INTRODUCTION

In 2023, Nigeria’s Ministry of  Budget and National Planning said it was working with Japan’s NEC Corporation to install facial recognition systems at the Murtala Muhammed International Airport in Lagos and the Nnamdi Azikiwe International Airport in Abuja, saying it aimed to tighten security and to catch imposters.[1] Around the same time, digital lenders such as FairMoney and Carbon were already approving or rejecting loan applications within minutes, using automated systems that score an applicant’s creditworthiness from data most of us never think of as financial: phone usage patterns, transaction history, sometimes even social media activity.[2] Neither development was introduced through legislation specifically regulating the use of artificial intelligence or facial recognition technologies. Yet both involve the processing of personal data on a scale that would have been unimaginable when section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended) (“the Constitution”) was drafted.

Section 37 of the Constitution states that “the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”[3] That is one sentence. It lists four things: homes, correspondence, telephones, and telegraphs. A camera that maps the geometry of a traveller’s face as they walk through an airport terminal is not a home, a letter, a phone call, or a telegram. The question that this article seeks to answer is whether it nonetheless falls within the spirit of what section 37 intended to protect. This is a question that no Nigerian court has yet had occasion to consider directly: whether section 37 extends to AI-enabled facial recognition or biometric surveillance.

HOW ARTIFICIAL INTELLIGENCE USES PERSONAL DATA

Although several regulatory instruments now propose working definitions of AI, there remains no universally accepted definition. The term is most commonly used to refer to computer systems that do things that normally require human judgement: recognising a face, predicting whether a borrower will repay a loan, flagging a transaction as fraudulent.[4] The field is named after a proposal by John McCarthy and three colleagues in 1955 for a summer workshop at Dartmouth College. The phrase ” artificial intelligence ” was coined more or less as a matter of convenience, in order to distinguish the new field from cybernetics and automata theory.[5]

It’s worth stating this plainly, because it is easy to talk about AI as a technical issue, separate from privacy law, but it is not. A facial recognition system cannot verify identity without a face to compare. A credit-scoring algorithm cannot predict repayment without transaction and behavioural history. The two are not related; they are the same thing explained from two different sides. Any legal framework that treats ‘AI regulation’ and ‘data protection’ as separate projects is going to miss the point.

Nigeria’s federal government, to its credit, recognised that this change is happening and, in August 2023, the Federal Ministry of Communications, Innovation and Digital Economy released a National Artificial Intelligence Strategy to promote ethical, inclusive and sustainable AI-driven economic growth in Nigeria.[6] The Central Bank of Nigeria has also started to reference AI and machine learning tools in its supervisory guidance, most notably in the 2024 Risk-Based Cybersecurity Framework issued to banks and payment service banks.[7] Neither document was drafted as an instrument of privacy, nor do they respond to the question this article is asking, but both reaffirm that Nigerian regulators are already aware that AI adoption is not a problem for the future. It is a present one.

SECTION 37 AND THE CONSTITUTIONAL FOUNDATION OF PRIVACY

Section 37 is found in Chapter IV of the Constitution, which lists the rights that a Nigerian citizen can enforce directly against the State. The principle is an old one, and not, frankly, a controversial one: a person needs some space, physical or informational, that is not open to inspection by everyone else, to live with any real autonomy. What is controversial, or at least unsettled, is how far that idea extends when the intrusion is not a soldier searching a house but a camera quietly building a database of faces.

Article 12 of the Universal Declaration of Human Rights provides that everyone shall have the right to be protected against arbitrary interference with his privacy, family, home or correspondence.[8] Article 17 of the International Covenant on Civil and Political Rights says much the same thing in the binding language of a treaty.[9] The African Charter on Human and Peoples’ Rights does not use the word ‘privacy’ at all, but Article 5 protects the dignity that is inherent in every human being, and Nigerian courts have taken that provision to reinforce the domestic guarantee.[10] Nigeria has adopted the Universal Declaration of Human Rights and is a State Party to both the International Covenant on Civil and Political Rights and the African Charter on Human and Peoples’ Rights. This is significant because Nigerian courts are entitled to use the instruments as an interpretive aid when the domestic text runs out of road, as Section 37 arguably does when the conversation turns to biometric data.

