PUBLIC PARADE OF SUSPECTS ON SOCIAL AND NEWS MEDIA: A DATA PROTECTION PERSPECTIVE
By: Omotojola Yusuf
The social media and news media are awash with pictures of people suspected by law enforcement agencies of having committed crimes. The pictures come with names, alleged offenses, age, and sometimes, workplace. A visit to the Twitter and Facebook pages of the Economic and Financial Crimes Commission, Nigeria Police Force, and a host of news blogs will show the magnitude and frequency of this practice. Usually, these suspects have not been charged to Court, and in some cases, investigations have not been concluded.
The public parade of suspects presents suspects and information about them and alleged offenses to the public. It includes taking their pictures, display, and inviting the press to ask questions and the subsequent publication online. The public parade of suspects has been declared unconstitutional by the Federal High Court in Ottoh Obono v Inspector General of Police. The Court held that it constitutes a violation of the fundamental rights of the suspects. It is a commonplace law that the presumption of innocence is on the side of the suspect or accused. Thus, where the Court finds in favour of the accused, an innocent person would have been paraded and his reputation damaged. The law is settled on this area, and it will not be stretched.
The public display of suspects’ personal data online and other news media by law enforcement agencies is mostly addressed as a violation of the suspects’ fundamental human rights. There is yet to be a conversation on the suspects’ parade on social and news media from the data protection perspective. This conversation is important because pictures, names, age, and offences are personal data that must be handled in accordance with the relevant data protection laws.
This article addresses the public display of suspects’ pictures on social and news media from the data protection lens vis-à-vis the Nigeria Data Protection Regulation (NDPR).
The Data Protection Perspective
Possible Lawful Basis for Processing
The Nigeria Data Protection Regulation (NDPR) provides that processing shall be lawful only if it is based on one or more lawful bases. This article will address the relevant lawful bases to the powers and functions of the law enforcement agencies.
- Legal obligation: this lawful basis applies where the public display of the pictures is necessary for compliance with a legal obligation to which the law enforcement agency is subject. To rely on legal obligation as a lawful basis, the law enforcement agency must identify the specific law(s) that imposes such obligation. The duties and powers of each law enforcement agency are spelt out in their establishing laws and other extant legislation. For example, section 31 to section 70 of the Police Act, 2020 stipulates the Powers of the Police. It does not give the Nigerian Police Force the power to take pictures of suspects for display in newspapers, social media, news websites, or similar public platforms. A look at the provision of section 4 of the Police Act also shows that none of the duties contained in subsections “a to j” directs the officers of the Nigerian Police Force to carry out such a public parade of suspects.
It is generally claimed that the public parade of suspects will serve as a warning and deterrent to the public. This assertion was also contained in EFCC’s counter-affidavit in the Ottoh Obono’s case. However, there is no empirical evidence that links crime reduction and public parade of suspects in Nigeria to date.
In the same vein, the official Twitter handle of the EFCC erroneously argued that the public display of such pictures “is to inform and update the public of the commission’s activities, and it is done within the ambit of the law”.
Assuming without conceding that the EFCC Act imposes a duty to “inform and update” the public on the EFCC, the law is that there must have been no other means to comply with that legal obligation imposed without such public display of suspects’ pictures. The considered view of this writer is that the law enforcement agencies can adequately inform and update the public without the public parade of suspects online. Thus, it is not necessary to fulfil the purpose of public information.
- Public Interest or Public Mandate: this lawful basis is relevant where the public parade of suspects is necessary for performing a task in the public interest or exercising the official public mandate vested in the law enforcement agency. This lawful basis applies where the task carried out in the public interest or the public mandate exercised as laid down by the law. It also covers the use of discretionary powers in the exercise of the task or mandate.
Another test for the applicability of this lawful basis is the test of necessity and proportionality.  Treating the need to “inform and update the public” as a discretionary exercise of power, can the public parade of suspects be deemed necessary and proportional to that purpose? As with the legal obligation, I consider there are less intrusive measures to inform and update the public about the law enforcement agencies’ activities.
Implications of the absence of a lawful basis vis-a-vis the data protection principles
The NDPR lays out the principles of data processing. These principles are meant to guide controllers and processors from the onset of processing personal data throughout the lifecycle of the personal data.
The first principle of data processing is that personal data shall be processed for a specific, legitimate and lawful purpose. If personal data is processed without a lawful basis, the processing is unlawful and violates the first principle. Having established that the law enforcement agencies do not have any lawful basis for the public parade and display of suspects’ pictures, it is safe to conclude that such processing is unlawful.
