the Nigerian Communications Commission to require telecommunications operators to maintain interception capabilities. These are broad powers. The safeguards around their exercise, in terms of judicial authorisation, proportionality requirements, and independent oversight mechanisms, are considerably narrower than the international standard demands. Read together, Sections 37 and 45 of the Constitution, the Cybercrimes Act, and the Nigerian Communications Act create a legal landscape in which surveillance is both constitutionally permitted and insufficiently constrained, a combination that demands urgent legislative attention.

5.2  The Nigerian Reality: What Reports Indicate

Reports have indicated that surveillance infrastructure in Nigeria has expanded significantly in recent years, particularly in the federal capital. Paradigm Initiative has documented concerns about the use of surveillance tools targeting communications in Abuja, and has previously sought information through Freedom of Information requests regarding government surveillance capabilities, requests that were not responded to until legal proceedings were initiated.

As documented in the preceding section, reports further indicate that facial recognition and CCTV surveillance infrastructure has been deployed across Lagos and Abuja. Research by the Institute of Development Studies has documented that Nigeria is among a group of African nations collectively spending at least $1 billion a year on digital surveillance technologies supplied by companies in the US, UK, China, EU, and Israel. These investments have been made without specific legislation governing the use of the surveillance systems procured, and without published human rights impact assessments.

The concern is not merely that surveillance exists. The concern is that surveillance is expanding faster than the legal framework designed to constrain it. When technology outpaces law, the gap that opens between them is not neutral. It is a space in which rights can be violated without remedy.

The concern is not merely theoretical. Across democratic and developing societies alike, surveillance capabilities originally justified by national security concerns have frequently expanded beyond their initial scope. This phenomenon, sometimes described as “mission creep,” illustrates why privacy protections must be designed not only for governments acting in good faith today, but also for governments and institutions that may wield the same powers tomorrow under different circumstances.

5.3  Freedom of Expression, Journalism, Activism, and the Chilling Effect

One of the most significant and most frequently overlooked consequences of pervasive surveillance is the “chilling effect”: the phenomenon by which the knowledge or reasonable belief that one is being watched causes individuals to modify their behaviour, self-censor their expression, and withdraw from civic participation, even where they have done nothing wrong and face no direct threat.

The chilling effect is particularly acute for journalists, activists, lawyers, and human rights defenders, precisely the categories of individuals whose work is most essential to a functioning democracy. The right to privacy is not, in this context, a personal indulgence. It is an institutional safeguard. It protects not only the individual being watched, but the democratic functions, investigative journalism, civil society advocacy, legal representation, political opposition, that a free society depends upon.

Surveillance powers must remain narrowly defined, judicially supervised, and subject to genuine public accountability. Not because security does not matter, it does, profoundly, but because a state that watches its citizens without constraint is not protecting their freedom. It is undermining it. Innovation needs room to breathe. But in the context of state surveillance, power without boundaries is not liberty. It is exposure.

6.0  Who Owns Your Data?

There is a question that sits at the heart of every conversation about digital privacy, yet is rarely asked directly in Nigerian legal and policy discourse. It is this: when a Nigerian citizen provides their personal data to a government agency, a financial institution, a telecommunications company, or a digital platform, who does that data belong to?

The answer that most people instinctively give is: the individual. It is their name, their biometric information, their financial history, their health records, their location data, their behavioural patterns. Surely, they own it. The answer that current practice in Nigeria most closely reflects is rather different. In practice, personal data, once collected, tends to be treated as an asset belonging to the organisation that collected it. It is stored, processed, shared, licensed, and in some cases sold, often without the meaningful participation of the individual to whom it relates.

This distinction, between owner and subject, is not merely semantic. It has profound consequences for the rights, remedies, and leverage that individuals can exercise over their own information. An owner can grant or withhold permission. An owner can demand return or destruction. An owner can seek compensation when their property is misused. A subject, by contrast, does not enjoy proprietary ownership of personal data. Instead, the law confers a set of statutory rights designed to protect their autonomy, privacy, and control over how their information is processed. While these rights can be extensive, they are not identical to the rights ordinarily associated with ownership.