The idea that privacy should be legally protected is often traced back to an 1890 article by two American lawyers, Samuel Warren and Louis Brandeis, who called it “the right to be let alone.”[11] This is not said because Nigerian law requires an American pedigree for its justification, but because the phrase captures something that Section 37 was obviously trying to get at: the right not to have one’s life monitored, catalogued and second-guessed by people one has never met.

The Nigerian Supreme Court has not treated the rights in Chapter IV as a mere formality. In Ransome-Kuti v. Attorney-General of the Federation, the apex court held that a right guaranteed under the fundamental rights provisions of the Constitution is superior to ordinary law.[12] The case has nothing to do with facial recognition. It is about tortious immunity arising from a military raid in 1977, rather than the use of emerging technologies. However, the rationale behind it is that fundamental rights are not decorative and are meant to bind the state in practice. This supports a generous rather than a literal reading of section 37 of the Constitution, but does not in itself answer whether a facial scan constitutes an interference with “the home” or “correspondence.” That question has not yet been put to any Nigerian court, and until it is, the answer remains an informed guess rather than settled law.

A purely literal reading of section 37 of the Constitution would be an odd place for a Nigerian court to land.  The four categories the section enumerated (home, correspondence, telephone, telegraph) were not chosen because the drafters thought privacy started and ended there, but because those were the obvious vectors of state intrusion in 1999. A purposive reading of section 37 of the Constitution, as protecting the underlying interest illustrated by those four categories, but not exhausted by them, would have a reasonably strong basis to extend it to biometric surveillance and algorithmic profiling. But purposive reading is an act of interpretation, not legislation, and interpretation alone cannot substitute for a statute that actually names AI, defines its risk categories, and states what is permitted and what is not.

WHAT AI ACTUALLY THREATENS IN NIGERIA

Vague warnings about ‘algorithmic threats’ convince no one, so it is worth being concrete rather than abstract about what is actually at stake. Take the airport pilot again: a facial recognition camera does not just verify that the person with the passport is the person in the picture; once installed, the same infrastructure can, in theory, record every face that enters the terminal, whether or not the person is a suspect traveller. There is no dedicated legal framework in Nigeria governing the operation of facial recognition systems by public authorities. Although the Nigeria Data Protection Act 2023 (“the NDPA”) imposes general obligations regarding purpose limitation, storage limitation, transparency and security, it does not prescribe detailed rules for the creation, retention, oversight or secondary use of biometric databases maintained for border control. In the Ministry’s announcement of the pilot, there was likewise no indication of retention periods, independent oversight or procedures governing subsequent access to the data.[13]

Another is the issue of digital lending. When FairMoney or Carbon reject a loan application in a matter of minutes, the applicant is not told which of the data points on which the decision was based were important. This is because in most cases, particularly where complex machine-learning models are deployed, the lender may not always be able to explain precisely.[14] Models built on this kind of alternative data are to a significant extent opaque, even to the people who built them. But if a model has learned, from patterns of repayment in the past, to see applicants from certain neighbourhoods or with certain spending habits as riskier, then it may end up replicating exactly the sort of exclusion that formal banking already struggled with, only faster, with a façade of mathematical neutrality that makes the result harder to contest.

A third, less visible than either of the first two, is aggregation, which is not a single data point. The rate at which a Nigerian fintech app collects a location ping here, and a contact list there, is alarming. All this information, collected in an app, a bank, a telecom provider and a government database, can create a detailed picture of someone’s home, their associations and their financial means, all without the subject of such data ever consenting to it being presented in such a manner. Nigerian law is yet to offer coherent answers to these issues, because most of its existing privacy protections were designed to stop a single actor from misusing a single dataset, not to prevent the quiet aggregation of many small, individually lawful disclosures into something much more revealing.

