In January 2021, instant messaging application - WhatsApp updated its privacy policy, which among several introductions, enabled certain information (such as contact details and the content of some messages) to be shared with Facebook and potentially used for advertising purposes. Users who did not wish to share this data were given the option to delete their accounts while users who gave their consent were not given the option to subsequently withdraw their consent.

Following widespread backlash over the privacy policy update, WhatsApp LLC and its parent company, Meta Platforms Inc (together referred to as "Meta" clarified that the data intended to be collected and shared, was on interactions with business accounts, not private messages between friends and family. Despite this clarification, privacy concerns regarding WhatsApp continued to linger.

In Nigeria, the Federal Competition Consumer Protection Commission ("FCCPC" commenced a joint investigation with the Nigerian Data Protection Commission ("NDPC") into the possible violation of Nigeria's data privacy and competition laws arising from the privacy policy update. On 12 July 2024, the FCCPC relying on the joint report, imposed a fine of US$220, 000, 000 (Two Hundred and Twenty Million United States Dollars) on Meta for allegedly violating the Nigeria Data Protection Regulation, 2019 (the

"NDPR"). The joint report stated that Meta "...over a protracted period of time have engaged in conduct that constitutes multiple and repeated, as well as continuing infringements of the Federal Competition Consumer Protection Act, 2018 (the "FCCPA") and NDPR, particularly, but not limited to abusive, and invasive practices against data subjects/consumers in Nigeria, such as appropriating personal data or information without consent, discriminatory practices against Nigerian data subjects/consumers or disparate treatment of consumers/data subjects compared with other jurisdictions™ (Emphasis supplied). The investigation also found Meta in breach of the FCCA for the abuse of its dominant market position. Meta have however indicated their intention to appeal the sanctions meted by the FCCPC.

Meta's Alleged Violation of the NDPR and FCCPA

Data protection laws primarily seek to safeguard the privacy of personal data of users in our fast-evolving digital world by ensuring lawful collection, processing, and transfer of personal data. The NDPC currently takes the lead as the primary regulator responsible for administering the Nigeria Data Protection Act 2023 (the "NDPA"? since being passed. On the other hand, consumer protection laws exist to promote the safeguard of end user or consumer rights in relation to the sale and purchase of products and services. The FCCPC is empowered to administer the FCCPA, and any other enactments focused on the protection of Nigerian consumers.

The joint report alleged that from its thirty-eight-month long investigation, it found that WhatsApp's privacy policy and practices had:

Failed to provide users the opportunity to withdraw consent from the privacy policy, contrary to the NDPR. The difference in the treatment meted out to Nigerian users compared to Europeans was considered

"discriminatory' to Nigerian users given the

NDPR was modeled after the EU's General Data Protection Regulation (the "GDPR").*

Deprived Nigerian users of the right to consent to the use and processing of their data by

"coercing" users into updating the application through repeated notifications to update the application, "threatening" to withdraw access to the application and subsequently limiting functionality for users who failed to update the application.

Sought to obtain excessive personal data than was required for lawful processing in the provision of its service and in addition bundled consent requested from data subjects...