JEE Africa

INTRODUCTION 

On 18th February 2025, Honourable Justice Emeka Nwite of the Federal High Court of Nigeria sitting in Abuja, delivered a significant judgment in the case of Chukwunweike Akosa Araka v. Ecart Internet Services Limited & Eat ‘N’ Go Limited. The judgment is important because it expands the law on the concept of purpose limitation and the legality of marketing communications under Nigerian data protection law. Below we provide a summary of the decision of the court and highlight the implications for businesses. 

SUMMARY OF THE CASE 

The Applicant’s Case 

Chukwunweike Araka (the ‘Applicant’) was a frequent user of the now defunct Jumia Food, a food delivery application owned by Ecart Internet Services Limited (the ‘1st Respondent’). The 1st Respondent’s business model was to host and advertise vendors for the patronage of the users of its application. To facilitate this relationship, the 1st Respondent shared the user’s contact details with the vendors.  

Eat ‘N’ Go Limited (the ‘2nd Respondent’), owners of Domino’s Pizza, was a vendor on the Jumia Food application and was frequently patronised by the Applicant. Months after placing an order on to the 2nd Respondent through Jumia Foods, the Applicant began to receive marketing communications from the 2nd Respondent. Aggrieved, the Applicant sent an email to the 1st Respondent demanding the cessation of marketing communications from the 2nd Respondent. The 1st Respondent communicated the Applicant’s demand to the 2nd Respondent; however, the marketing communications continued.  

The Applicant sued the 1st and 2nd Respondents. Amongst other reliefs, the Applicant sought declarations that the use of his personal data for direct marketing purposes violated his right to privacy and the principle of purpose limitation. He also sought declarations that the continued processing of his personal data despite his request for deletion breached his rights to erasure and right to object. The Applicant also sought exemplary damages in the sum of N20,000,000 and general damages in the sum of N100,000,000. 

The 1st Respondent’s Defence 

In its defence, the 1st Respondent argued that it had fulfilled its legal obligations by putting the necessary safeguards in place. It also argued that it had defined the purpose of processing when sharing personal data with the 2nd Respondent and stated any unauthorised processing was not done on its instruction. It demonstrated that it had duly conveyed the Applicant’s request for the deletion of his personal data to the 2nd Respondent.  

The 2nd Respondent’s Defence 

On the other hand, the 2nd Respondent argued that the Applicant had consented to the use of personal data to deliver its services and that the data was processed in a fair, lawful and transparent manner and retained for as long as necessary. It also stated that it complied with the Applicant’s request for deletion of his personal data. However, the subsequent market communications were triggered by the Applicant’s patronage of their services through another food delivery application, ‘Glovo’. The 2nd Respondent also argued that its marketing communications contain an opt-out button which the Applicant could have used to end the communications. 

The Court’s Judgment 

In its judgment, the Court took the view that the 1st Respondent had fulfilled its obligations by using the Applicant’s personal data appropriately as the marketing communications did not emanate from the 1st Respondent. It also found that the 1st Respondent had followed due procedure in alerting the 2nd Respondent of the Applicant’s demand that his personal data be deleted. Therefore, the court deemed that the 1st Respondent had discharged its duty of care.  

However, the Court noted that the under the Nigeria Data Protection Act 2023 (NDPA), the processing of personal data must be limited to the purposes for which it was given. As the Applicant only provided consent to the processing of his personal data to fulfil his food orders, the use of that personal data for marketing communications violated the NDPA. The Court held that the presence of an opt-out button in such marketing communications is not a defence, as sending such communications was illegal to begin with. In all, the Court found that the 2nd Respondent violated the Applicant’s privacy rights and the provisions of the NDPA. Consequently, the Court awarded the Applicant general damages of N3,000,000. 

IMPLICATIONS FOR BUSINESSES 

The court's decision to absolve the 1st Respondent while holding the 2nd Respondent liable highlights an important lesson: organizations that comply with the NDPA and other data protection laws can avoid legal penalties. The 1st Respondent’s prompt and effective action in responding to the data subject's request was pivotal, showcasing a strong understanding of Nigeria's data protection laws. In contrast, the 2nd Respondent failed to meet its obligations. 

This case follows a recent trend of data subjects’ awareness and enforcement of their privacy rights. To ensure compliance and mitigate risks, it is crucial for organizations to regularly assess their personal data processing activities and provide training to help staff recognize and appropriately respond to data subjects’ requests. 

Jackson, Etti & Edu is a licensed Data Protection Compliance Organisation, fully equipped to provide guidance on data protection compliance, including audits, training and remediation services.