At the 2024 edition of BizFest - a prominent industry conference ("BizFest" or the "Conference"), participants convene to network, exchange insights, and discuss the latest business trends. Among them is Adanu, a technology executive engaging in a private discussion and presenting an unrevealed product prototype. As is customary with prominent events in Nigeria, photographers contracted by the Conference organisers capture various moments including enthusiastic attendees, lively panel debates, and Adanu's private interaction and demonstration. These images are subsequently shared on the Conference's social media channels and website's photo section, consistent with past practices aimed at commemorating the event for archival purposes.

The illustrated scenario, which is increasingly prevalent in Nigeria, serves as a backdrop for the discussion in this blog post. We frequently attend conferences, large gatherings such as weddings, sporting events, and similar occasions, where our photographs are taken and utilised by event organisers for archival purposes and sometimes promotional endeavours. While encountering a photograph of oneself or an acquaintance from such a prominent event online is often met with delight, it raises questions when the image inadvertently reveals sensitive information or are used for purposes such as marketing and promotion (commercial purposes), or a purpose other than what is usually expected, such as archival purposes. This blog post aims to explore the position of the Nigerian Data Protection Act, 2023 (NDPA or the “Act”) regarding data protection and image rights.

According to the definition of Personal Data In the NDPR,¹ an image of a person amounts to personal data and as such, must be handled according to the data protection principles provided by the NDPR.² Under the NDPA, personal data can only be collected and processed in accordance with the guiding principles outlined in the Act, which require that personal data be processed in a fair, transparent and lawful manner, for specific, and legitimate purposes (“Prerequisites”). While the Act enumerates additional principles, this blog post focuses on those considered Prerequisites for the collection and processing of personal data which shall be discussed below.

Fair and lawful processing

The Act delineates two overarching criteria for lawful data processing, one of which must be satisfied.³ First, data processing is lawful if the data subject has provided and not rescinded consent for the specified purpose. Second, processing is deemed lawful if it is necessary to fulfil certain conditions, such as performance of a contractual obligation involving the data subject, compliance with legal obligations, protection of vital interests, or fulfilment of tasks carried out in the public interest or exercise of official authority (“Lawful Purposes”).

What the above entails for the BizFest organisers is that for their data processing to be considered lawful, they must either obtain the consent of the Conference attendees prior to processing their respective data, in this case, photographing them and posting online or elsewhere, or meet one of the other Lawful Purposes. Given the options presented by the Act under lawful processing, obtaining consent from attendees seems more judicious in this digital age. A request for consent can be integrated into the digital registration form, typically utilised for conference sign-ups, with a simple opt-in feature. As the Act also requires that consent at any given time must not have been rescinded, the organisers must also provide attendees with the option to opt out if they no longer wish to have their photographs published.

In an era where social media presence influences perception, attendees are likely to welcome the opportunity for their images to be disseminated by reputable conferences, as it contributes to personal branding. However, exceptions to this expectation exist, underscoring the importance of exercising discretion in content selection. For instance, utilising the specific example of Adanu in the illustration above, sharing a photograph of him capturing his private interaction and demonstration may contravene fair and lawful practices which would directly violate attendees' privacy.

Legitimate purposes

Once the fair and lawful processing criteria is met, the data processor must now consider the legitimacy of the purpose for processing.

According to the Act, if a data processing overrides the fundamental rights, freedoms and the interests of the data subject, they are incompatible with other lawful basis of processing as described above or are of such a nature that the data subject would not have reasonable expectation that the data would be processed in certain manner, then the interests in processing the personal data according to the Act would not be considered legitimate.⁴

As illustrated by the Bizfest scenario above, attendees of the BizFest Conference, judging by past events, would have a reasonable expectation that their photographs from the Conference would be posted on the social media pages of the event organisers or on their website, so the event organisers can justify legitimate interests. However, it would also be reasonable for the organisers to ensure that the data processing does not override any fundamental rights of the data subjects and is not inconsistent with other lawful basis.

It should be noted that the Act requires that data collected to be processed for legitimate purposes shall be explicit and specific and not to be further processed in a way incompatible with these purposes. What this means is that if the organisers of Bizfest have obtained the consent of the Conference attendees to process their personal data for post-event reports and have satisfied the legitimate purposes criteria, the organisers must not further process the data collected in a way that is inconsistent with the legitimate purpose or in a way that was not specifically or explicitly communicated to the attendees such as selling the data to a third party without explicit consent or generally repurposing the data for different uses not originally communicated.

As the digital landscape continues to evolve, the capturing and utilisation of individuals' images whether for archival or promotional purposes require a nuanced approach that carefully considers and adheres to the data processing principles provided under the NDPA.

Consent appears to be a foundational principle in the Act, thereby necessitating proactive measures by organisers to obtain explicit permission from attendees for photographing and subsequent usage and the concept of legitimate purposes serves as a critical checkpoint, requiring organisers to assess whether their data processing activities align with the expectations and rights of the data subjects. While leveraging event images for promotional endeavors may be justifiable within the framework of legitimate interests, organisers must ensure transparency and consistency in their approach.

1. Means any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual.
2. S. 24, The Nigerian Data Protection Act, 2023
3. S.25(1), The Nigerian Data Protection Act, 2023
4. S.25(2), The Nigerian Data Protection Act, 2023