6.1  The Case for Individual Data Ownership

The proposition that individuals should be regarded as the primary owners of their personal data is the logical extension of principles that Nigerian law already recognises in other contexts. Property law recognises that individuals own the products of their labour. Intellectual property law recognises that individuals own the products of their creativity. The extension of ownership principles to personal data, information generated by the individual’s own existence, behaviour, and identity, is a natural and defensible development of these established doctrines.

The argument for individual data ownership rests on three foundations. The first is dignity: personal data is a representation of a person, and to treat it as the property of whoever happens to have collected it is to treat the person themselves as a resource to be harvested. The second is autonomy: the capacity to control information about oneself is a fundamental dimension of the freedom to author one’s own life. The third is accountability: if individuals are recognised as owners of their personal data, then organisations that collect or process it do so as licensees, not as owners, creating a clearer basis for liability when data is misused.

6.2  What Nigerian Law Currently Provides

The Nigeria Data Protection Act, 2023 does not explicitly declare individuals to be the owners of their personal data. It does, however, grant data subjects a suite of rights, access, correction, objection, withdrawal of consent, portability, and compensation, that are consistent with, and in some respects approximate, an ownership model. What the NDPA stops short of is the full articulation of data as personal property.

The practical consequence is that the individual’s position remains more precarious than a genuine ownership model would provide. Rights can be limited by exceptions. Rights can be difficult to enforce without institutional support. Rights, as we have seen in the context of Nigeria’s enforcement landscape, can exist on paper long before they are realised in practice.

6.3  A Provocation for the Conversation Ahead

The question of data ownership is not one that this article will resolve. It is too large, too contested, and too consequential to be settled in a single discussion. What this article does is plant a seed, one that will be explored in greater depth in the next episode of this series, which will examine the relationship between personal data, artificial intelligence, and intellectual property.

In 2017, The Economist declared in a widely cited article that the world’s most valuable resource is no longer oil, but data, a formulation that has since become one of the defining characterisations of the digital economy. The market capitalisation of the companies built on personal data lends considerable weight to that declaration. Nigerian citizens have provided their data to government agencies, financial institutions, and digital platforms in exchange for an implicit social contract: that the data will be used for the purposes for which it was given, that it will be protected from exploitation, and that its misuse will be met with accountability. The AnyVerify scandal, in which the personal data of potentially 43 million Nigerians was found to be available for purchase online for as little as ₦100 per record, is a measure of how far the current reality falls short of that contract.

The conversation about data ownership is, at its core, a conversation about the terms on which Nigerian citizens participate in the digital economy. It is a conversation that Nigeria’s policymakers, legal practitioners, technologists, and citizens can no longer afford to defer.

7.0  The Nigerian Reality

Every legal framework must ultimately be measured not by the elegance of its provisions but by the experience of the people it is designed to protect. A constitution that guarantees privacy means little to a citizen whose data has been sold online for ₦100. A data protection act with significant penalties means little if the commission charged with enforcing it operates without a budget. And a commitment to international human rights standards means little if the institutions responsible for giving those standards domestic effect lack the independence, resources, and political will to do so.

This is the Nigerian reality. And it must be stated honestly, not as a counsel of despair, but as a prerequisite for meaningful progress.

7.1  The Paradigm Initiative LONDA Report: Nigeria’s Digital Rights Score

In April 2024, Paradigm Initiative published its annual LONDA Digital Rights and Inclusion Report, benchmarking the digital rights performance of 26 African countries. According to Paradigm Initiative’s 2024 LONDA Report, Nigeria’s score was 36 out of 60, a level described as “moderately compliant,” reflecting both genuine progress and continuing, significant shortfalls.

A score of 36 out of 60 is not a failing grade. Nigeria has enacted progressive legislation, established a dedicated data protection commission, and demonstrated a legislative ambition that many African nations have not yet matched. But 60 percent is not adequate protection. The LONDA report identified arbitrary internet disruptions, weak enforcement of data protection laws, surveillance concerns, and inconsistent policies as key factors eroding public trust and undermining the growth of Nigeria’s digital economy.

