Connect with us

E-Business

NDPC Asks Court  to Dismiss Meta’s Suit Challenging $32.8m Fine

Published

on

Kindly share this post

Nigeria Data Protection Commission (NDPC) has prayed the Federal High Court (FHC) in Abuja to dismiss, in its entirety, a suit filed by Meta Platforms, Inc. challenging the sanctions imposed on it.

NDPC Asks Court  to Dismiss Meta’s Suit Challenging $32.8m Fine

The NDPC had, on Feb. 18, imposed both a remedial fee of 32,800,000 million US dollars and eight corrective orders against Meta Inc.

The American multinational technology company was alleged to have violated the fundamental privacy rights of its Nigerian users with respect to behavioural advertising on Facebook and Instagram.

Dissatisfied with the action, Meta Platforms Inc., in a motion ex-parte dated and filed on Feb. 26, dragged the regulatory agency to court as sole respondent.

In the motion ex-parte marked: FHC/ABJ/CS/355/2025 and moved by Fred Onuofia, SAN, on March 4, Justice James Omotosho granted one of the two orders sought.

The judge had granted leave to Meta to commence proceedings by way of judicial-review seeking, inter alia, an order of certiorari quashing the compliance and enforcement orders dated Feb. 18 issued by NDPC against the company, “and all other investigations, proceedings and actions taken by respondent against the applicant leading to the ‘Final Orders.’”

He, however, refused to grant Meta’s relief seeking a stay of the proceedings of all matters relating to the “Final Orders” issued by NDPC against it, pending the hearing and determination of the judicial review proceedings.

Instead, the judge made an order of accelerated hearing of the suit.

The firm, in its originating summons filed by Prof. Gbolahan Elias, SAN, lead counsel,  wants the court to determine whether NDPC’s investigative process and ensuing compliance and enforcement orders (the Final Orders) issued on Feb. 18 were invalid, null and void.

Meta, in its application dated and filed March 19, hinged the question on the allegation that the commission failed to provide it with adequate notice or an opportunity to be heard on alleged violations of the NDP Act prior to issuing the “Final Orders.”

Meta argued that such action violated its due process rights, including its right to fair hearing under Section 36 of the 1999 Constitution (as amended), among other reliefs.

But NDPC, in a preliminary objection to Meta’s suit, told the court that the suit is incompetent and the court lacks the jurisdiction to entertain same.

The regulatory agency, in its application dated April 10 and filed April 11 by Adeola Adedipe, SAN, its lawyer and the head, ALPHA & ROHI Law Firm, urged the court to either strike out or dismiss the case.

Adedipe, in two grounds of argument, submitted that the originating summons filed by the company is incompetent for non-compliance with the mandatory provision of Order 34 Rule 6(1) of the FHC (Civil Procedure) Rules, 2019.

Quoting the provision, the lawyer said: “No ground shall be relied upon or any relief sought at the hearing, except the grounds and reliefs sought in the statement.”

He also argued that the suit, as presently constituted, is grossly incompetent and academic, the reliefs sought therein, not being capable of activating the jurisdiction of the court.

“The suit is liable to be struck out/dismissed, in limine,” Adedipe argued.

The NDPC, in the affidavit attached to the preliminary objection, stated that by an ex-parte motion, Meta Inc. filed the case.

The commission said that the company had filed the suit, seeking leave to apply for judicial review against the decision of the respondent taken on Feb. 18.

It averred that there was a statement made pursuant to Order 34 of the Rules of the court, supporting the said application, containing the company’s two reliefs.

It said the court granted permission on March 4 for Meta to commence the proceeding, by way of judicial review.

According to the respondent, the originating summons filed by the plaintiff was commenced on 19th March, 2025, 15 days after leave was granted for the judicial review proceedings to be commenced.

NDPC, however, contended that the reliefs contained in the originating summons were completely different from the reliefs contained in the statement filed to support the ex-parte application for judicial review.

It said it believes that this error on the part of Meta was fundamental and “the defendant/applicant (NDPC) does not intend to waive its right to object, in this regard.”

“The defendant/applicant does not intend to waive its rights in challenging these fundamental errors, which are fatal to this proceeding and jurisdiction of the court.”