The same structural risk is present in all three cases: the growth of state and commercial surveillance capacity is growing faster than the institutions that are meant to check it. In countries like Nigeria where trust in public institutions is already fragile, giving security agencies AI-powered surveillance tools without a clear legal basis is not a neutral technical upgrade. It alters the practical definition of moving freely through a Nigerian city without being subjected to surveillance, although Chapter IV of the Constitution was intended to protect the rights to privacy and freedom of movement.

NIGERIA’S LEGAL AND REGULATORY RESPONSE

The primary legislation in this regard is the NDPA. It applies to anyone processing personal data in Nigeria, or processing the data of anyone located in Nigeria, no matter where the company itself is based. [15] Facial images capable of uniquely identifying an individual constitute biometric data and are treated as sensitive personal data under the Act, attracting enhanced legal safeguards. This requires processing to be lawful, fair and transparent and limited to a specified purpose,[16] which is directly relevant to facial recognition. Section 37 of the NDPA provides that a data subject has the right not to be subjected to a decision based solely on automated processing that has a significant effect on the data subject. Exceptions are provided for processing authorised by law, necessary for a contract or carried out with explicit consent.[17] In theory, this is precisely the sort of one-minute, algorithmic loan decision described above.

What matters most is that the Nigeria Data Protection Commission (“the NDPC”) has moved since the NDPA was passed. In March 2025, the NDPC published the General Application and Implementation Directive (“GAID”), which came into effect in September 2025 and provides that the NDPC shall cease to apply the NDPR 2019 as a regulatory instrument. The GAID is not simply an administrative tidy-up, as it applies to organisations using emerging technologies, including AI, which among other conditions have to carry out a documented Data Protection Impact Assessment before deployment.[18] This is a concrete step forward, and it has to be recognised as such, not lumped into a generic complaint that Nigerian regulators have done nothing. The deployment of AI-driven lending models falls within the circumstances that require a Data Protection Impact Assessment under the GAID, and the failure to conduct such an assessment would constitute non-compliance.

That said, a documented impact assessment is a procedural safeguard, not a substantive safeguard. It requires the company to document that it has considered the risks. However, it does not require the company to avoid the highest risk uses, and it says nothing about facial recognition by state agencies specifically, since the GAID is addressed to data controllers and processors generally rather than to the state’s own surveillance conduct. The NDPA’s automated decision-making protection also further relies on an undefined term, “significant effect,” which the NDPC has so far failed to define through guidance, leaving lenders and applicants to determine for themselves whether a loan rejection passes that bar.[19]

Two further statutes touch this area without being built for it. The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, criminalises unauthorised access to computer systems and unlawful interception of electronic communications, which is useful against outside attackers but says nothing about a lawful data controller misusing data it was properly given.[20] The Freedom of Information Act 2011 gives citizens a right to request records from public institutions,[21] which could, in theory, be used to ask the Ministry of  Budget and National Planning precisely what the airport facial recognition system retains and for how long. Although the Act was drafted for general government transparency rather than surveillance oversight, nothing suggests it has been used for that purpose yet.

CONCLUSION

Section 37 of the Constitution provides a starting point for privacy in Nigeria and should not be discarded as outdated simply because it was enacted before the technology that now challenges its boundaries. The rights in Chapter IV of the Constitution are intended to be read as living guarantees, and there is a reasonable argument that a purposive reading can take section 37 into territory its drafters never envisaged. But an argument is not a decided case, and Nigeria cannot indefinitely run its AI governance on the basis of an argument that has never been tested in court. The NDPA and the NDPC’s 2025 implementation directive are real progress. It is not insignificant to require a documented impact assessment before deploying AI. But a procedural requirement to think before acting is not the same as a substantive rule about what may not be done at all. Nigeria still has neither a facial recognition statute nor a clear judicial answer on what section 37 of the Constitution protects in a world of biometric cameras and one-minute credit algorithms.