The legal battle between the Nigerian Data Protection Commission (NDPC) and Meta Platforms Inc., parent company of Facebook and Instagram, has escalated as the Commission seeks to dismiss Meta’s challenge against a $32.8 million sanction and a series of compliance directives.
At the heart of the dispute are allegations of data privacy violations involving Nigerian users, including unauthorized behavioral advertising and the misuse of sensitive personal data.
NDPC Challenges Meta’s Suit
In a preliminary objection filed at the Federal High Court in Abuja, the NDPC described Meta’s suit as “grossly incompetent,” asserting that the court lacks jurisdiction to hear the case. The Commission claims Meta failed to comply with the requirements for judicial review under Order 34 of the Federal High Court (Civil Procedure) Rules, 2019.
The dispute arose from the NDPC’s decision on February 18, 2025, to impose a $32.8 million fine on Meta, alongside eight corrective compliance orders. The sanctions followed a petition by the Personal Data Protection Awareness Initiative (PDPAI), a civil society organization, accusing Meta of conducting behavioral advertising without the express consent of Nigerian users.
Alarming Findings
According to the NDPC, investigations revealed serious violations, including:
- Unauthorized processing of sensitive personal data, such as the sex lives and drug use of minors.
- Manipulation of journalists’ profiles.
- Dissemination of explicit childbirth content.
- Failure to file a 2022 compliance audit.
- Breach of cross-border data transfer regulations.
- Processing data belonging to individuals who are not Meta platform users.
Meta Fights Back
Meta is contesting both the NDPC’s findings and the procedure leading to the enforcement orders. In a motion filed on March 19, the tech giant alleged it was denied fair hearing and due process, claiming that the NDPC did not provide sufficient notice or opportunity to respond before issuing the final orders.
Meta’s lead counsel, Prof. Gbolahan Elias, SAN, urged the court to nullify the NDPC’s enforcement actions, arguing that they violate Section 36 of the Nigerian Constitution, which guarantees the right to a fair hearing.
Procedural Clash
In response, the NDPC’s legal representative, Adeola Adedipe, SAN, contended that Meta’s originating summons and accompanying statements of facts were misaligned, thereby rendering the suit defective. He accused Meta of trying to smuggle in fresh claims disguised as amendments — a procedural violation, in his view.
However, on April 23, Meta filed a motion to amend its original filing to harmonize its prayers for relief with the originating summons. The company maintains that the amendment is for clarity and will not prejudice the NDPC’s position.
Court Ruling Pending
Justice James Omotosho, presiding over the matter, previously granted Meta permission to initiate judicial review proceedings but rejected its application to stay the NDPC’s enforcement orders. Instead, the court ordered an accelerated hearing.
Following arguments from both sides, Justice Omotosho adjourned the matter to October 3, 2025, when he is expected to deliver a consolidated ruling on both the NDPC’s preliminary objection and Meta’s application for amendment.
A Landmark Test for Nigeria’s Data Law
The case marks a significant test of Nigeria’s Data Protection Act, enacted in June 2023 under President Bola Tinubu’s administration. The law empowers the NDPC to regulate data privacy, enforce compliance, and levy penalties for violations. If upheld, the NDPC’s sanction against Meta would be the most high-profile enforcement action to date under the new legal framework.
Source: ITPulse
