Award-winning journalist and publisher of the online newspaper, BONews, Ms Blessing Oladunjoye, has won her Freedom of Information (FOI) suit against the Yaba College of Technology (YABATECH) as a Federal High Court in Lagos ordered the institution to pay her N300,000 as exemplary and aggravated damages for wrongfully denying her access to the information she requested and directed it to make available to her all the information she asked for.
The court’s judgment arose from a suit filed by Ms Oladunjoye against YABATECH and its Rector following the institution’s failure to grant her access to information relating to its compliance with the Nigerian Data Protection Regulations (NDPR), 2019, which she requested by a letter dated October 26, 2020.
In his judgment, Justice Daniel Emeka Osiagor described the information sought from YABATECH by Ms Oladunjoye as being of “public interest” and stressed that compliance with the FOI Act is mandatory in enhancing transparency and accountability in the public sector.
The judge held that the failure or refusal by YABATECH to grant her access to the information she requested by her letter dated October 26, 2020 was a violation of her right of access to information, which is established and guaranteed by Sections 1(1) and 4 of the FOI Act.
Mr. Owolabi Dawodu, a Lagos-based lawyer and member of Media Rights Agenda’s network of lawyers, filed the suit on behalf of Ms Oladunjoye on March 1, 2022, against YABATECH and the rector of the institution, asking the court to declare that the failure and/or refusal by the institution to grant Ms Oladunjoye access to the information requested in her letter dated October 26, 2020 is a violation of her right of access to information established and guaranteed by Sections 1(1) and 4 of the FOI Act.
She also asked the court for an order compelling YABATECH to disclose or make available to her the information, which she had requested in her letter, namely:
- Copies of all data protection policies of YABATECH, issued in conformity with the NDPR;
- The name and contact details of the Data Protection Officer of YABATECH, designated in accordance with the NDPR, together with the institution’s relevant data privacy instruments and data protection directives;
- Details of all capacity building training or other capacity building activities undertaken for the Data Protection Officer of YABATECH and other personnel of the institution involved in any form of data processing since the issuance of the NDPR;
- The number of persons or individuals whose personal data YABATECH processes on an annual basis, that is over a period of 12 months.
- A report from a detailed audit conducted by YABATECH of its privacy and data protection practices in accordance with the NDPR. The audit report should contain the following information:
(a) the personally identifiable information that YABATECH collects on its employees and members of the public;
(b) the purpose for which the personally identifiable information is collected;
(c) copies of any and all notices given to individuals regarding the collection and use of their personal information;
(d) details of any access or opportunities given to individuals to review, amend, correct, supplement, or delete their personal information collected or held by YABATECH;
(e) information on whether or not consent is obtained from an individual before personally identifiable information is collected, used, transferred, or disclosed and details of any method used to obtain consent;
(f) copies of the policies of YABATECH and details of its practices for ensuring the security of personally identifiable information;
(g) copies of the policies of YABATECH and details of its practices for the proper use of personally identifiable information;
(h) copies of YABATECH’s policies and details of its procedures for privacy and data protection;
(i) copies of YABATECH’s policies and details of its procedures for monitoring and reporting violations of privacy and data protection policies; and
(j) copies of YABATECH’s policies and details of its procedures for assessing the impact of technologies on its stated privacy and security policies.
Other reliefs sought by Ms Oladunjoye included an order directing YABATECH and its rector to pay to her the sum of N1 million as exemplary and aggravated damages for the flagrant and unlawful violation of her right of access to information and the wrongful denial of the information to her.
In his judgment, Justice Osiagor disagreed with YABATECH that the information requested by Ms Oladunjoye fell within the exemptions provided in Section 15(1) of the FOI Act, describing as “very strange” the institutions interpretation that the information she asked for amounted to trade secrets, financial information or personal information on third parties.
After listing in detail all the information requested by Ms Oladunjoye in her letter to YABATECH, he asked “is this information categorized as personal data that ought to be protected?”
The judge also quoted copiously from the FOI Act and referred to the National Information Technology Development Agency (NITDA) Act of 2007, noting that NITDA “is mandated by the Act to develop regulations for electronic communication that may improve the exchange of data and information as an alternative to paper-based methods in government.”
According to him, in January 2019, the Director-General of NITDA signed the NDPR under the NITDA Act, Section 4.1(1) of which provides “all public and private organizations in Nigeria that control data of natural persons shall within three months after the date of the issuance of the Regulations make available to the general public their respective data protection policies, these policies shall be in conformity with the regulations”.
Justice Osiagor observed that it is under these Regulations combined with the FOI Act that Ms Oladunjoye wrote to YABATECH on October 26, 2020 demanding to know about their data policies but received no response.
He said YABATECH’s refusal to comply with the FOI Act and the NITDA Regulations 2019 was hinged on the information requested by Ms Oladunjoye consisting mostly of trade secrets and commercial or financial information obtained from third parties based on its claim that the journalist sought “personal information of persons and/or third parties.”
Reproducing Ms Oladunjoye’s request letter in full, the judge said: “this information in the main seeks to know the state of compliance by the Respondents in the education sector in complying with the NITDA Regulations and thus enhancing migration from paper-based to paperless correspondence in governance as the preamble to the Regulation demand.”
He stressed that “These demands are of public interest as compliance with the Freedom of Information Act concerning the Data Protection Regulation, 2019 is made mandatory in enhancing transparency and accountability in the public sector.”
Justice Osiagor noted that the information requested by Ms Oladunjoye fit into the records which all public institutions are required to keep about their activities, operations and businesses under Section 2(1) of the FOI Act and are thus not the personal data of third parties as argued by YABATECH.
He held that having decided the issue in favour of Ms Oladunjoye, he found merit in her suit. He, therefore, granted all the reliefs sought by her, but said he would reduce her claim for damages from N1 million to N300,000.
