In September 2022, we shared an update about the three cases we filed challenging rights violations by the Nigerian government and its agencies. In fulfilment of our commitment to transparency, we present the outcome of the case against the Economic and Financial Crimes Commission (EFCC).
The backdrop of this action dates back to 2021, when the EFCC introduced the mobile application "Eagle Eye" with the commendable aim of simplifying the reporting of economic and financial crimes. However, upon review, our team found that certain aspects of the app's operation had the potential to infringe on data protection rights and the law. For example, our research found that the app did not provide users with a privacy notice and uses trackers that share data with advertisers, ignoring data protection by design considerations in a public-facing app used for public interest.
The App was designed to reduce the need for direct person-to-person communication throughout the reporting process, real-time reporting, ensuring anonymity, and providing an additional incentive for effective whistleblowing. Members of the public can use the Eagle Eye to take a picture of a property or persons suspected of being fraudulently or corruptly acquired and report it using the App. Eagle Eye App is intended to go a long way towards assisting in reporting specific fraudulent activities, especially money laundering through real estate.
On September 14, 2021, we submitted a complaint to the National Information Technology Development Agency (NITDA), which at the time was the data protection regulator in the country, detailing our findings. The Regulator promptly responded the following day, September 15, assuring it would review the complaint and take the necessary action. Our complaints also included a broad range of recommendations to address these concerns. After a series of follow-ups without any response, we filed a suit before the Federal High Court a year after asking the court to compel the EFCC to fix the issues to make the app more privacy-preserving.
In our complaint to the court, we presented evidence from a technical analysis that demonstrated the presence of trackers within the app capable of monitoring and profiling users' behaviour. We also identified the third parties receiving data from these embedded trackers. We noted that the app, downloaded over ten thousand times, lacked a privacy notice to explain these trackers or inform users of their rights. The EFCC countered that it does not collect personal data, such as names or email addresses. Still, we argued that online behavioural profiling constitutes personal data, providing the court with substantial resources to clarify our stance.
Our legal team is currently reviewing the decision and deciding on the next steps. A potential outcome may be an appeal to the superior court to review the decision and filing similar complaints before the newly created Nigeria Data Protection Commission.
Nonetheless, we still urge the EFCC to uphold privacy compliance standards by providing a privacy notice to inform users about processing activities on the app and ensuring transparent processing in alignment with both local and international privacy principles, implementing data protection by design considerations, conducting a data protection impact assessment before launching products and deleting trackers not essential for the functioning of the app.
According to Adedolapo Evelyn Adegoroye, the Program Officer at Ikigai Innovation Initiative, “the decision of the court undermines privacy risks inherent within the app, and the court missed an opportunity to extend data protection rights into the online behavioural profiling ecosystem.” According to our report on the use of tracking technologies in Nigeria, we found extensive use of different tracking technologies without sufficient transparency around their existence in both public and private digital platforms. Regrettably, the courts not only failed to recognise the necessity for the EFCC's adherence to mandatory provisions within the Nigerian Data Protection Regulation and its Implementation Framework, but they also fell short in safeguarding individuals' privacy rights. The Nigerian courts' stance seemingly disregards the status of data obtained through behavioural profiling and other online tracking sources as personal data, undermining genuine privacy risks and implications. This is by far a derogation and thwarting of global privacy principles and celebrated landmark cases on online tracking mechanisms.
Contact us at policy@ikigaination.org for more information.