The display of such pictures on social media and news sites also violates the principle of data minimisation. Personal data should be limited only to that which is sufficient, relevant and necessary to fulfil the purpose of processing. It prohibits the processing of excess personal data. The display and parade of suspects is excessive processing or disclosure of data.
Although, the NDPR Implementation Framework sets out “the furtherance of national security” and the “investigation of crime” as exceptions to the applicability of the NDPR. This writer’s considered view is that the public parade of suspects online and offline is not essential in investigating crime. This would not be the view where the suspects’ pictures are displayed because they have been declared wanted, and the public’s help is needed to find them.
The applicability of the exception of national security is also in doubt. In Dokubo Asari v Federal Republic of Nigeria, the Supreme Court on “instances where the fundamental rights can be waived”, held per Ibrahim Tanko Muhammad that:
“where national security is threatened or there is the real likelihood of it being threatened, human rights or the individual right of those responsible takes second place . . . Once the security of this nation is in jeopardy and it survives in pieces rather than in peace, the individual’s liberty or right may not even exist”
It is not all economic and financial crimes, theft, assault, robbery, and a host of similar crimes by suspects who are publicly paraded online that put the nation’s security in jeopardy or put the nation’s survival in pieces. A look at the practice as perpetrated by the agencies shows that it is done not because national security is at the risk of jeopardy, as even the smallest of crimes and the suspects are publicly displayed online. Moreover, at no time did the agencies support such public parades with reasons of furthering national security.
Recommendations and Conclusion
By virtue of their powers and functions, law enforcement agencies process personal data that would require extra protection and safeguards. For example, they process personal data that concern the prevention, investigation, detection, prosecution of criminal activities and the execution of criminal penalties. The processing of these types of personal data could lead to significant consequences for the data subjects. It explains why the European Union has a separate law- the Law Enforcement Data Protection Directive to govern the processing of personal data by competent authorities for the prevention, investigation, detection, prosecution of criminal activities and the execution of criminal penalties.
The nature of the NDPR as a mere regulation may account for the blatant disregard of its provisions by the Nigerian law enforcement agencies. However, as much as the status of the NDPR is not a justification for its blatant violation, a data protection Act or specific law that will govern data processing by the law enforcement agencies would go a long way in addressing these issues, especially when followed by proper enforcement by the regulatory body.
It is also recommended that the National Information Technology Development Agency (NITDA) commence an awareness initiative for the various law enforcement agencies. It will help them to understand the importance of data protection and the consequences for the data subjects. Such awareness may birth special legislation to govern the processing of personal data that concern the prevention, investigation, detection, prosecution of criminal activities and the execution of criminal penalties. Besides, an awareness programme will enlighten the law enforcement agencies on other data protection practices as stipulated in the NDPR. For instance, the appointment of Data Protection Officers (DPO) within the agencies, carrying out a Data Protection Impact Assessment (DPIA), keeping a record of processing activities (RoPA), and the fulfilment of other obligations.
References / Footnotes:
 Section 36(5) of the 1999 Constitution, as amended
 Article 2.2 NDPR
 Article 2 2(c) NDPR
 ‘Legal Obligation’ (1 January 2021) <https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legal-obligation/> accessed 11 May 2021
 Sections 6 and 7 EFCC Act 2003 provides for the functions and special powers of the EFCC, respectively
 Abolade Akinkunmi Saheed, ‘PARADE OR CHARADE: A CRITICAL EXAMINATION OF PARADING SUSPECTS BY THE POLICE IN NIGERIA.’ (Law Axis 360°, 30 March 2019) <https://lawaxis360degree.com/2019/03/30/parade-or-charade-a-critical-examination-of-parading-suspects-by-the-police-in-nigeria/> accessed 11 May 2021
 ‘Time to End the Illegal Parade of Crime Suspects’ (Financial Nigeria International Limited) <http://www.financialnigeria.com/time-to-end-the-illegal-parade-of-crime-suspects-blog-407.html> accessed 12 June 2021.
 Legal Obligation’ (1 January 2021) <https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legal-obligation/> accessed 11 May 2021
 ‘Public Task’ (16 March 2021) <https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/public-task/> accessed 11 May 2021
 Article 2.1(a) NDPR
 Article 2.1(b) NDPR
 (2007) LPELR-958 (sc)
 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016