The tribunal's decision, delivered on Friday by a three-member panel led by Thomas Okosun, upheld the initial $220 million penalty imposed by the FCCPC on WhatsApp and Meta for engaging in discriminatory data-sharing practices concerning Nigerian users. The tribunal also dismissed the appeal filed by WhatsApp and Meta, which sought to overturn the substantial fine.
The legal teams representing both sides, with Professor Gbolahan Elias (SAN) arguing for WhatsApp and Meta, and Babatunde Irukera (SAN), former Executive Vice Chairman of the FCCPC, representing the Commission, presented their final arguments to the tribunal on January 28, 2025.
As previously reported by Nairametrics, WhatsApp and Meta had lodged an appeal citing 22 grounds for overturning the FCCPC's penalty. Their arguments included allegations of vague directives, unjustifiable demands for data sharing, and procedural irregularities in the Commission's actions. The appellants contended that the FCCPC's demands were technically unfeasible within the given timeframe and lacked sufficient legal basis under Nigerian law.
The FCCPC's initial fine stemmed from an investigation into alleged breaches of data protection regulations and consumer rights by Meta and WhatsApp. The Commission had voiced concerns over what it described as Meta's potentially abusive and invasive practices affecting the personal data of Nigerian users.
In their appeal, WhatsApp and Meta argued that the FCCPC had denied them a fair hearing by imposing such a significant penalty without providing a clear methodology for its calculation or affording them an adequate opportunity to respond to the proposed amount. They further claimed that implementing a consent mechanism for every data point processed for Nigerian users, as mandated by the FCCPC, would be practically impossible and prohibitively expensive.
However, the FCCPC countered, asserting that the $220 million penalty was not merely punitive but aimed at rectifying the companies' alleged discriminatory practices. The Commission emphasized its findings, which indicated that Meta had engaged in exploitative practices that infringed upon constitutional guarantees by allowing unauthorized access to and misuse of private user information.
Professor Elias urged the tribunal to disregard foreign legal precedents cited by the FCCPC, arguing their irrelevance to the Nigerian legal framework. He also contended that there was no abuse of market dominance, as Nigerian users have alternative social media and communication platforms such as TikTok and Google Meet available to them.
In response, Irukera implored the tribunal to uphold the FCCPC's orders and dismiss the appeal entirely. While acknowledging that foreign law is not binding in Nigeria, he argued that it can be persuasive in analogous situations. The FCCPC also sought and was partially granted the tribunal's permission to submit supplementary records to support a fair adjudication of the dispute.
In its verdict, the tribunal affirmed the FCCPC's reliance on foreign legal decisions as appropriate and persuasive. While partially blocking the entirety of the FCCPC's requested records, the tribunal admitted the Commission's internal memo, an email from Udo Udoma Law Firm, and an internal memo dated May 7, 2024, as supplementary evidence.
The tribunal concluded that the FCCPC's final and supplementary orders were validly executed in accordance with the FCCPC Act and the Evidence Act. Furthermore, it held that WhatsApp and Meta had failed to provide substantial evidence to refute the FCCPC's findings of discriminatory practices.
Addressing WhatsApp's claims of a denial of a fair hearing, Justice Okosun stated that this issue was resolved in favor of the FCCPC, as the social media giants were afforded ample opportunity to present their case. "The appellants were given ample opportunity to be heard," he affirmed.
"The tribunal finds that the FCCPC did not exceed its powers while making orders in respect to data protection," the tribunal stated, adding that the Commission acted within its lawful mandate to address market dominance. The tribunal specifically found that Meta and WhatsApp acted improperly in transferring consumer data to third parties without explicit consent, thereby contravening Nigeria’s data protection laws.
The tribunal explicitly agreed with the FCCPC's contention that the privacy policies of WhatsApp and Meta were in breach of Nigerian law. "The tribunal finds no error in the overall orders of the FCCPC," it stated. "Accordingly, the administrative penalties of the FCCPC were lawfully imposed on Meta and WhatsApp," the tribunal concluded, dismissing the appellants' appeal in its entirety.
Consequently, the tribunal issued the following directives:
- Meta parties must immediately reinstate the right of Nigerian users to determine how their data is shared.
- Meta parties must submit a letter of compliance to this effect by July 1, 2025.
- Meta parties must ensure their application is updated to allow Nigerians to fully express their legitimate right to relate with each data point.
- Meta parties must provide their proposed policy to the FCCPC and the Nigeria Data Protection Commission (NDPC) within 10 days, and the same must be publicly published.
- Meta shall immediately cease the process of sharing Nigerian users’ information with Facebook and other third parties.
- The tribunal directed Meta to immediately revert to its data-sharing policy of 2016.
- Meta parties must cease tying WhatsApp data to Facebook and other third parties without explicitly seeking and obtaining consent from Nigerian users and must provide evidence of compliance.
- Meta must reimburse the FCCPC $35,000 for its investigation.
- Meta must pay the $220 million fine no later than 60 days from Wednesday, April 30, 2025.
Following the FCCPC's initial orders, WhatsApp had stated, "In 2021, we globally informed users about how talking to businesses would work. While there was initial confusion, it has proven quite popular."
Notably, significant fines for data privacy violations are not unprecedented. The European Data Protection Board previously fined Meta a record €1.2 billion for non-compliance with EU privacy regulations. Over the past five years, major tech companies like Amazon, Meta, and Google have faced substantial penalties under the European Union’s General Data Protection Regulation (GDPR).
The latest ruling by the Nigerian tribunal underscores the growing global scrutiny of Big Tech's data handling practices and reinforces the importance of adhering to local data protection laws and respecting users' rights to control their personal information. The decision now places the onus on Meta and WhatsApp to comply with the tribunal's directives and potentially reshape their data-sharing policies for Nigerian users.