A Federal High Court sitting in Abuja, Nigeria's capital, has ordered Eat'n'Go, owners of the Domino’s Pizza and Cold Stone Creamery franchise in Africa, to pay ₦3 million ($1,997)to one Chukwunweike Akosa Araka for sending a direct marketing message to his mobile line without his consent.
According to court documents shared by Olumide Babalola, convener of Nigeria's privacy community, PrivCon, Ecart Internet Services Nigeria Limited, otherwise known as Jumia Food, breached Araka's data protection rights by sharing his contact details with Eat'n'Go for direct marketing purposes.
In the lawsuit, which was filed on July 12, 2024, the applicant — Araka — stated that Jumia Food and Eat'n'Go breached at least 11 data privacy laws by sharing and retaining his contact details for direct marketing purposes.
The applicant demanded ₦20,000,000 for exemplary damages, ₦100,000,000 for general damages and breach of fundamental human rights, and ₦5 million as cost of litigation. However, Justice Emeka Nwite ordered Eat'n'Go to pay ₦3 million to the applicant for the breach of fundamental human rights.
Details of the court proceedings showed that the applicant used the now-defunct Jumia Food in March 2023 to order from Domino's Pizza.
Seven months later, he was "bombarded with direct marketing messages from Domino's Pizza." Despite requesting via email that Domino’s Pizza stop sending the messages, they continued, causing distress to the applicant.
Araka’s lawyers argued that the direct marketing messages sent by Domino's Pizza were not covered under the lawful basis provided by the Nigeria Data Protection Act (NDPA).
The NDPA, which was signed into law in June 2023, explicitly mandates that companies must obtain user consent before using personal information for direct marketing.
This ruling reinforces the legal requirement for consent and the consequences of non-compliance.
Give it a try, you can unsubscribe anytime. Privacy Policy.
This case highlights the broader issue of unchecked data breaches in Nigeria, where businesses frequently share user data without permission. Babalola told Techpoint Africa that "the case aligns with the growing trend of data privacy rulings we've seen since the Nigeria Data Protection Act came into effect two years ago. It serves as a crucial reminder that businesses must familiarise themselves with the compliance landscape in Nigeria, as the rules around data protection have fundamentally changed."
He also urged customers to hold companies accountable as there is now legal precedent to protect their rights.
Data privacy violations are particularly rampant in sectors like e-commerce, fintech, and telecoms, often leading to consumer complaints with little to no action taken.
The judgment also sets an important legal precedent. While the ₦3 million penalty is significantly lower than what Araka sought, it serves as a warning to businesses that mishandle customer data.
As more Nigerians become aware of their data privacy rights, companies may face increased scrutiny and potential lawsuits if they fail to comply with existing regulations.
For communities like PrivCon, which advocate for data protection enforcement, this ruling is a win. However, it also underscores the extent of data rights violations that many Nigerians endure frequently, even after multiple complaints.
This case may encourage stricter enforcement of the NDPA and push businesses to prioritise data protection, ensuring that customer information is handled with the necessary legal and ethical considerations.
