Digital Surveillance, Data Privacy, and Fundamental Rights in Nigeria

Contributor: Iyanuoluwa Animasaun

Introduction

Digital surveillance has become a defining feature of modern governance. In Nigeria, the expansion of state and commercial surveillance capabilities has outpaced the development of adequate legal safeguards. Government agencies now collect and process personal data on an unprecedented scale, while private companies routinely obtain vast amounts of information through mobile applications, digital financial services and identity-linked platforms.

These developments raise urgent concerns about constitutional rights, democratic accountability and the rule of law. The right to privacy, once associated primarily with physical spaces and private communications, must now extend to data collection, biometric systems, digital tracking and algorithmic decision-making. The central question is no longer whether surveillance occurs, but whether it is lawful, necessary, proportionate and subject to effective oversight.

Constitutional and Statutory Framework^[1]

Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) provides the principal constitutional protection for privacy. It guarantees the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications. Although broadly framed, Nigerian courts have not fully developed the scope of this provision in relation to digital surveillance and contemporary data-processing technologies.^[2]

Sections 34 and 35 of the Constitution are also relevant. Section 34 protects the dignity of the human person, while section 35 guarantees the right to personal liberty. Read together with section 37, these provisions provide a constitutional basis for challenging surveillance practices that are arbitrary, unlawful or disproportionate. The Fundamental Rights (Enforcement Procedure) Rules 2009 provide the procedural framework for enforcing these rights before a competent court.

At the statutory level, the Nigeria Data Protection Act 2023 represents the most significant legislative development in this area. The Act establishes a framework for the lawful processing of personal data, confers enforceable rights on data subjects and imposes obligations on data controllers and data processors. It also establishes the NDPC as the principal regulatory and enforcement authority. Unlike the Nigeria Data Protection Regulation 2019, the Act derives its authority directly from legislation and provides stronger institutional and enforcement mechanisms.

Other relevant legislation includes the Cybercrimes (Prohibition, Prevention, etc) Act 2015, the Nigerian Communications Act 2003 and the National Identity Management Commission Act 2007. Collectively, these statutes regulate electronic communications, lawful interception, access to subscriber information and the administration of biometric identity systems. However, their relationship with the Nigeria Data Protection Act 2023 is not always clear or coherent. Consequently, Nigeria’s legal framework for digital surveillance and data privacy remains fragmented.

The Reality of Digital Surveillance in Nigeria

Digital surveillance in Nigeria occurs at two principal levels: state surveillance and private-sector surveillance. State agencies such as the Department of State Services, the National Intelligence Agency, the Economic and Financial Crimes Commission and the Nigeria Police Force conduct various forms of surveillance. These activities include intercepting communications, monitoring online activity, deploying facial-recognition technology and extracting data from electronic devices.

In many instances, the legal basis and procedural safeguards governing these activities remain unclear. Nigerian courts have also considered matters involving digitally obtained intelligence in criminal and civil proceedings, including applications to freeze bank accounts and prosecutions arising from online activity. These cases raise significant concerns about the lawfulness and admissibility of evidence obtained through electronic surveillance, particularly where the authorities conduct such surveillance without prior judicial authorisation.

Closed-circuit television infrastructure has also expanded across major urban centres, including Lagos, Abuja and Port Harcourt. However, no comprehensive statutory framework specifically regulates the collection, storage, access, use and retention of surveillance footage. Because such footage may identify individuals, it constitutes personal data and falls within the scope of data protection law. Nevertheless, compliance with applicable data protection principles and obligations remains inadequate.

Biometric Databases and Identity Governance

Nigeria has developed one of Africa’s most extensive biometric identity systems. The National Identity Management Commission administers the National Identity Database, which contains fingerprints, facial images and iris scans. The Independent National Electoral Commission maintains a separate biometric voter register, while the Nigerian Communications Commission has implemented the linkage of Subscriber Identity Module cards with National Identification Numbers. This policy connects telecommunications records with individuals’ national identity data.^[3]

These databases contain sensitive personal data and raise important legal questions. What lawful basis supports the collection and processing of the data? Who may access it, and under what circumstances may it be disclosed to law-enforcement agencies or third parties? What remedies are available where public authorities or private entities misuse or unlawfully disclose the data?

Although national security considerations may partly justify the National Identification Number–Subscriber Identity Module linkage policy, its implementation reveals a broader governance problem: the persistent gap between policy objectives and effective privacy safeguards. Concerns about identity fraud, insider abuse and the unauthorised disclosure of biometric information demonstrate the need for a comprehensive biometric data governance framework.^[4] The Nigeria Data Protection Act 2023 (NDPA) provides an important foundation, but it cannot, by itself, adequately address the distinct risks associated with the collection, integration, use and retention of biometric data.