7.2  The AnyVerify Scandal: A Case Study in Enforcement Failure

No event in recent Nigerian history illustrates the gap between legislative ambition and enforcement reality more starkly than the AnyVerify data scandal of 2024.

On 16 March 2024, the Foundation for Investigative Journalism published an investigation revealing that a website, XpressVerify.com.ng, had gained access to the personal data of Nigerian citizens and was commercialising it for profit. Further investigation by Paradigm Initiative uncovered a second website, AnyVerify.com.ng, operating since November 2023, engaged in the systematic commercial distribution of Nigerians’ most sensitive personal data: National Identity Numbers, Bank Verification Numbers, virtual NINs, Driving Licences, International Passport details, Tax Identification Numbers, Permanent Voter’s Cards, and phone numbers, for as little as ₦100 per data request, as documented in Paradigm Initiative’s June 2024 public statement.

The website was visited 567,990 times in February 2024 alone, and 118,360 times in April 2024. According to Paradigm Initiative Executive Director Gbenga Sesan, the alleged breach potentially affects up to 43 million Nigerians, a figure he disclosed at the organisation’s December 2024 year-end media briefing and reported by Leadership Newspaper. To demonstrate the severity of the breach, Paradigm Initiative took the extraordinary step of purchasing the personal data of senior government officials, including that of the Minister of Communications and Digital Economy, and presenting it as evidence.

On 20 June 2024, Paradigm Initiative served pre-action notices on eight government agencies. Only the NDPC responded. On 24 July 2024, Paradigm Initiative filed a public-interest lawsuit at the Federal High Court in Abuja against nine respondents, seeking declarations that the breach violated Section 37 of the Constitution and Sections 30 and 39 of the NDPA 2023, as well as orders compelling investigation, public disclosure, and compensation, as detailed in the organisation’s press release of that date. The case was scheduled for hearing on 22 January 2025.

The AnyVerify scandal demonstrates that the data entrusted to Nigerian government agencies by citizens is not adequately protected; that the regulatory response has been characterised more by denial than accountability; and that in the absence of robust institutional enforcement, the burden of protecting Nigerians’ digital rights has fallen, to an uncomfortable degree, on civil society organisations operating on limited resources. That is not a sustainable position. Civil society can advocate, litigate, and expose. It cannot replace the state.

7.3  The Enforcement Gap: Zero Naira and Its Consequences

The AnyVerify scandal did not occur in a vacuum. It occurred in an environment shaped by a fundamental institutional weakness that, once understood, makes the scandal less surprising, though no less serious. As Gbenga Sesan disclosed at Paradigm Initiative’s December 2024 year-end media briefing, and as reported by Leadership Newspaper, the Nigeria Data Protection Commission operated in 2024 with a budget of zero Naira.

Let that fact be stated plainly. The institution responsible for enforcing Nigeria’s most important piece of digital rights legislation had no operational budget for an entire year. No funds for investigations. No funds for public awareness campaigns. No funds for the technical capacity required to audit data controllers and processors. A law without an enforcer is a declaration of intent, not a guarantee of protection. The funding of the NDPC is not a budgetary detail. It is a human rights imperative.

7.4  Digital Awareness: The Human Dimension

The most fundamental challenge to privacy protection in Nigeria is not, ultimately, a legal one. It is a human one. The majority of Nigerians who use digital platforms do so without meaningful awareness of the data they are generating, the rights they hold over that data, or the risks to which its misuse exposes them. This is not a criticism of Nigerian citizens. It is an observation about the environment in which we are operating, one in which digital services have expanded far faster than digital literacy and regulation.

Digital literacy is not a luxury. In a world where data determines access to credit, employment, healthcare, and civic participation, understanding how data works, and how to protect it, is as fundamental a life skill as reading and writing. The Nigerian government, civil society, educational institutions, and the private sector all have a role to play in building this literacy. Privacy cannot be protected by people who do not know they have it.

