Digital Rights Group Sues FIRS, NIMC, CBN, Others On Massive Data Breach

A digital rights advocacy organization, Paradigm Initiative, has launched a legal battle against the Nigerian government over a massive data breach that has exposed the personal information of millions of Nigerians. The lawsuit, filed in October 2024, targets several government agencies, including the National Identity Management Commission (NIMC), Central Bank of Nigeria (CBN), Nigeria Immigration Service, and Federal Inland Revenue Service.

The alleged breach exposed sensitive personal data such as National Identity Numbers (NINs), home addresses, phone numbers, and passport details of an estimated 43 million Nigerians. This data, which was reportedly accessed and sold by hackers, poses significant risks to individuals’ privacy and security.

Paradigm Initiative’s Executive Director, Gbenga Sesan, has criticized the government’s response to the breach, accusing it of a lack of transparency and accountability. Sesan pointed out inconsistencies in official statements, including the initial denial of a breach followed by an acknowledgment and investigation. He also highlighted the inadequate funding and independence of the Nigeria Data Protection Commission (NDPC), which hampers its ability to effectively enforce data protection laws.

He stressed that, Paradigm Initiative is taking this step, following allegations that surfaced in April 2024 about hackers gaining unauthorised access to national databases, claiming that personal data—including National Identity Numbers (NINs), home addresses, phone numbers, and passport details—was illegally accessed and sold.

According to Sesan, this breach potentially affects up to 43 million Nigerians. “When the data of ordinary Nigerians is breached, nobody does anything. To draw attention to the issue, Paradigm Initiative purchased the personal data of senior government officials, including the Minister of Communications and Digital Economy, and used it as evidence to push for legal action,” he stated.

The lawsuit seeks to establish accountability for the data breach, ensure the protection of citizens’ personal information, and set a precedent for data protection in Nigeria. Paradigm Initiative is calling for greater transparency, stricter oversight of data handling practices, and a stronger commitment to safeguarding digital rights.

The organization also raised concerns about the government’s reliance on third-party vendors to manage sensitive national data, emphasizing the need for increased oversight and accountability. Sesan criticized the government’s forced enrollment of Nigerians in the NIN registration process, arguing that the promised benefits of enhanced security have not materialized.

The data breach has broader implications for national security, as it raises questions about the reliability of government systems meant to protect sensitive information. The lawsuit aims to address these issues and ensure that the government takes responsibility for its actions and protects the rights of its citizens.

In her opening remarks, the chief operating officer, Paradigm Initiative, Nnena Paul-Ugochukwu, said: “Africa is at the forefront of a global digital revolution, bringing unprecedented opportunities in education, health, business, and governance. However, Ugochukwu highlighted significant challenges, including the widening digital gap, data privacy violations, censorship, and poor digital governance. While technology has enhanced our lives, these challenges hinder economic growth, social progress, and the fundamental rights of citizens,”

The COO also pointed to the disturbing trends of internet shutdowns, digital surveillance, and algorithmic biases, which threaten freedom of expression and disproportionately affect underserved communities.