Fintech and Private Surveillance

Nigeria’s financial technology sector is among the country’s most data-intensive industries. Digital banks, payment processors, lending platforms and mobile money service providers routinely collect transaction records, location data, device identifiers, contact lists and, in some cases, biometric information.

Many service providers rely on consent as the lawful basis for processing such data. However, they often obtain consent through lengthy click-through terms and conditions that users accept without reading or fully understanding them. Under the NDPA, valid consent must be freely given, specific, informed and unambiguous. In practice, many consent mechanisms used by financial technology companies may not satisfy these requirements.

Excessive data collection presents a related concern. Some financial technology applications collect substantially more information than is necessary to provide their services, including access to users’ contact lists, photographs and location histories. Such practices violate the principle of data minimisation and increase the risk of misuse. This risk is particularly evident where digital lenders contact borrowers’ relatives, friends or colleagues to shame them or exert pressure for repayment.^[5]

Regulatory action against certain digital lenders represents a positive development. However, isolated sanctions have not created a strong and systematic enforcement regime capable of producing lasting changes in industry practices.

Telecommunications and Lawful Interception^[6]

The telecommunications sector also raises significant privacy concerns. The Nigerian Communications Act 2003 and the Cybercrimes (Prohibition, Prevention, etc) Act 2015 contain provisions governing the lawful interception of communications, disclosure of subscriber information and access to the content of communications. In principle, these laws require proper legal authorisation, including a court order where applicable.^[7]

In practice, however, the interception regime lacks transparency. Public authorities do not publish data on the number of interception orders issued, the agencies that obtain them or the mechanisms used to supervise their execution. Without transparency reports and effective independent oversight, it is difficult to determine whether surveillance powers are exercised lawfully and proportionately or abused without public scrutiny.

Reports concerning the use of International Mobile Subscriber Identity catchers also raise serious concerns. These devices imitate telecommunications base stations and may collect information from mobile devices within a particular area. Their use without a clear statutory basis, prior judicial authorisation and adequate safeguards would raise substantial constitutional and data protection concerns.

Strengths and Weaknesses of the NDPA 2023

The NDPA represents a significant advancement in Nigeria’s data protection framework. It incorporates the core principles of modern data protection law, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and accountability. In this respect, the Act brings Nigeria’s regulatory framework closer to internationally recognised data protection standards.^[8]

Despite this progress, significant gaps remain.

Firstly, the Act does not expressly establish a comprehensive framework for regulating surveillance by state security and intelligence agencies. This omission is particularly concerning because these agencies possess extensive powers and technological capabilities for intrusive, large-scale data processing.

Secondly, the Act does not adequately address the distinct risks associated with large biometric databases maintained by government institutions. Given the sensitivity and permanence of biometric data, such databases require more specific safeguards governing access, integration, retention, disclosure and security.

Thirdly, the Act does not impose a general requirement for prior judicial authorisation whenever government agencies seek access to personal data held by private entities. The absence of such a requirement in relevant circumstances weakens procedural safeguards against arbitrary or disproportionate access.

Fourthly, limited institutional capacity constrains effective enforcement. Although the NDPC has broad regulatory and enforcement powers, it must supervise millions of data controllers and processors operating across a complex and rapidly expanding digital economy.

Finally, the provisions governing cross-border transfers of personal data have not been sufficiently operationalised. This creates uncertainty for local businesses, multinational companies and other organisations that routinely transfer or process personal data across national borders.

The Nigeria Data Protection Commission

The NDPC is the principal regulatory and enforcement authority under the Nigeria Data Protection Act 2023. Its responsibilities include investigating complaints, examining the activities of data controllers and processors, imposing sanctions and promoting public awareness of data protection rights and obligations.

The Commission’s initial enforcement measures, particularly those concerning digital lenders and sector-specific regulatory guidance, demonstrate some promise. Nevertheless, the scale of its mandate remains considerable. It must regulate a rapidly expanding digital economy despite limited human, financial and technical resources.^[9]

The Commission’s institutional independence is equally important. Effective regulation requires protection from political interference and regulatory capture. The Commission must also strengthen its coordination with other relevant institutions, including the Central Bank of Nigeria, the Nigerian Communications Commission, the National Information Technology Development Agency and the Independent National Electoral Commission. Overlapping regulatory mandates may create uncertainty, inconsistent enforcement and confusion among regulated entities. A structured inter-agency framework would promote greater coherence, regulatory clarity and accountability.

