The Incorporated Trustees of the Digital Rights Lawyers Initiative (DRLI) have dragged the Independent National Electoral Commission (INEC) before the Federal High Court in Yenagoa, Bayelsa state, over the commission’s alleged failure to publish a privacy policy on its official website.
In Suit No. FHC/YNG/CS/148/2026, the applicants are challenging the absence of a privacy policy on INEC’s official website, https://wp1.inecnigeria.org/, arguing that the commission has failed to disclose how the personal data of website users, voters and other data subjects is collected, processed, stored, shared and protected.
In the suit, the applicants who are Incorporated Trustees of the Digital Rights Lawyers Initiative (for and on behalf of its members in Bayelsa State and other parts of Nigeria) and Solomon Etisang, while INEC is the sole respondent.
Filed through their counsel, Dr. Olumide Babalola, the suit contends that INEC’s failure to publish a privacy policy violates Section 24(1)(a) of the Nigeria Data Protection Act (NDPA), 2023, which requires data controllers to provide transparent information on the processing of personal data. The applicants also argue that the omission infringes the constitutional right to privacy guaranteed under Section 37 of the 1999 Constitution (as amended).
The suit is one of a growing number of public interest actions seeking judicial enforcement of the Nigeria Data Protection Act since it came into force in 2023. Digital rights advocates have increasingly resorted to litigation to compel public institutions and private organisations to comply with the country’s data protection and privacy obligations amid concerns over weak enforcement.
The case is expected to test the scope of transparency obligations imposed on public institutions under the NDPA, particularly agencies that process large volumes of citizens’ personal information
The claimants in the suit are asking the court to declare that INEC’s failure to publish a privacy policy constitutes a breach of its statutory transparency obligations under the NDPA. They further seek declarations that the commission has breached its duty of care under Section 24(3) of the Act and failed to comply with its obligation under Section 27(1) to provide relevant information to data subjects.
The reliefs sought among others is for court to grant an order compelling INEC to immediately publish a comprehensive privacy policy on its official website detailing how personal data is collected, processed, retained, disclosed, and safeguarded. The applicants are also seeking an order directing the commission to file an affidavit of compliance within seven days of complying with the judgment.
INEC operates one of Nigeria’s largest databases of personal information, containing the biometric and demographic records of millions of registered voters.
The applicants argue that the absence of a publicly accessible privacy policy raises serious concerns over transparency, accountability, and citizens’ ability to understand how their personal data is managed.
Meanwhile, as of the time of filing this report, INEC had not filed a public response to the suit.
Also, no date had been fixed for hearing.
