Edo gives businesses ultimatum to install CCTV

Edo State's recent directive mandating businesses to install Closed-Circuit Television (CCTV) cameras by July 30, 2026, to bolster crime-fighting efforts has ignited significant legal and practical debate. While aimed at enhancing security and aiding criminal investigations, the order raises critical questions regarding its legal foundation, the financial burden it imposes on businesses, and its implications for individual privacy rights. This article examines the directive within Nigeria's constitutional and statutory frameworks, particularly the Nigeria Data Protection Act 2023, highlighting potential challenges to its enforceability and compliance requirements for affected entities.

In a bid to combat rising insecurity, including kidnapping and cultism, the Edo State Security Squad issued a directive requiring all businesses within the state to install functional Closed-Circuit Television (CCTV) cameras by July 30, 2026. This mandate, publicly announced by the squad's spokesperson, Noah Idemudia, aims to provide crucial evidence for crime investigation and identification of suspects.

While the government defends the initiative as a necessary step to improve public safety, citing instances where CCTV footage aided investigations, the directive has been met with apprehension from various quarters. Legal experts and civil society groups have voiced concerns regarding the directive's legal basis, the economic feasibility for small and medium-sized enterprises (SMEs), and the profound implications for data privacy. This article delves into the legal landscape governing such directives in Nigeria, scrutinising the Edo State order against constitutional provisions, data protection legislation, and the powers of state governments, to assess its validity and practical ramifications for legal professionals and businesses.

The legal framework for security and privacy in Nigeria is primarily anchored in the 1999 Constitution of the Federal Republic of Nigeria (as amended) and recent data protection legislation. Section 37 of the Constitution guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications, establishing privacy as a fundamental right. This constitutional guarantee forms the bedrock of Nigeria's data protection regime.

Building on this, the Nigeria Data Protection Act 2023 (NDPA), which received Presidential assent on June 13, 2023, replaced the Nigeria Data Protection Regulation (NDPR) 2019 and serves as the principal legal framework for the protection of personal information. The NDPA establishes the Nigeria Data Protection Commission (NDPC) as the primary regulatory and supervisory authority, tasked with safeguarding data subjects' rights and promoting secure data processing practices. The Act applies broadly to data controllers and processors domiciled or operating in Nigeria, or those processing personal data of Nigerian residents, setting out principles such as lawful, fair, and transparent processing, purpose limitation, data minimisation, accuracy, and security.

Regarding the powers of state governments, the 1999 Constitution mandates the Nigerian state to maintain law and order and provide for the security and welfare of its people. While governors are often referred to as the 'chief security officers' of their states, their direct authority over federal security agencies, such as the Nigeria Police Force, is limited. Governors can issue executive orders for administrative matters and the implementation of existing laws, but these orders cannot create new offenses, impose penalties, or restrict fundamental rights without specific legislative backing from the State House of Assembly. Nigerian jurisprudence, including cases like *Ugochinyere v. President of the Federal Republic of Nigeria* and *Attorney-General of Abia State v. Attorney-General of the Federation*, has consistently affirmed that executive orders must derive their authority from the Constitution or existing statutes, otherwise, they risk being declared ultra vires.

The Edo State Security Squad's directive for mandatory CCTV installation, while well-intentioned for crime prevention, faces significant legal scrutiny concerning its statutory basis. The directive appears to be an executive or administrative order. However, for such a mandate to be legally enforceable, especially one that imposes obligations and costs on private entities and potentially infringes on fundamental rights, it typically requires specific enabling legislation passed by the Edo State House of Assembly. Without a clear law empowering the state government or its security agencies to compel private businesses to install surveillance equipment, the directive risks being challenged as ultra vires, meaning beyond the powers of the issuing authority. Past judicial pronouncements, such as in *James v. Governor of Edo State & Ors* (though concerning a different subject matter), have invalidated gubernatorial directives that lacked proper statutory backing and overreached into rights restrictions.

Furthermore, the directive's implications for privacy under the Nigeria Data Protection Act 2023 are substantial. CCTV footage constitutes personal data, and its collection, storage, and processing by businesses must comply with the NDPA. Key principles of the NDPA include obtaining a lawful basis for processing (which, in this case, would ideally be a clear legal obligation, currently absent), purpose limitation (ensuring data is used only for crime fighting as stated), data minimisation, and robust security measures. Businesses would become 'data controllers' or 'data processors' under the NDPA, incurring significant responsibilities, including the need to conduct Data Privacy Impact Assessments (DPIA) if the processing poses a substantial risk to data subjects' rights and freedoms. The absence of clear guidelines on data retention, access protocols for law enforcement, and mechanisms for data subjects to exercise their rights (e.g., access, rectification, erasure) creates a compliance minefield for businesses.

The practical challenges and economic burden on businesses, particularly SMEs, cannot be overstated. The cost of purchasing, installing, and maintaining functional CCTV systems, coupled with the technical expertise required for data storage, security, and compliance with data protection regulations, could be prohibitive. The Edo State Commissioner for Information's defence, questioning the need for legal backing in the face of insecurity, reflects a tension between urgent security needs and adherence to the rule of law. However, in a constitutional democracy, even legitimate state objectives must be pursued through legally sound means. The NDPC, as the regulatory body, has powers to impose significant fines for non-compliance with the NDPA, ranging from ₦2 million to ₦10 million or 2% of annual gross revenue, whichever is higher, depending on the classification of the data controller. This places businesses in a precarious position: comply with a potentially unlawful directive or risk penalties from the state, while simultaneously facing NDPA non-compliance risks if they proceed without proper legal and technical safeguards.

This situation highlights a critical gap in the current approach: the need for harmonised legislation that balances security imperatives with fundamental rights and economic realities. While the Police Act 2020 promotes community partnership in crime fighting, it does not explicitly empower state governments to unilaterally impose such a broad mandate on private businesses. A more robust and legally sound approach would involve the Edo State House of Assembly enacting a specific law, developed through stakeholder consultation, that clearly outlines the obligations, provides support mechanisms for businesses, and integrates seamlessly with national data protection laws.

The Edo State government's directive for businesses to install CCTV cameras, while driven by a commendable objective to enhance security, presents a complex legal and practical dilemma. Its enforceability is questionable without a clear, specific legislative instrument from the State House of Assembly, potentially rendering it ultra vires and susceptible to legal challenge. Furthermore, businesses face significant compliance hurdles under the Nigeria Data Protection Act 2023, necessitating careful consideration of data privacy principles, security measures, and the rights of data subjects.

For legal practitioners, advising businesses in Edo State requires a nuanced approach. Clients should be informed of the directive's uncertain legal basis and the potential for legal challenges. Simultaneously, they must be guided on best practices for data protection compliance under the NDPA, should they choose to comply or be compelled to do so, focusing on lawful processing, data security, and transparency. The Edo State government is urged to pursue a legislative route, enacting a comprehensive law that provides a solid legal foundation for such security measures, offers incentives or support for businesses, and clearly articulates data governance protocols in line with national data protection standards. The coming months will likely see increased advocacy from civil society and potential judicial interventions, making this a critical area for legal professionals to monitor closely.