On the 19th of February 2024, Honourable Justice Emeka Nwite, sitting at the Federal High Court in Abuja, ordered one of the world’s largest cryptocurrency exchanges, Binance to divulge information about all Nigerians using its trading platform to the Economic Financial Crimes Commission (EFCC). This incident has generated a lot of controversy on all social media platforms, particularly Twitter where there has been a debate about the legality or otherwise of such order as it relates to violating the data rights of Nigerians. It is against this backdrop that this short piece aims at examining the legality or otherwise of the said court order.
Data Protection in Nigeria is primarily governed by the National Data Protection Act (NDPA) 2023, Nigeria Data Protection Regulation (NDPR), 2019, and the Nigeria Data Protection Regulation Implementation Framework, 2020.
In starting this discourse, the question that begs for an answer is: Does the NDPA apply to Binance as an entity, considering that it is not domiciled in Nigeria?
A quick examination of the application section of the NDPA especially Section 2(2)(c) provides that:
“This Act shall apply, where the …-”
“The data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria”
Flowing from the above, it is evident that while Binance as an entity may not be domiciled in Nigeria, it falls under the NDPA’s coverage under processing the personal data of data subjects in Nigeria.
Also, in as much as the Constitution of the Federal Republic of Nigeria (CFRN) 1999, as amended and other supplementary laws, advocates for the protection of fundamental human rights, there is no single right that is absolute in its entirety. For instance, Section 39 of the CFRN provides that everyone is entitled to freedom of expression, including freedom to hold opinions and to receive and impart ideas and information without interference. This right does not mean that one should defame another person’s character, as where one right stops, another right begins.
Thus, although Section 37 of the CFRN (right to privacy, the NDPA, and NDPR, all advocate for the right and protection of the data of Nigerian citizens, this is not absolute. There exist circumstances under which this right may not avail. These circumstances are provided for under section 3 of the Nigeria Data Protection Act 2023(NDPA).
In this particular scenario, we will be emphasizing Section 3(2)(a)(c) which provides that;
“Subject to the rights and freedoms under the Constitution and the limitations, the obligations under Part V, other than sections 24, 25, 32 and 40 of this Act, shall not apply to a data controller or data processor if the processing of personal data is__
“Carried out by a competent authority for the purposes of the prevention, investigation, detection, prosecution, or adjudication of a criminal offense or the execution of a criminal penalty, in accordance with any applicable law”
“Carried out by a competent authority, as is necessary for national security”
Due to the intelligence received by the Special Investigation Team of the Economic and Financial Crimes Commission that money laundering and terrorism financing are being carried out on Binance, the Commission launched an investigation into the trading platform, and in order to unravel the perpetrators of these criminal acts. Thus, it is not out of place for the Court to grant the Order against Binance.
Conclusively, it is pertinent to reiterate that though there are laws regulating data protection in Nigeria, these laws are not absolute and when violated, the rights of the violators will be given up by the appropriate mechanism. It is therefore safe to say that the order of the court to compel Binance to release the list of customers (data subjects) on its platform is not out of place as it is for the purpose of investigating an alleged crime which Is one of the derogations/exceptions to data privacy rights in Nigeria.
--
Read the original publication at Trusted Advisors