Unresolved Tensions in the Intersections of Corporate Insolvency, Data Protection and Conflict of Laws Under the Nigerian Legal Framework

Insolvent corporate debtors often possess a considerable amount of personal data, such as customer lists and user data. The insolvency and liquidation of biobanks and private hospitals even pose greater challenges in relation to the sensitive personal data in their holding. In liquidation, should the sensitive personal data in their holding be sold alongside other assets to satisfy the corporate debtor’s debts? This question (or its kind) is yet to receive any judicial interpretation in Nigeria. Similarly, insolvency practitioners (e.g. administrators and liquidators) are typically appointed to manage and distribute an insolvent corporate debtor’s assets to its stakeholders. An administrator’s use of personal data to trade may qualify him as a data controller under the Nigerian Data Protection Act 2023 (NDPA). Likewise, where personal data are necessary for trading under administration, the cost of processing information requests from data subjects may impede the success of the administration. Although NDPA indicates that a data subject will bear the cost of processing if the underlying cost is “unreasonable”, neither case law nor subsidiary legislations have clarified the quantum of cost as well as the circumstances that could meet the “unreasonable” threshold. The article finds that NDPA intersects with other business laws in Nigeria, and their intersections breed a considerable amount of uncertainty that is likely to impede commerce: the article proposes urgent reforms on these pertinent issues.