The commission said it would be in the interest of justice for its objection to be sustained.

Also, in a counter affidavit deposed to by Osunleye Olatubosun, NDPC ‘s staff,  in opposition to the originating summons filed by Meta on March 19, he said the suit was brought under the judicial review procedure, primarily, to contest the decision of his office against Meta.

Olatubosun averred that in the NDPC ‘s decision, Meta was sanctioned after a protracted and thorough process of investigation.

He said the investigative power of the commission was activated by a petition written by an organisation, the Personal Data Protection Awareness Initiative (PDPAI).

The PDPAI had alleged that the company breached the data protection rights of users of Facebook and Instagram.

He averred that in the said petition, the plaintiff was alleged to be engaging in behavioural advertising without obtaining explicit consent of data subjects (users).

He said compelling evidence were provided in support of the petition, revealing Meta’s private policy showing that it conducted behavioural advertising, without obtaining consent from the data subjects.

The officer, in the counter affidavit dated and filed on April 30, described behavioural advertisement as “a special form of targeted advertising, where consumers are shown advertisements based on their behavioural data.”

He said it is a kind of advertising which collects and tracks individual sensitive information, without their knowledge or consent, to either share with third parties, or to decide specialised advertisements to be shown to the consumers.

Olatubosun said during investigation, NDPC drew the company’s attention to some very disturbing violations in this regard, especially as to non-consensual data processing activities.

He said these included the disclosure of sensitive personal data of minors relating to their sex lives; sensitive personal data of minors involving drug use; and sensitive personal data of minor pupils in school, involving erotic dancing.

He said it also revealed sponsored advertisements on gambling, involving the manipulated personal data of a female journalist on TVC; sponsored advertisement on gambling involving the manipulated personal data of a male journalist on Channels; and manipulated personal data of public figures, conspiring to commit a felony; explicit video of a woman delivering a child, with her genitals in full display, etc.

He said Meta was, therefore, found in breach of certain provisions of the Nigeria Data Protection (NDP) Act, and that its promotion of debasing images outside the expectation of concerned data subjects offended the principles of fairness, lawfulness, transparency, accountability and duty of care.

Besides, the officer said failure of the company to file a compliance audit with the commission for the year 2022, was a breach of the NDP Act.

He equally said that cross border transfer of data by Meta, contravened mandatory requirements under the NDP Act.

Olatubosun, who said that it was wrong for the plaintiff to process the data of its non-users of it platforms, added that Meta’s privacy policy violates relevant provisions of the NDP Act.

Against these development, the officer said the commission ordered the firm to, henceforth, “seek express consent of data subjects in Nigeria, where their personal data for behavioural advertising will be process.

“Carry out Data Processing Impact Assessment, taking into account the democratic development of Nigeria; update its privacy policy; cease and desist from transferring data out of Nigeria without approval of the commission, in line with the NDP Act.

“Create an appropriate icon link for educative videos, on the dangers of manipulative, unlawful and unfair data processing; put in place sufficient measures for the protection of data privacy on its platforms; and payment of 32, 800, 000 USD.”

Olatubosun said that the case lacks merit, praying the court to dismiss it.

Meanwhile, other reliefs sought by Meta in the main suit, include whether NDPC’s initiation of its investigation, based on a petition submitted by an organisation, rather than on a complaint filed by a “data subject” (as defined under Section 65 of NDPA), invalidates the investigation and the “Final Orders.”

It also prayed the court for an order of certiorari, quashing the investigation, all proceedings constituted thereby, as well as the ensuing “Final Orders” issued by the commission against it.

It equally sought an order of injunction restraining NDPC from enforcing or taking steps to enforce any or all of the orders and/or intimidating, harassing or coercing the applicant to pay the purported remedial fee as contained in the “Final Orders.”

However, Meta, in a motion on notice filed on April 23, sought to amend its statement attached to the ex-parte application, having seen through the notice of preliminary objection which was filed by Adeola Adedipe, SAN, on behalf of the commission.

Onuofia, SAN, while adopting all their processes, said the motion sought an order granting leave to the company to amend its statement pursuant to Order 34, Rule 3(2)(a) of the FHC rules.

