Meta Faces Legal Pushback as NDPC Defends $32.8M Data Fine

The Nigeria Data Protection Commission (NDPC) has asked the Federal High Court in Abuja to dismiss a lawsuit filed by Meta Platforms Inc., the parent company of Facebook and Instagram, which challenges a $32.8 million fine and several compliance directives issued against the company for alleged data privacy violations involving Nigerian users.

In a preliminary objection submitted to the court, the NDPC argued that Meta’s suit is “grossly incompetent” and that the court lacks jurisdiction to entertain it. According to the Commission, Meta failed to follow the legal procedures outlined under Order 34 of the Federal High Court (Civil Procedure) Rules, 2019, which guide judicial review applications.

The case stems from a decision issued on February 18, 2025, in which the NDPC fined Meta $32.8 million and issued eight corrective directives for violating Nigeria’s Data Protection Act. The Commission’s action followed a petition by the Personal Data Protection Awareness Initiative (PDPAI), a civil society group that accused Meta of engaging in behavioural advertising on Facebook and Instagram without obtaining users’ express consent.

NDPC’s investigation revealed several alarming infractions, including the unauthorized processing of sensitive personal data—such as users’ sex lives and drug use, altered profiles of journalists, and even explicit childbirth content. The Commission also said Meta failed to file a 2022 compliance audit, violated cross-border data transfer regulations, and processed data of individuals who were not users of its platforms.

Meta has disputed both the findings and the procedure leading to the sanctions. In a motion filed on March 19, 2025, Meta argued that it was denied a fair hearing and due process, as the Commission failed to give adequate notice or provide an opportunity to respond before issuing its final orders. Meta’s lead counsel, Prof. Gbolahan Elias, SAN, requested the court to annul the enforcement orders, arguing they violate Section 36 of the Nigerian Constitution, which guarantees fair hearing.

In response, NDPC’s counsel, Adeola Adedipe, SAN, contended that Meta’s suit is procedurally defective. He noted that the originating summons and the reliefs sought were inconsistent, rendering the entire case flawed. He also accused Meta of attempting to modify its claims under the pretense of an amendment—an approach not permitted under the rules of court. He urged the court to reject the application.

In a follow-up motion on April 23, Meta’s legal team sought permission to amend its filings to align with the reliefs already stated in the originating summons, claiming the changes were for clarity and would not prejudice the respondent.

Justice James Omotosho, who is presiding over the case, earlier granted Meta permission to initiate judicial review proceedings but declined to stay the enforcement of NDPC’s orders. He instead ordered an expedited hearing of the matter. After hearing arguments from both sides, the court adjourned proceedings to October 3, 2025, for a consolidated ruling on both the preliminary objection and the motion to amend.

The $32.8 million sanction is part of NDPC’s broader efforts to enforce the Nigeria Data Protection Act, signed into law by President Bola Tinubu in June 2023. In a related enforcement action, the NDPC also fined Pay-TV provider Multichoice Nigeria N766.2 million for privacy violations, including the unauthorized handling of subscriber data and the illegal transfer of personal data across borders. The Commission reaffirmed its commitment to safeguarding the data rights of Nigerian citizens and holding accountable entities that breach data protection laws.