By Olumide Babalola, PhD
![](https://thenigerialawyer.com/wp-content/uploads/2026/09/NBBSPIDEL.png")
![](https://thenigerialawyer.com/wp-content/uploads/2026/05/2026-Summer-IDRI-Masterclass.jpg")
In 2023, the Federal High Court, in Suit No. FHC/ABJ/CS/1432/2019, Olumide Babalola LP & Anor v True Software Scandinavia (Truecaller), delivered a decision concerning Truecaller’s processing of the telephone numbers of persons who were not users of the Truecaller application. In interpreting the provisions of the then applicable Nigeria Data Protection Regulation 2019 (NDPR), the Court accepted, in substance, Truecaller’s position that it was not necessary for Truecaller itself to obtain the consent of non-users whose telephone numbers were contained in the contact lists of its users. The Court permitted Truecaller to rely on the indication of its users that they had sought and obtained the consent of those non-users before making their contact information available to Truecaller.
During arguments, we vehemently opposed that reasoning. In our respectful view, the proposition raised a fundamental question concerning the nature of consent in data protection law, i.e., can one person’s consent validly constitute the consent of another person whose personal data is being processed? More particularly, can the consent of a Truecaller user, given in respect of the user’s own use of the application, be treated as sufficient consent for the collection, access, storage and other processing of the personal data of individuals who are not users of the application and who have themselves neither subscribed to the service nor directly interacted with Truecaller?
For reasons relating to the circumstances of that particular suit, the 2023 decision was not appealed. It consequently remained an important judicial reference point in the Nigerian data-protection landscape and, for some time, provided Truecaller with a judicial basis for its position concerning the processing of the telephone numbers of non-users in Nigeria.
That position has, however, now been subjected to significant judicial reconsideration. On Monday, 14 September 2026, the High Court of Lagos State, per N.O.O. Ojuromi, J., in Suit No. LD/2021MFHR/2025 – Data Privacy Lawyers Association v Truecaller International LLP, declined to follow the reasoning advanced in the earlier Federal High Court decision and rejected Truecaller’s argument that it could rely on the consent allegedly obtained by its users from persons whose telephone numbers appeared in their contact lists.
The significance of the decision lies not merely in the outcome of the particular proceedings, but in the Court’s treatment of the fundamental distinction between the consent of a data subject and the consent of another person concerning that data subject’s personal data. The Court expressly confronted the proposition that a user’s consent to upload contacts contained on the user’s device could somehow amount to consent by the persons whose contact details were uploaded. In doing so, the Court observed:
“But does the consent of the users of the app who desire to use the Enhanced Search Feature and the Public safety function on the respondent application to upload the contact details of non-users stored in the user’s phonebook on to the respondent server to give the respondent access amount to the consent of processing non-users personal data contained in the users contact list? The respondent has cited no case/precedent that supports the proposition that users of the application impliedly consent to use of contact belonging to non-users nor has the respondent cited anything that suggests that by doing nothing more than the obtaining of the users consent from a user through its Privacy Policy and Terms of Service, Exhibit TCI and TC2, non-users have consented to the processing of their personal data. Accepting the respondent’s theory of implied consent would completely eviscerate the rule of privacy and the definition of consent as provided by the Act. The critical question with respect to implied consent is whether the parties whose contact details were uploaded to the server of the respondent had adequate notice of this. That the user of the app voluntarily consented to the upload of contact details on the users phone to the respondent is insufficient to establish implied consent.
This Court does not find that non-users who are not subject to the respondent’s Privacy Policies and Terms of Service have impliedly consented to the respondent interception of their phone numbers and contact details. The applicants have adequately alleged that they have not explicitly or implicitly consented to the respondent’s access to its contacts details. Consent to one does not equate to consent to the other.”
This reasoning is particularly significant under the Nigeria Data Protection Act 2023 (NDPA), which effectively replaced the NDPR as the principal statutory framework governing the processing of personal data in Nigeria. The NDPA’s conception of consent places considerable emphasis on the quality and circumstances in which consent is given. Consent must be capable of being characterised as voluntary, informed and specific.
The Lagos State High Court’s reasoning is therefore consistent with a fundamental proposition in data protection law that consent is personal to the data subject and must relate to the particular processing in respect of which it is given. A person’s agreement to the processing of his or her own personal data cannot, without more, be converted into the consent of a different individual whose personal data is subsequently processed.
This distinction is especially important in the context of contact-uploading applications. When a Truecaller user agrees to the terms governing the user’s use of the application, that agreement regulates the relationship between the user and Truecaller. Such agreement does not bind every person whose telephone number happens to be stored in the user’s address book. Those persons have never downloaded the application, accepted its terms, visited its website, received notice of its processing activities, or otherwise interacted with the controller.
The Court therefore alluded to notice as a critical consideration in determining whether implied consent could properly be established. The mere fact that a Truecaller user voluntarily authorised the uploading of contacts from the user’s device was, in the Court’s view, insufficient to establish that the individuals to whom those contacts related had themselves consented to the processing. This is an important departure from the proposition that the consent of one person can effectively be transferred to, or exercised on behalf of, another person merely because the consenting person has possession or control of that person’s contact details.
The Court’s observation that accepting Truecaller’s theory would “completely eviscerate the rule of privacy and the definition of consent as provided by the Act” is particularly instructive. It demonstrates that the question is not simply whether some form of consent was obtained somewhere within the data-processing chain. The more fundamental question is whose consent was obtained, what did that person consent to, what information was made available to that person, and whether the consent relates to the particular processing complained of.
Importantly, however, the judgment should not be understood as meaning that the applicants ultimately obtained all the reliefs sought. The Court did not grant the reliefs claimed because it was of the view that the applicants had not established the requisite damages. This, however, does not diminish the significance of the Court’s reasoning on consent. The Court’s treatment of Truecaller’s argument provides a valuable judicial analysis of the relationship between consent, notice, data-subject autonomy and third-party personal data. It is particularly relevant to future proceedings involving contact harvesting, address-book synchronisation, data enrichment, people-search services and other technologies through which the personal data of non-users may be collected indirectly from existing users.
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
The book also examines Nigeria's legal ecosystem, focusing on the LPELR and NBA AI Guidelines. As a bonus, every purchase comes with a FREE eBook titled: How to Use the AI Features in LegalPedia and LawPavilion.
Ohio Books Ltd praises the publication, stating:
"....this is the only Nigerian book I know of on the topic."
How to Order:
📞 Call, Text, or WhatsApp: 08034917063 | 07055285878
📧 Email: benadigwe1@gmail.com
🌎 Website: www.benadigwe.com
Ebook Version: Access it directly online at https://selar.com/prv626
Authored by Ben Ijeoma Adigwe Esq., ACIarb (UK), LL.M, Dip. in Artificial Intelligence, Director at the Delta State Ministry of Justice, Asaba, Nigeria.
_______________________________________________________________________