Judicial Engagement and the Need for a Constitutional Standard

Nigerian courts have addressed digital privacy only sporadically as a distinct constitutional issue. Most disputes have arisen indirectly through questions concerning the admissibility of electronic evidence, access to frozen bank accounts or the use of digitally obtained information, rather than through direct consideration of the legality of surveillance practices.

The Supreme Court has not yet articulated a definitive constitutional standard for digital surveillance. This gap is significant. Without clear judicial guidance, law enforcement agencies operate within an uncertain legal framework, while citizens lack a settled understanding of the scope and limits of their constitutional rights.

The proportionality test provides the most appropriate standard. Under this test, any restriction of a constitutional right must pursue a legitimate aim, be rationally connected to that aim, impair the right no more than is reasonably necessary and maintain an appropriate balance between the public interest and the affected right. This approach accords with constitutional rights jurisprudence and section 45 of the Constitution.^[10]

Courts exercising jurisdiction over fundamental rights claims are well placed to develop this area of jurisprudence. Strategic litigation could help establish clearer legal limits on warrantless interception, the misuse of biometric data, the deployment of facial-recognition technology in public spaces and compulsory access to financial or communications data.

Recommendations

Nigeria requires a stronger and more coherent legal framework for digital surveillance and data protection. The following reforms are necessary:^[11]

1. Enact dedicated legislation on surveillance and the interception of communications, with clear requirements for prior judicial authorisation, independent oversight and transparency.
2. Amend the NDPA to include express provisions governing state surveillance and the processing of personal data by security and intelligence agencies.
3. Enact legislation specifically regulating the collection, use, storage, disclosure, retention and deletion of biometric data.
4. Strengthen the NDPC through increased funding, enhanced technical capacity and the establishment of a specialised surveillance oversight unit.
5. Establish formal coordination mechanisms between the NDPC and relevant sectoral regulators.
6. Encourage strategic litigation aimed at developing clear constitutional jurisprudence on digital surveillance and privacy.
7. Require all government digital systems, including identity, health and financial platforms, to incorporate privacy-by-design and privacy-by-default standards.

Conclusion

Digital surveillance has created a new frontier in the relationship between state power and individual freedom. In Nigeria, the legal and institutional framework governing this relationship remains incomplete, fragmented and inconsistently enforced. Although the NDPA provides a strong foundation for protecting personal data, its objectives can only be achieved through effective institutions, clearer legislation and robust judicial oversight.

The constitutional rights to privacy, dignity and personal liberty remain fully applicable in the digital age and have become increasingly important as surveillance capabilities expand. A state that can intercept communications, track movements and profile individuals without adequate legal restraint risks undermining democratic accountability and public trust. Nigeria must therefore develop a legal order in which surveillance technologies remain subject to constitutional safeguards, institutional oversight and effective remedies, ensuring that the exercise of state and corporate power remains accountable to individual rights.

Reference:

1. The right to privacy in the digital age’ 71/199 (2017) UN General Assembly Resolution ↑
2. Constitution of the Federal Republic of Nigeria 1999 (as amended), ss. 37, 45; see SERAP v. FGN (ECOWAS Court, 2010) on proportionality in rights limitation, Amnesty International v. Sudan (ACHPR) on digital surveillance and human rights ↑
3. NDPA 2023, s. 30 (special categories of personal data); NIMC Act 2007, ss. 18-20 (identity database provisions). ↑
4. See NDPC Enforcement Actions 2023-2024; NCC NIN-SIM Linkage Directive 2020; reports of NIMC data breaches documented by Paradigm Initiative Nigeria ↑
5. See J Terstegge ‘Privacy in the law’ in M Petkovíc & W Jonker (eds) Security, privacy, and trust in modern data management (2017) 13-14; OECD Privacy Guidelines (n 36) para 1(b); CoE Convention 108/1981. Accessed on 24th June 2026 ↑
6. Nigerian Communications Act 2003, s. 146 (lawful interception); Cybercrimes Act 2015, s. 38 (preservation and disclosure of data). ↑
7. INCORPORATED TRUSTEES OF DIGITAL RIGHTS LAWYERS INITIATIVE & ORS v. NIMC (2021) LPELR-55623(CA) ↑
8. ↑
9. Aelex ‘A summary of the Nigeria data protection Bill 2022’, https://www.aelex.com/asummary-of-thenigeriadata-protection-bill-2022/ accessed 24 June 2026. ↑
10. Check YE Ayalew ‘The right to privacy in the digital era in Africa’ (2022) 12 International Data Privacy Law 16, 19. accessed by 24th June 2026 ↑
11. Check EB Sultanov and others ‘Transformation of the right to privacy in the context of the development of digital technologies’ (2022) 7 BiLD Law Journal 223, 228 accessed by 24th June 206 ↑