7.5  Reimagining Privacy for the AI Age

As artificial intelligence continues to evolve, policymakers should increasingly adopt a human-rights-based approach to technological governance. Such an approach begins from the premise that innovation is not an end in itself. Rather, technological development should be evaluated against its impact on human dignity, equality, autonomy, accountability, and access to justice. The question is not simply whether artificial intelligence can perform a task more efficiently than humans. The more important question is whether its deployment advances or undermines the rights and freedoms that democratic societies seek to protect.

8.0  Conclusion

Privacy has always been more than a legal right. It is the condition that makes all other rights meaningful. It is the space, physical, psychological, and now digital, in which individuals think freely, speak honestly, associate without fear, and live with the dignity that every human being is entitled to by virtue of their humanity alone. When privacy is eroded, it is rarely eroded all at once. It is eroded gradually, incrementally, often in the name of convenience, security, or efficiency, until the space in which freedom was once exercised has been so comprehensively mapped, monitored, and monetised that freedom itself becomes a diminished thing.

The question posed by the title of this article: are Nigerians prepared? therefore deserves a direct answer. Nigeria is not unprepared in law. It has the constitutional foundation in section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended). It has the beginnings of a statutory framework in the Nigeria Data Protection Act 2023. It has an institutional regulator in the Nigeria Data Protection Commission. It has a vigilant civil society, exemplified by Paradigm Initiative and other digital-rights advocates who have refused to allow privacy violations to pass without challenge. And it has, in its growing community of lawyers, technologists, journalists, and policymakers, the human capital from which a genuine digital-rights culture can be built.

What Nigeria does not yet have, however, is the enforcement reality that translates those foundations into lived protection for ordinary citizens. It does not yet have a data protection regime with the institutional strength, public awareness, technical capacity, and accountability culture necessary to confront the realities of artificial intelligence, algorithmic profiling, facial recognition, large-scale surveillance, and the commercial exploitation of personal data. It does not yet have a legal framework specifically calibrated to the human-rights risks posed by emerging technologies, nor a public digital literacy infrastructure equal to the scale of the transformation already underway.

These are not insurmountable gaps. They are addressable ones. It is encouraging that the Nigeria Data Protection Commission has indicated that the NDPA may be reviewed to respond to emerging technologies such as artificial intelligence, big data, and robotics. That is a welcome development. But the real test will not be whether the law acknowledges technological change. It will be whether it confronts, with seriousness and clarity, the deeper questions raised by that change: who controls personal data, how automated decisions are scrutinised, how surveillance powers are restrained, and how the dignity of Nigerian citizens is protected in a digital economy increasingly built on extraction, inference, and invisible control.

There is also a particular responsibility here for the legal profession. Rights do not enforce themselves, and progressive legislation does not become meaningful merely because it has been enacted. The gap between the promise of the NDPA and the lived experience of Nigerian citizens will narrow only when lawyers litigate, advise, draft, teach, and participate seriously in the shaping of Nigeria’s digital-rights culture.

Ultimately, privacy must be understood for what it truly is: not a technical compliance issue, not a secondary policy concern, and not a right to be negotiated away whenever technology promises efficiency. It is a human-rights question, and in the age of artificial intelligence, it is one of the defining human-rights questions of our time. Nigeria may not yet be fully prepared. But if it is willing to treat privacy not as an obstacle to innovation, but as one of the conditions of democratic freedom itself, it can still build a digital future in which technological progress does not come at the expense of human dignity.

The next article in this series will turn to a related frontier: the relationship between artificial intelligence, intellectual property, and human creativity in Nigerian law.