He said it also sought an order deeming the amended statement, which had already been filed and served on NDPC as having been properly filed and served.

Giving grounds why his application should be grated, Onuofia said on March 4, the court heard and granted their motion ex-parte for leave.

He said, thereafter, Meta filed it originating summons on March 19.

The lawyer, however, told the judge that the firm sought to amend the wording of the reliefs and grounds set out in the statement to replicate the wording used in the originating summons.

He said the decision was to ensure efficiency and the full and fair hearing of the issues arising in the originating summons.

According to him, the proposed amended statement highlights the amendments that the applicant seeks permission to make to the statement.

Onuofia said the requested amendment would not cause any injustice to NDPC.

But Adedipe vehemently opposed Onuofia’s prayer seeking an amendment, urging the court to dismiss the application.

The senior counsel told the court that a counter affidavit was filed on May 2 in opposition to the motion.

He argued that the application was presumptuous and misleading.

He submitted that an amendment of a process is not as of right, but entirely at the discretion of the court, where such is practicable and lawful to do so.

Adedipe argued that the reliefs sought in a statement attached to a judicial review procedure cannot be amended, except the grounds for which the reliefs are premised.

He said the reliefs contained in the statement, are such that must be reproduced in the originating process filed, after leave had been granted for judicial review.

According to him, the applicant seeks to amend the reliefs set out in the unattached predicate “statement.”

“There can be no amendment to incompetent reliefs set out in the statement,” he said.

The lawyer argued that to concede that the reliefs contained in the predicate statement should be amended, was to make a mockery of the entire proceedings as the court had already granted the said reliefs contained in Exhibit A.

‘This is suggestive that the court already determined the substantive suit in favour of the applicant, ex-parte.

“The application before this court is not for ‘substitution’ of the reliefs, but amendment of orders or reliefs which had already been granted in the ex-parte application,” he argued.

He added that what Meta sought to do was to substitute the reliefs, under the guise of amendment.

He said the application contradicted Order 34(6)(1) of the FHC (Civil Procedure) Rules, 2019.

“It projects a lot of incongruity,” he said, arguing that there was no provision under the Rules to amend reliefs in the statement; but that only grounds of the reliefs can be amended.

Justice James Omotosho adjourned the matter until Oct. 3 for consolidated ruling on the preliminary objection and motion to amend.

 


Kindly share this post

Ebere Melum-Nwogbo is a trained and practicing journalist. She is passionate about ICT and business journalism. She has over a decade experience spanning money and capital market as well as information technology

E-Business

Lagos Captures over 6.4m Residents in LASRRA Database

Published

on

Kindly share this post

Lagos State government has disclosed that more than 6.4 million residents have so far been captured under the Lagos State Residents Registration Agency (LASRRA) exercise as part of efforts to strengthen governance, planning and service delivery across the state.

Lagos Captures over 6.4m Residents in LASRRA Database

Tobosun Alake, commissioner for Innovation, Science and Technology,  revealed this during the ongoing ministerial press briefing marking the second-term anniversary of Governor Babajide Sanwo-Olu.

According to Alake, a total of 6,465,667 residents have been enrolled in the residency database, comprising 4,058,333 adults and 2,407,224 children.

The commissioner described the Lagos Identity Card Project, popularly known as LAG ID, as a major component of the state government’s strategy to improve governance efficiency and public service delivery under the THEMES development agenda.

He explained that the initiative was designed to provide government with a reliable and comprehensive population database capable of supporting planning, policy implementation and effective allocation of resources.

Alake noted that the agency operates an open framework that allows government institutions and private sector partners to independently participate in the system while leveraging a centralised data-sharing infrastructure.

According to him, the arrangement creates opportunities for partnerships, improved information management and enhanced value for both residents and businesses operating within Lagos.

The commissioner added that the initiative would further expand opportunities linked to the Lagos Residents Card and deepen the state’s digital transformation drive.

Speaking on security and digital enforcement, Alake disclosed that the state’s Safe City initiative had significantly increased digital traffic enforcement across Lagos.

He revealed that about 86,000 traffic violations were tracked within a few months, bringing the cumulative figure to about 737,000 recorded cases.

On technology-driven governance, the commissioner highlighted the role of Art and Technology Lagos, an annual conference organised by the Eko Innovation Centre in collaboration with the Lagos State Government.

