Edo Gives Businesses Ultimatum to Install CCTV

Edo State's recent directive mandating businesses to install Closed-Circuit Television (CCTV) cameras by July 30, 2026, to bolster crime-fighting efforts has ignited a critical debate among legal professionals. While aimed at enhancing public safety, the order, issued by the Edo State Security Squad, raises significant questions regarding its legal foundation, the financial burden on businesses, and its compliance with Nigeria's robust data protection framework, particularly the Nigeria Data Protection Act (NDPA) 2023. This article examines the directive's implications, highlighting the tension between executive action for security and the constitutional right to privacy, alongside the statutory obligations of data controllers.

In a bid to combat rising insecurity, including kidnapping and cultism, the Edo State Security Squad recently issued a directive requiring all businesses within the state to install functional Closed-Circuit Television (CCTV) cameras on their premises by July 30, 2026. This move, championed by the state government as a crucial step towards strengthening investigations and enhancing public safety, has been met with mixed reactions. While the objective of improved security is widely supported, the directive has sparked considerable discussion within legal circles concerning its enforceability, legal basis, and potential infringement on fundamental rights and existing data protection laws.

The Edo State Commissioner for Information, in defending the policy, questioned the need for explicit legal backing when addressing urgent security concerns. However, for legal practitioners advising businesses, this stance immediately flags a critical area of concern. The directive, as currently presented, appears to be an executive pronouncement rather than a duly enacted law or regulation, which raises fundamental questions about its constitutional validity and its interface with the Nigeria Data Protection Act (NDPA) 2023. This article will delve into these legal complexities, providing an analysis of the directive against the backdrop of Nigerian constitutional law and data protection legislation, and outlining the implications for businesses and legal practice.

The legal framework governing public order, security, and individual rights in Nigeria is primarily enshrined in the Constitution of the Federal Republic of Nigeria, 1999 (as amended). Section 5 of the Constitution vests executive powers in the Governor of a State, extending to the "execution and maintenance" of the Constitution and all laws made by the State House of Assembly. However, the exercise of these executive powers is not absolute and must not contradict existing legislation or overstep constitutional boundaries.

Crucially, Section 37 of the 1999 Constitution guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications, establishing privacy as a fundamental right. While this right is not absolute and can be restricted in the interest of public safety or public order, such restrictions must be prescribed by law and be necessary and proportionate. Complementing this constitutional guarantee is the Nigeria Data Protection Act (NDPA) 2023, which provides a comprehensive legal framework for the protection and processing of personal data. The NDPA 2023 establishes principles such as lawfulness, fairness, transparency, and purpose limitation for data processing, and grants data subjects specific rights over their personal information. The Nigeria Data Protection Commission (NDPC) is the supervisory and regulatory authority established under the NDPA 2023 to oversee data protection in Nigeria.

The Edo State directive, as reported, appears to be an executive order or pronouncement by the Edo State Security Squad, rather than a law passed by the Edo State House of Assembly. While governors possess executive powers under Section 5 of the 1999 Constitution, these powers are generally for the execution and maintenance of existing laws, not for creating new obligations that typically fall within the legislative domain. Legal scholars have consistently argued that executive orders cannot make new laws or contradict existing legislation. Without a specific Edo State law or regulation empowering the Governor or the Security Squad to mandate private businesses to install CCTV, the legal basis of this directive remains tenuous and susceptible to challenge on grounds of ultra vires and violation of the principle of legality.

Furthermore, the directive directly implicates the fundamental right to privacy enshrined in Section 37 of the 1999 Constitution. While surveillance for public safety is a recognised exception to privacy rights, it must be "prescribed by law" and be necessary and proportionate. An executive directive, lacking the force of a properly enacted law, may not satisfy the "prescribed by law" requirement, thus potentially rendering the mandatory installation of CCTV an infringement of privacy rights. The Nigeria Police Act 2020, for instance, outlines powers of police officers but does not grant state security outfits the authority to issue such blanket mandates to private entities.

The directive also raises significant concerns under the Nigeria Data Protection Act (NDPA) 2023. Businesses installing CCTV cameras become 'data controllers' under the NDPA, with stringent obligations regarding the collection, processing, storage, and security of personal data. The NDPA mandates that personal data be processed lawfully, fairly, and transparently, and for a specific, legitimate purpose. While crime prevention can be a legitimate purpose, the NDPA requires data controllers to have a lawful basis for processing, such as consent or legitimate interest, and to conduct Data Privacy Impact Assessments (DPIAs) where processing poses a high risk to data subjects' rights. The directive, as it stands, does not provide guidance on these crucial NDPA compliance requirements, leaving businesses exposed to potential breaches and legal liabilities under the Act.

Moreover, the NDPA grants data subjects rights, including the right to access their data and, in certain circumstances, the right to erasure. The indiscriminate collection of footage without clear policies on data retention, access, and security could lead to widespread privacy breaches. The financial burden of installing and maintaining CCTV systems, coupled with the costs of NDPA compliance (e.g., data protection officers, security measures), could be substantial for businesses, particularly small and medium-sized enterprises, potentially leading to further legal challenges based on undue burden or discrimination if not accompanied by clear support or a phased implementation strategy.

The Edo State government's directive for businesses to install CCTV cameras, while laudable in its intent to enhance security, presents a complex legal landscape for practitioners. The absence of a clear statutory framework underpinning this mandate renders its enforceability questionable and exposes businesses to legal risks. Practitioners must advise clients on the potential for challenging the directive on constitutional grounds, particularly concerning the right to privacy and the principle of legality, should it not be backed by a duly enacted law.

Furthermore, businesses must be made aware of their obligations as data controllers under the Nigeria Data Protection Act 2023, irrespective of the directive's legal standing. Compliance with the NDPA's principles of lawfulness, fairness, transparency, purpose limitation, and data security is paramount to avoid penalties. Legal professionals should guide businesses on conducting necessary Data Privacy Impact Assessments, establishing clear data retention and access policies, and ensuring adequate security measures for CCTV footage. The Edo State government is urged to provide a robust legal framework, through legislative enactment, to support such directives, ensuring they align with constitutional provisions and data protection laws, thereby fostering a secure environment without compromising fundamental rights or imposing unmanageable burdens on the business community.