References and Authorities

• Legislation and Constitutional Instruments

1. Constitution of the Federal Republic of Nigeria 1999 (as amended), ss 37 and 45
2. Nigeria Data Protection Act 2023
3. Nigeria Data Protection Regulation 2019
4. Cybercrimes (Prohibition, Prevention, Etc.) Act 2015
5. Nigerian Communications Act 2003
6. European Union General Data Protection Regulation (EU) 2016/679
7. European Union Artificial Intelligence Act (EU) 2024/1689

• Cases

1. Incorporated Trustees of Digital Rights Lawyers Initiative v National Identity Management Commission (2021) LPELR-55623(CA)

• International Instruments

1. Universal Declaration of Human Rights (1948), art 12
2. International Covenant on Civil and Political Rights (1966), art 17
3. African Charter on Human and Peoples’ Rights (1981)
4. UNESCO Recommendation on the Ethics of Artificial Intelligence (2021) <https://www.unesco.org/en/artificial-intelligence/recommendation-ethics>
5. UN Special Rapporteur on the Right to Privacy, First Report to the Human Rights Council (2016) UN Doc A/HRC/31/64

• Reports and Institutional Publications

1. Paradigm Initiative, LONDA Digital Rights and Inclusion Report: Nigeria (2024) <https://paradigmhq.org/wp-content/uploads/2024/06/Nigeria-Country-Report.pdf>
2. Paradigm Initiative, ‘Major Data Breach: Sensitive Government Data of Nigerian Citizens Available Online for Just ₦100’ (20 June 2024) <https://paradigmhq.org/major-data-breach-sensitive-government-data-of-nigerian-citizens-av ilable-online-for-just-100-naira/>
3. Paradigm Initiative, ‘Press Release: Paradigm Initiative Files a Public-Interest Case to Challenge Recent Data Breach that Saw Personal Data Sold for ₦100’ (24 July 2024) <https://paradigmhq.org/press-release-paradigm-initiative-files-a-public-interest-case-to-chall nge-recent-data-breach-that-saw-personal-data-sold-for-n100/>
4. National Institute of Standards and Technology, ‘Face Recognition Vendor Testing (FRVT) Part 3: Demographic Effects’ (NISTIR 8280, 2019)
5. Institute of Development Studies, ‘African Nations Spending $1bn a Year on Harmful Surveillance of Citizens’ <https://www.ids.ac.uk/news/african-nations-spending-1bn-a-year-on-harmful-surveillance-of-citizens/>
6. TechAfrica News, ‘Nigeria Emerges as Africa’s Largest Buyer of Smart City Surveillance Technology Amid Privacy Concerns’ (March 2026) <https://techafricanews.com/2026/03/24/nigeria-emerges-as-africas-largest-buyer-of-smart-city-surveillance-technology-amid-privacy-concerns/>

• Journal Articles and Academic Works

1. Joy Buolamwini and Timnit Gebru, ‘Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification’ (2018) 81 Proceedings of Machine Learning Research 77 <https://proceedings.mlr.press/v81/buolamwini18a.html>
2. Aleecia M McDonald and Lorrie Faith Cranor, ‘The Cost of Reading Privacy Policies’ (2008) 4 I/S: A Journal of Law and Policy for the Information Society 543
3. Ryan Amos and others, ‘Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset’ in Proceedings of The Web Conference 2021 (Association for Computing Machinery 2021) 2165
4. Isabel Wagner, ‘Privacy Policies Across the Ages: Content and Readability of Privacy Policies 1996–2021’ (2022) arXiv:2201.08739 <https://arxiv.org/abs/2201.08739>

• Selected News and Commentary Sources

1. The Economist, ‘The World’s Most Valuable Resource is No Longer Oil, but Data’ (6 May 2017)
2. Leadership Newspaper, ‘NIMC, CBN, Others Sued over Alleged Digital Rights Breaches’ (December 2024) <https://leadership.ng/nimc-cbn-others-sued-over-alleged-digital-rights-breaches/>
3. Biometric Update, ‘Nigeria’s Abuja, Lagos Airports to Pilot Facial Recognition from NEC to Boost Security’ (March 2023) <https://www.biometricupdate.com/202303/nigerias-abuja-lagos-airports-to-pilot-facial-recognition-from-nec-to-boost-security>
4. NordVPN, ‘Privacy Policy Study’ (2023) <https://nordvpn.com/blog/privacy-policy-study-us/>

 

Continue reading part 3 of the series below:

Can a Machine Truly Create?