A Federal High Court in Lagos has given the Lagos University Teaching Hospital (LUTH) 14 days to make available to Media Rights Agenda (MRA) the information requested by the organization in its May 22, 2020 letter regarding the medical institution’s data protection policies and practices under the Nigeria Data Protection Regulation (NDPR), 2019.
Justice Yellim Bogoro said since LUTH has pleaded that it could not comply with MRA’s request earlier because its administrative staff who possessed the required information were at home as a result of the lockdown arising from the COVID-19 pandemic when MRA made the request and has said on oath that it is now ready to comply with the request, there was nothing wrong with the court extending the time for LUTH to provide MRA with the information if the parties so wished.
The judge, however, declined to grant MRA’s claim for exemplary damages against LUTH as well as the organization’s request for an order compelling the Attorney-General of the Federation to initiate criminal proceedings against the institution for wrongful denial of access to the information. He said although the FOI Act did not provide for the situation that arose during the COVID-19 pandemic, the court could not close its eyes to the global phenomenon that shut down the world, including Nigeria, in the light of the institution’s explanation of its failure to disclose the information.
The comments and the order giving LUTH 14 days to provide the information were made by Justice Bogoro while delivering judgment in a suit instituted by MRA against the LUTH Management Board, its Chief Medical Director and the Attorney-General of the Federation challenging the medical institution’s refusal to disclose the information it applied for by a letter dated May 22, 2020, signed by Mr. Ayode Longe, then MRA’s Director of Programmes.
In the suit instituted on MRA’s behalf by Mr. Owolabi Dawodu, a Lagos-based lawyer, MRA asked the Court to compel LUTH to make available the information it requested in its May 22, 2020 letter in which it asked, among other things, for copies of all the institution’s data protection policies issued in conformity with the NDPR; the name and contact details of its Data Protection Officer, designated in accordance with the NDPR and its relevant data privacy instruments and data protection directives.
In resolving the issues presented to him for determination, Justice Bagoro held in his judgment that MRA has the right to request information from LUTH and its Chief Medical Director under the FOI Act and that it also has a right to apply to the court to compel them to disclose information that is wrongfully withheld from them, subject to the exemptions contained in the Law.
He also ruled that generally speaking, a public institution has an obligation to provide information requested by an applicant, as long as the information does not fall under the categories of exempted information and is not inhibited by any section of the FOI Act.
Observing that MRA had not countered LUTH’s claim in its counter-affidavit that it could not comply with MRA’s request because its administrative staff in possession of the required information were already at home as a result of the lockdown arising from the COVID-19 pandemic when MRA made the request, Justice Bagoro noted that the Act did not provide for such circumstances possibly because its drafters never envisaged a situation like that.
He said: “I think the justice of this case will demand that looking at the circumstances of this case, the court should not shut its eyes and ears to the cry for justice. The COVID-19 pandemic was a global phenomenon that shut the world virtually and Nigeria was not immune and exempted from the scourge of the pandemic. It is not a hidden point as it is open to all and we are all witnesses to the fact that the country, including all Government offices, were shut down for a considerable time frame due to the COVID-19 pandemic.”
The judge added that in that situation where due to the lockdown, it was impracticable for LUTH to deal with MRA’s demand letter within the statutory number of days provided and even to write for an extension of the time, the justice of the case will demand that LUTH cannot be held liable for non-compliance with the provisions of the FOI Act.
He said since LUTH has averred on oath that it is ready to comply by providing the information demanded, there is nothing wrong for the court to extend the time for it to provide the information requested by MRA, if the parties so wish.
Justice Bagoro ruled that “I am of the view that justice will demand that the first respondent (LUTH) shall within 14 days from today, the day of this judgment, provide the information required by the Plaintiff (MRA).”
He, however, held that LUTH’s Medical Director is not a juristic person, adding that it “is the position of the law that only juristic personality can sue and be sued.”
The judge therefore ruled that the suit could not be maintained against LUTH’s Chief Medical Director and accordingly struck out the name of the Medical Director from the suit and dismissed the case against him.
He made an order that LUTH “shall provide the information as sought”, namely:
• Copies of all data protection policies of LUTH, issued in conformity with the NDPR;
• The name and contact details of LUTH’s Data Protection Officer, designated in accordance with the NDPR, together with LUTH’s relevant data privacy instruments and data protection directives;
• Details of all capacity building training or other capacity building activities undertaken for the Data Protection Officer and other personnel of the institution involved in any form of data processing since the issuance of the NDPR;
• The number of persons or individuals whose personal data the LUTH processes on an annual basis, that is over a period of 12 months.
• A report from a detailed audit conducted by LUTH of its privacy and data protection practices in accordance with the NDPR. The audit report should contain the following information:
(a) the personally identifiable information that LUTH collects on its employees and members of the public;
(b) the purpose for which the personally identifiable information is collected;
(c) copies of any and all notices given to individuals regarding the collection and use of their personal information;
(d) details of any access or opportunities given to individuals to review, amend, correct, supplement, or delete their personal information collected or held by LUTH;
(e) information on whether or not consent is obtained from an individual before personally identifiable information is collected, used, transferred, or disclosed and details of any method used to obtain consent;
(f) copies of the policies of LUTH and details of its practices for ensuring the security of personally identifiable information;
(g) copies of the policies of LUTH and details of its practices for the proper use of personally identifiable information;
(h) copies of LUTH’s policies and details of its procedures for privacy and data protection;
(i) copies of LUTH’s policies and details of its procedures for monitoring and reporting violations of privacy and data protection policies; and
(j) copies of LUTH’s policies and details of its procedures for assessing the impact of technologies on its stated privacy and security policies.