According to him, the conference brings together technology stakeholders, policymakers, innovators and government officials to drive conversations around the development of a smarter and digitally connected Lagos.

Alake also stated that Lagos currently leads the country in data protection compliance, revealing that the state now has 109 certified data protection officers responsible for ensuring compliance and safeguarding residents’ data.

He explained that the government’s digital platforms now generate robust analytics that help authorities understand public interaction with online services.

“With technology, the state government has been able to know that an average 250,000 visit monthly,” he said.

“When we see our daily visitors on our online platform we are able to tell how many people are visiting our platforms, what they are clicking on and what they are using.

“Some of the services they are related with so we have backend analytics to tell us the number of visitors. I think the back end analytics is very robust and we respond to questions very quickly,” Alake added.

The commissioner further disclosed that the state had completed about 3,000 kilometres of fibre optic duct infrastructure extending to areas such as Alimosho, Ikorodu and Ibeju-Lekki.

He added that the government was planning to expand the infrastructure to 5,000 kilometres through partnerships with private sector investors.

 


Kindly share this post
Continue Reading

E-Business

Firm Shares Insights into Ransomware Trends and Tactics @ International Anti-Ransomware Day-2026

Published

on

Kindly share this post

On International Anti-Ransomware Day, May 12, Kaspersky shares a report with an overview of ransomware trends that marked 2025 and insights into what the threat landscape holds in 2026.

According to Kaspersky Security Network, in 2025 Latin America had the highest share of organisations with ransomware attacks detected (8.13%), followed by the Asia-Pacific region (7.89%), Africa (7.62%), Middle East (7.27%), the Commonwealth of Independent States (CIS, 5.91%) and Europe (3.82%).

The report highlights the rise of “encryption-less” extortion attacks, the use of post-quantum cryptography by ransomware groups, and the persistent use of Telegram channels by cybercriminals to distribute compromised data sets and credentials.

Despite a slight decline in the overall share of organisations attacked by ransomware in 2025 compared to 2024, users remain at significant risk as attackers industrialise their operations, automate intrusion methods, and increasingly focus on stealing and leaking sensitive data rather than simply encrypting systems.

One of the trends in 2025 is the continued rise of endpoint detection and response (EDR) “killers” – tools specifically designed to disable endpoint security solutions before executing the malware itself. EDR killers have become a standard component of attacks, which means more deliberate and methodical intrusions.

Researchers also noted the emergence of ransomware families adopting post-quantum cryptography standards – this was predicted by Kaspersky previously. The development signals a concerning shift toward encryption methods that could resist future quantum computing decryption attempts.

The role of Initial Access Brokers (IABs) – cybercriminal intermediaries that sell pre-compromised corporate access through underground forums and messaging platforms – is growing. RDWeb portals (websites through which devices can be controlled remotely) are increasingly targeted as ransomware groups continue to industrialise attacks through “Access-as-a-Service” operations. As a result, the barrier to launching ransomware attacks declines.

Telegram channels and dark web forums continuously function as platforms for the distribution and for the sale of compromised data sets and accesses including those that were obtained as a result of ransomware attacks.

A major underground forum, RAMP, which also functioned as a platform through which threat actors advertised their ransomware services and published service‑related updates, got seized by authorities in January 2026.

Another underground forum, LeakBase, where malicious actors distributed exfiltrated and compromised data, was seized in March 2026. However, while law enforcement agencies are actively shutting down dark web platforms and ransomware data leak sites, similar portals may appear over time.

Active groups

Among the most active ransomware groups in 2025 based on data leak sites, Kaspersky identified Qilin as the dominant ransomware-as-a-service (RaaS) operator following RansomHub’s seizure of operations. Clop ranked as the second most active group, with Akira in the third place.

While several major ransomware groups stopped operation in 2025, new actors emerge. Looking at 2026, the Gentlemen is one of the most important new ransomware actors due to the group’s rapid growth, structured operations, and increasing focus on data-centric extortion. The group may include attackers formerly associated with other major ransomware operations.

