Legality Or Otherwise Of The Order Compelling Binance To Release The List Of Nigerian Traders On Its Platform To EFCC – Privacy Protection

On the 19^th of February 2024, Honorable Justice Emeka
Nwite, sitting at the Federal High Court in Abuja, ordered one of
the world’s largest cryptocurrency exchanges, Binance to
divulge information about all Nigerians using its trading platform
to the Economic Financial Crimes Commission (EFCC). This incident
has generated a lot of controversy on all social media platforms,
particularly Twitter where there has been a debate about the
legality or otherwise of such order as it relates to violating the
data rights of Nigerians. It is against this backdrop that this
short piece aims at examining the legality or otherwise of the said
court order.

Data Protection in Nigeria is primarily governed by the National
Data Protection Act (NDPA) 2023, Nigeria Data Protection Regulation
(NDPR), 2019, and the Nigeria Data Protection Regulation
Implementation Framework, 2020.

In starting this discourse, the question that begs for an answer
is: Does the NDPA apply to Binance as an entity, considering that
it is not domiciled in Nigeria?

A quick examination of the application section of the NDPA
especially Section 2(2)(c) provides that:

“This Act shall apply, where the
…-“

“The data controller or the data processor is
not domiciled in, resident in, or operating in Nigeria, but is
processing personal data of a data subject in
Nigeria”

Flowing from the above, it is evident that while Binance as an
entity may not be domiciled in Nigeria, it falls under the
NDPA’s coverage under processing the personal data of data
subjects in Nigeria.

Also, in as much as the Constitution of the Federal Republic of
Nigeria (CFRN) 1999, as amended and other supplementary laws,
advocates for the protection of fundamental human rights, there is
no single right that is absolute in its entirety. For instance,
Section 39 of the CFRN provides that everyone is entitled to
freedom of expression, including freedom to hold opinions and to
receive and impart ideas and information without interference. This
right does not mean that one should defame another person’s
character, as where one right stops, another right begins.

Thus, although Section 37 of the CFRN (right to privacy, the
NDPA, and NDPR, all advocate for the right and protection of the
data of Nigerian citizens, this is not absolute. There exist
circumstances under which this right may not avail. These
circumstances are provided for under section 3 of the Nigeria Data
Protection Act 2023(NDPA).

In this particular scenario, we will be emphasizing Section
3(2)(a)(c) which provides that;

“Subject to the rights and freedoms under the
Constitution and the limitations, the obligations under Part V,
other than sections 24, 25, 32 and 40 of this Act, shall not apply
to a data controller or data processor if the processing of
personal data is__

“Carried out by a competent authority for the purposes
of the prevention, investigation, detection, prosecution, or
adjudication of a criminal offense or the execution of a criminal
penalty, in accordance with any applicable law”

“Carried out by a competent authority, as is necessary
for national security”

Due to the intelligence received by the Special Investigation
Team of the Economic and Financial Crimes Commission that money
laundering and terrorism financing are being carried out on
Binance, the Commission launched an investigation into the trading
platform, and in order to unravel the perpetrators of these
criminal acts. Thus, it is not out of place for the Court to grant
the Order against Binance.

Conclusively, it is pertinent to reiterate that though there are
laws regulating data protection in Nigeria, these laws are not
absolute and when violated, the rights of the violators will be
given up by the appropriate mechanism. It is therefore safe to say
that the order of the court to compel Binance to release the list
of customers (data subjects) on its platform is not out of place as
it is for the purpose of investigating an alleged crime which Is
one of the derogations/exceptions to data privacy rights in
Nigeria.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.