PRIVACY RIGHTS AND DATA PROTECTION ISSUES ARISING FROM THE VIRAL VIDEO OF THE FRACAS INVOLVING MS. COMFORT EMMANSON AND IBOM AIR AT THE MURITALA MOHAMMED INTERNATIONAL AIRPORT, LAGOS

The spotlight have been beamed on the Nigerian aviation sector in the last few days with two major occurrences which have thrown the social media into a frenzy. First was the incident involving popular Fuji musician - King Wasiu Ayinde Marshall (KWAM) 1 who attempted to block a plane from taxing. The other and the most recent is the scenario involving a young lady by name Ms Comfort Emmason who was said to have engaged the hostess and staff of the IBOM Airline in some physical scuffles.

The second scenario involving Ms Emmason who boarded the IBOM Airline aircraft from Lagos has ignited some privacy and data protection issues given the viral video of the passenger currently circulating widely showing certain private parts of her body exposed during her scuffles with staff of IBOM Air.

In the video circulating widely on social media, Ms Emmason is seen being dragged in a undignifying manner by staff of IBOM Air with her upper body exposed showing her face and upper body to the whole world. 

What also appears not to be in contention is that the video recording was made by a staff of IBOM Air and released online to netizens possibly to humiliate Ms

Emmason.

On the 12th day of June 2023, President Bola Ahmed Tinubu signed into law the Nigerian Data Protection Bill which by the presidential assent given to it became the Nigeria Data Protection Act 2023 (Act No. 37, the Act). The purpose of the Act as stated in its long title is "...to provide a legal framework for the protection of personal information and establish the Nigerian Data Protection Commission (NDPC) for the regulation of the processing of personal information and for related matters."

The objectives of the Act include safeguard of the fundamental rights and freedoms, and interests of data subjects as guaranteed by the Nigerian Constitution, promotion of data processing practices that safeguard the security of personal data and privacy of data subjects, ensure that personal data is processed in a fair, lawful and accountable manner. 

Furthermore, the Act enacts crucial provisions including the principles and lawful basis for processing of personal data, rights of data subjects, data security, cross-border transfers of personal data among others.

The enactment of the Act finds root in the Right to Privacy guaranteed by Section 37 of the Constitution of the Federal Republic of Nigeria 1999 as amended.

What is clear is that the video containing the nude content was recorded and shared to the whole world by an official of IBOM Air. What is also not subject to dispute is that the video and it's content was shared without the consent of Ms. Emmason.

These trajectory of events raise crucial issues with regard to privacy protection under Nigerian law. Recognising the gravity of the conduct of IBOM Air in this regard, the Hon Minster of Aviation and Aerospace, Mr. Festus Keyamo, SAN has rightly indicated that there would be sanctions meted out to those responsible for releasing Ms. Emmason's nude videos online.

The Nigerian Data Protection Regime encapsulated under the Nigerian Data Protection Act 2023 confers rights on a data subject which a data controller or data processor has a duty to respect. These rights are stipulated in Part VI of the Act. 

The public display of Ms. Emmason's nude by Ibom Air (a data controller within the classification of the NDPC Guidance Notice of February 2024) raises issues of privacy breaches under the Act including absence of consent by the data subject (Ms. Emmason) and disregard to principles for lawful recording (collection) of her personal images and spreading same online. The three lawful basis upon which the personal data of a data subject can be collected under the Act are that such data is "collected for specified, explicit and legitimate purposes" - Section 24 (1) (b). The manner in which the video of Ms Emmason was recorded apparently failed these tests as the circumstances surrounding the recording did not satisfy these requirements. The indecent images were not collected by the data controller's agent for any explicit, specified or legitimate purposes.

The processing of the images/video which led to it's being shared online to the whole world also failed the trinity requirements under section 24 (1) of the Act which mandates that a data controller or data processor shall ensure that personal data is processed in a fair, lawful and transparent manner. The processing of the viral images were apparently not fair, lawful and transparent in the circumstances.

Fundamentally, the primary lawful basis for the processing of personal data by a data controller or processor is the consent of the data subject. A data controller or processor processing the personal data of a data subject is mandated to do so with the prior consent of the data subject which consent must be given by the data subject for the specific purpose for which the data is processed- Section 25 (1) (a). Personal data may only be processed without the consent of the data subject only in the instances contemplated by Section 25(1) (b) which include processing for compliance with a legal obligation to which the data controller or processor is subject, protection of the vital interest of the data subject or another person, e.t.c. In this case, Ms Emmason gave no consent for the processing of her images online by Ibom Air, which act has brought to her public opprobrium and disrepute. The processing also cannot be justified under the alternative circumstances contemplated by Section 25(1) (b) earlier referenced.

With regard to the giving or presence of consent by a data subject for the processing of a personal data, Article 17 (8) (a) of the General Application and Implementation Directive (GAID) 2025 provides that a data subject could grant constructive or implied consent to data processing in certain instances including where a data subject has participated in a public event. The images taken at the event may be used for the report or that event- provided that such images shall not be used for a profit or commerce oriented advertisement without the express consent of the data subject. In this case, the fracas which occured at the Muritala Mohammed International Airport, Lagos on the 11th August 2025- a spontaneous event which the data subject did not voluntarily offered her participation cannot by any stretch of the imagination be classified as coming under this provision. Assuming that could be the case, the provision of Article 17 (8) (a) of the GAID expressly confers on the data controller a duty to ensure that the images captured do not portray the data subject in bad light. Apparently, the implied consent provisions of Article 17 (8) (a) would not suffice as a justification for the privacy breaches suffered by the data subject in the scenario under review.

In addition, Article 18 of GAID list certain data processing activities which require the consent or a data subject. These include where the processor intends to process sensitive personal data such as in the instant case involving Ms. Emmason.

One of the objectives of the NDPC Act 2023 is that it makes provision for the protection of the rights of a data subject and also provides for means of recourse and remedies where the rights of a data subject has been violated, such as in the case of Ms Emmason. 

The Act confers on the data subject a right to lay a complaint with the Nigerian Data Protection Commission who may conduct an investigation and where it finds the data controller (IBOM Air) culpable of the allegations made in the complaint true and established may impose a sanction on the data controller or make any enforcement order including order for payment of compensation to the data subject who has suffered injury, loss or harm as a result of the violation.

This Article briefly espouses the Nigerian legal perspective of Data Protection law vis a vis the recent event involving a Lagos bound passenger of IBOM Air, a data controller withing the meaning of the NDP Act and the Guidance Notice issued by the NDPC in February 2024.

It is clear and not subject to arguement that the collection and processing of the nude images of Ms. Comfort Emmason by agent of IBOM Air violated the basic provisions of NDP Act and rights of the data subject to have her personal data processed only with her consent.

These breaches entitle Ms Emmason to remedies upon a proper complaint before the NDPC.