In a landmark ruling, a Nigerian NGO has won its case against Meta, securing USD 100,000 in damages for data protection law violations. Justice Adeniyi Pokanu of the Lagos State High Court delivered the judgment, which Meta has appealed, finding that the tech giant unlawfully profiled and monitored users through behavioral advertising.
The case, Incorporated Trustees of Laws and Rights Awareness Initiative and others v Meta Platforms, was filed on 14 January by Incorporated Trustees of Laws and Rights Awareness Initiative (ITLRAI), an organisation focused on civil liberties, and digital and information rights. The group acted on behalf of Nigerian users of Meta’s Facebook and Instagram social media products.
Background to the Case
The applicants sought multiple declarations, including that Meta had engaged in non-consensual collection, processing, profiling, and use of personal data in breach of the Nigerian constitutional right to privacy. This potentially affected over 60 million Nigerians, with the application also asserting Meta’s breaches of the Nigerian Data Protection Act 2023 (NDPA) provisions covering transparency, privacy, and cross-border data flows.
Meta filed its objections on 29 April, seeking dismissal and strike-out based on procedural breaches and jurisdictional issues. However, the judge found substantially in the applicants’ favour, citing the persistence of profiling, absence of meaningful consent, difficulty of opting out, unlawful intrusion into applicants’ private life autonomy and informational self-determination as reasons for the decision.
Decision and Appeal
The court did not grant all the requested relief, particularly in regard to the damages sought. It held that a finding of behavioural advertising is insufficient on its own to warrant damages under the NDPA; rather, it must be shown that there was contravention of the NDPA, that the respondent is classed as a Data Controller or Data Processor, and that the applicant suffered damage, which must have arisen from the behavioural advertising.
The applicants were awarded USD 100,000 in general damages, together with NGN 1 million in costs. Olumide Babalola, counsel for the successful applicants, stated that the judgment is significant because it affirms that the commercial model of a global technology platform cannot override the privacy and data protection rights guaranteed to Nigerians.
Babalola added that the mere acceptance of general terms and conditions cannot, without more, constitute meaningful consent to behavioural profiling and targeted advertising. Users of such platforms are entitled to know what is being done with their personal data, why it is being done and the lawful basis for doing it. Meta has appealed the decision, which the applicants plan to defend through the appellate process.
Broader Implications
The case has implications for global technology companies operating in Nigeria, as they must comply with Nigerian data protection law. In August last year, the Nigerian Data Protection Commission launched a multi-sector investigation into suspected data protection breaches. The commission’s actions and the court’s decision in this case demonstrate the growing importance of data protection in Nigeria.