By Olumide Babalola, PhD
Since 2023, I anticipated that a day like this would come, when the problematic wording of the Nigeria Data Protection Act’s provisions on consent (which appears to elevate consent above the other lawful bases for data processing) would eventually be subjected to judicial scrutiny. Even though that is not the focus of my piece today, the recent decision of the High Court of Lagos, per Okunuga, J. in Nwabueze v Nigerian Breweries reported at (2026) Nigerian Privacy Law Report (NPLR) Vol. 5, page 181 (accessible at https://nigerianprivacylawreport.org/reports/larry-nwabueze-v-nigerian-breweries) presents the earliest judicial interrogation of reasonable expectation of privacy in public and the concept of implied consent introduced into the Nigerian data protection framework through the General Application Implementation Directive (GAID) 2025
Facts of the case
In that case, a businessman sued the Nigerian Breweries for the unauthorised use of his image in a promotional video for Goldberg beer. On October 26, 2024, the applicant and his wife attended an El Clasico football match viewing event at Johnny Rockets Restaurant, which was sponsored by the Nigerian Breweries. The man said he made a private indoor reservation, expressly declined participation in the sponsored event when an event manager attempted to record him, and asserted his right to privacy. When he discovered through a that his image appeared in a Goldberg advertisement on SuperSport and social media, he demanded the removal of the video but the respondent allegedly ignored this request and continued using his image. The respondent claimed that the event was publicly advertised, and a “Crowd Release” notice was displayed at the entrance informing attendees that entry and participation constituted consent to being photographed, filmed, and recorded for promotional purposes. The respondent argued that the applicant voluntarily attended, watched the match, enjoyed the musical performance, and consumed Goldberg beer, thereby giving implied and informed consent. The respondent maintained that the event was a public, branded, and recorded setting where no attendee could reasonably expect privacy, and that the use of the applicant’s image was lawful and justified under legitimate interest in event documentation, not commercial advertisement.
Reasonable expectation of privacy, Crowd Release and (implied) consent
In its judgment, the court captured Nigerian Breweries’ forceful arguments as follows: “… the Applicant with the knowledge that the event was privately hosted and exclusive, chose to attend voluntarily. Due to the nature of the event, the organizers followed the global industry best practices for events of this magnitude by issuing a Crowd Release notice at the entrance and within the event premises for the purpose of obtaining practical and enforceable consent from the audience where individual written consent is impracticable. That the notice provided in clear and unequivocal terms that by entering and remaining at the venue, attendees consented to being photographed, filmed and/or recorded, and that such recordings could be used by the Respondent in perpetuity for promotional or other purposes connected to the Event. A clear warning was also displayed that anyone who did not agree to the Crowd Release should not enter the area. That the Applicant was fully aware that photographs, videos and other recordings from the Event would be taken and used for promotional purposes, yet still chose to attend…. He further stated that under Article 17(8)(a) of the General Application and Implementation Directive (GAID) made in March, 2025 by the Nigeria Data Protection Commission pursuant to the Nigeria Data Act, voluntary participation in public events implies consent to being recorded and having such images used. That the Applicant admitted in paragraphs 5 and 8 of his supporting Affidavit that he went to Johnny Rockets to observe the El Clasico football match, participated in the event as he further admitted that he watched the match, enjoyed the life musical performance and consumed a Goldberg beer contrary to his claim that he declined involvement. After the event, as part of its marketing activities, the Respondent published images and video highlights of same strictly for the purpose of reporting, documenting, and showcasing its brand activities. ….That in such a public and highly publicized setting, no attendee could reasonably expect their presence or activities to remain private.”
On the effect of the “Crowd Release” and Larry’s valid consent (if any), the court decided instructively as follows: “The argument that the Applicant lacked a reasonable expectation of privacy due to the event and the Crowd Release notice must be balanced against the core right to privacy and the specific context of commercial use. Though an individual may have less privacy in public, the use of his identifiable image for commercial advertisement without explicit consent raises a different issue….The subsequent deployment of his image in Goldberg promotional advertisements aired on SuperSport and social media platforms transcends ordinary event documentation… The Court therefore holds that although the Applicant had a reduced expectation of privacy at the event, the Respondent’s commercial use of his identifiable image without authorization constitutes an infringement of his protected right to privacy….It is pertinent to note that though Article 17(8)(a) of the General Application and Implementation Directive (GAID) referred to by the Respondent corroborates the provision for express consent required for profit or commerce-oriented advertisement”
The court’s holding above underscores the complexities surrounding consent in data protection law and highlights the need for data controllers to take proactive and demonstrable steps to establish that valid consent was sought and obtained in accordance with the applicable legal requirements.
Conclusion
The decision in Larry Nwabueze v. Nigerian Breweries is significant, not because of its implication for implied consent at public events, but because it marks the first known judicial engagement with the concept of reasonable expectation of privacy in public and Article 17(8)(a) of the General Application and Implementation Directive (GAID) 2025 on the need for express consent at such events. Although the respondent relied heavily on the Crowd Release notice and the doctrine of implied consent, the court drew a crucial distinction between consent to being recorded at a public event and consent to the subsequent commercial exploitation of an individual’s identifiable image.
In doing so, the court rightly recognised that a reduced expectation of privacy in a public or semi-public setting does not extinguish a data subject’s rights where personal data are processed for commercial advertising. Attendance at an event, even with knowledge that photography or videography may occur, cannot automatically be construed as consent for profit-driven promotional use of one’s image. The court’s insistence on explicit authorisation for such commercial use reinforces the principle that implied consent has limits, particularly where processing substantially departs from the context in which the data were collected.
More broadly, the judgment provides an early indication that Nigerian courts may be unwilling to permit Article 17(8)(a) of the GAID to dilute the standard of consent required under the Nigeria Data Protection Act. While the court did not undertake an extensive analysis of the relationship between the Act and the GAID, its reasoning suggests that implied consent cannot be deployed as a blanket justification for commercial data processing. Whether this approach will be consistently adopted in future cases remains to be seen. However, what is clear for now, is that this decision has initiated the expected judicial conversation on one of the most contentious aspects of Nigeria’s evolving data protection framework. As more cases come before the courts, greater clarity will emerge on the proper scope of implied consent as well as the legal effect of crowd release notices.
The post “Court Clarifies Public Participation Is Not Implied Consent To Data Processing” — Lessons For Brands From Larry Nwabueze v Nigerian Breweries appeared first on TheNigeriaLawyer.