The Gentlemen exemplify a broader shift in the ransomware ecosystem away from chaotic, high-noise campaigns toward scalable, business-like extortion models focused primarily on stealing sensitive data and leveraging reputational and regulatory pressure rather than relying solely on disruptive file encryption.

“Ransomware has evolved into a highly organised ecosystem focused on monetising stolen data, disabling defences, and scaling attacks with business-like efficiency. Threat actors are quickly adapting, weaponising legitimate tools, exploiting remote access infrastructure, and even adopting post-quantum cryptography years earlier than many expected.

“The purpose of Anti-Ransomware Day is to raise global awareness about the threats posed by ransomware and to promote best practices for prevention and response, and we urge all users to stay secure, set up layered defences, invest in backups and boost cyberliteracy levels to counter attacks,” comments Fabio Assolini, Lead Security Researcher at Kaspersky GReAT.

On Anti-Ransomware Day and beyond, Kaspersky encourages organisations to follow these best practices to safeguard from ransomware:

  • Enable ransomware protection for all endpoints. There is a free Kaspersky Anti-Ransomware Tool for Business that shields computers and servers from ransomware and other types of malware, prevents exploits and is compatible with already installed security solutions.
  • Always keep software updated on all the devices you use to prevent attackers from exploiting vulnerabilities and infiltrating your network.
  • Focus your defence strategy on detecting lateral movements and data exfiltration to the Internet. Pay special attention to outgoing traffic to detect cybercriminals’ connections to your network. Set up offline backups that intruders cannot tamper with. Make sure you can access them quickly when needed or in an emergency.
  • Companies from non-industrial sector can protect themselves by installing anti-APT and EDR solutions that enable capabilities for advanced threat discovery and detection, investigation and timely remediation of incidents. Organizations can also provide their SOC teams with access to the latest threat intelligence and regularly upskill them with professional training.

Kindly share this post
Continue Reading

E-Business

Firm Warns of Phishing Attacks via Compromised Amazon Simple Email Service Accounts

Published

on

Kindly share this post

Kaspersky has detected phishing and business email compromise (BEC) attacks that are leveraging Amazon Simple Email Service (SES) – a cloud-based email service designed for businesses and developers to send and receive high-volume marketing, notification, and transactional emails (for instance, password resets).

Because these emails are sent via a trusted service, they originate from reputable IP addresses, frequently include legitimate “.amazonses.com” identifiers. This makes phishing messages nearly indistinguishable from legitimate correspondence at a technical level. Users should treat unexpected emails with extreme caution.

The attacks are driven by the theft and exposure of credentials from Amazon Web Services (AWS). The attackers are using leaked AWS Identity and Access Management Keys – often found in public repositories, misconfigured cloud storage, and exposed configuration files. With automated tools, threat actors can identify valid keys and abuse them to send large volumes of malicious emails through legitimate infrastructure operated by Amazon.

Attackers disguise malicious links behind trusted domains such as amazonaws.com using redirects and by creating highly convincing HTML email templates. In many cases, phishing pages are hosted on infrastructure that appears legitimate, further increasing the likelihood of credential theft from victims.

One of the campaigns observed by Kaspersky in early 2026 involved emails impersonating document-signing platforms like DocuSign. Victims were prompted to review and sign documents, only to be redirected to fraudulent login pages hosted on an Amazon Web Services page designed to capture credentials.

Researchers also identified business email compromise attacks carried out via Amazon SES in which attackers impersonated employees and fabricated entire email threads with suppliers. These messages, often sent to finance departments, requested urgent payments and included PDF attachments containing only banking details – with no malicious links – making detection challenging.

“We’ve seen attackers abuse trusted platforms before – like in cases with Google Tasks and Google Forms – where scammers rely on built-in notification mechanisms to deliver phishing links from legitimate domains like @google.com, effectively bypassing email filters and exploiting user trust.

“However, the abuse of Amazon SES represents a more advanced stage of this trend: instead of merely leveraging a platform’s notification features, attackers compromise cloud credentials and gain direct control over a trusted email-sending infrastructure. This allows them to scale attacks, fully customise messages, and deliver phishing emails that are hard to distinguish from legitimate business communications,” commented Roman Dedenok, Anti-Spam Expert at Kaspersky.

 


Kindly share this post
Continue Reading

Trending