A Federal High Court in Abuja has ruled that Eat’n’Go, the owner of Domino’s Pizza and Cold Stone Creamery franchises in Africa, must pay ₦3 million to a customer for sending unsolicited marketing messages.

The court found that Eat’n’Go and Jumia Food breached the customer’s data protection rights by sharing his contact details without consent.

According to court documents, the applicant, Chukwunweike Akosa Araka, had used Jumia Food to order from Domino’s Pizza in March 2023.

However, seven months later, he began receiving direct marketing messages from Domino’s Pizza, despite not consenting to receive such messages.

Araka had requested that Domino’s Pizza stop sending the messages via email, but they continued, causing him distress. His lawyers argued that the direct marketing messages sent by Domino’s Pizza were not covered under the lawful basis provided by the Nigeria Data Protection Act (NDPA).

The NDPA, which was signed into law in June 2023, mandates that companies must obtain user consent before using personal information for direct marketing. This ruling reinforces the legal requirement for consent and the consequences of non-compliance.

The case highlights the broader issue of unchecked data breaches in Nigeria, where businesses frequently share user data without permission.

Data privacy violations are particularly rampant in sectors like e-commerce, fintech, and telecoms, often leading to consumer complaints with little to no action taken.

The judgment sets an important legal precedent, serving as a warning to businesses that mishandle customer data. While the ₦3 million penalty is significantly lower than what Araka sought, it underscores the need for companies to prioritize data protection and comply with existing regulations.

For communities like PrivCon, which advocate for data protection enforcement, this ruling is a win. However, it also underscores the extent of data rights violations that many Nigerians endure frequently, even after multiple complaints.

This case may encourage stricter enforcement of the NDPA and push businesses to prioritize data protection, ensuring that customer information is handled with the necessary legal and ethical considerations.