By Okoi Obono-Obla
Privacy and Image Rights under the Nigerian Data Protection Act 2023: The Legal Consequences of Unauthorized Use of Personal Data
The advent of information and communication technology has led to an exponential increase in the use of data such as biometrics, phone numbers, emails, WhatsApp, Facebook, banking transactions, and online banking. This surge has heightened our exposure to legal risks, as we may innocently or deliberately breach the law when we use someone’s picture or release another person’s data without their consent.
Therefore, using someone’s image without their consent — particularly if the person is a private individual who is not a public official and not engaged in activities of public interest — amounts to a violation of their privacy rights.
Section 65 of the Nigerian Data Protection Act (NDPA) 2023 defines personal data as any information relating to an identified or identifiable natural person (the data subject). An identifiable person is one who can be recognized, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. By this definition, a person’s image clearly qualifies as personal data, since it can directly or indirectly identify them.
The right to privacy is a fundamental human right under Section 37 of the Constitution of the Federal Republic of Nigeria, 1999. Thus, when someone’s privacy is invaded by using their picture or image without permission or consent, it amounts to a violation of Section 37. Importantly, Section 37 of the Constitution reinforces the provisions of Section 65 of the NDPA.
This position has received judicial approval in the landmark case of Larry Nwabueze vs. Nigerian Breweries Plc. On May 26, 2026, the Lagos High Court ruled that an individual’s image constitutes personal data under the NDPA 2023. The court ordered Nigerian Breweries Plc to pay ₦10 million in damages and ₦500,000 in costs for using Mr. Nwabueze’s image in commercial advertising without his consent.
The court reinforced several key principles regarding privacy and image rights in Nigeria:
– Consent is mandatory: The commercial use of a person’s likeness requires their clear permission.
– Event notices are insufficient: A simple warning sign at an event does not constitute lawful basis for using attendee footage in marketing.
– Right to privacy: Unauthorized commercial use of a person’s face breaches Section 37 of the Constitution.
– Remedies: The court ordered Nigerian Breweries Plc to remove the claimant’s image from all advertising platforms and imposed a permanent ban on any future use.
Furthermore, those who habitually share pictures, images, phone numbers, email addresses, WhatsApp numbers, or any other form of personal data on social media platforms such as Facebook, Instagram, or WhatsApp without the consent of the data subject may be liable for committing an offence under the NDPA 2023. Such conduct can also give rise to civil liability, including payment of damages for a civil wrong.
Conclusion
This landmark judgment and the statutory framework under the NDPA 2023 underscore the importance of respecting privacy and personal data in Nigeria. Unauthorized use of personal images or data is not only unlawful but also exposes individuals and organizations to significant legal consequences.
Leave a comment