There is a particular kind of exhaustion that comes with being pursued by a machine. Barr. Ebenezer Amadi knew it well because between July and October 2024, his phone rang, and rang, a pre-recorded voice selling a loan app called Okash calling from a different number nearly every time and he blocked one line another took its place which approximately twenty-five numbers, in the end before he stopped blocking and started suing.

His case was decided by the Federal High Court in December 2025, testing a question that sounds almost basic in an age of data brokers and predictive marketing: “Does a citizen have the right to simply not be called?”

The court said yes.

A RIGHT OLDER THAN THE STATUTE

Nigeria's constitutional answer to that question has existed since 1999. Section 37 of the Constitution guarantees the privacy of citizens, their homes, correspondence, telephone conversations and communications and that was the provision the court relied on.

Okash denied the claim and only claimed one of the twenty-five phone numbers Amadi listed was not theirs. The court found this insufficient because Amadi had provided detailed evidence, including dates and supporting documents. A general denial cannot defeat clear and specific evidence. The court found a breach of Section 37 and granted a perpetual injunction restraining Okash from making further unsolicited calls to Amadi through any number, alongside a written apology and ₦500,000 in damages.

It was a sound outcome but it also left an important gap.

THE STATUTE

In 2023, Nigeria enacted the Nigeria Data Protection Act (NDPA), a legislation built, in part, for exactly this kind of dispute. Section 36 gives every data subject the right to object to the processing of personal data for direct marketing at any time, because a phone number is personal data and the repeated promotional robocalls are processed for direct marketing purpose the very conduct Section 36 addresses.

Section 25 goes further to require that personal data processing rest on one of six lawful bases, including consent, contract, legal obligation, vital interest, public task or legitimate interest, and a stranger who never supplied his number to a lender appears to fit none of these.

Yet none of this became part of the court's substantive analysis.

Instead, the Respondents relied on Section 46(1) of the NDPA, arguing that a complainant ought to first approach the Nigeria Data Protection Commission. The court rejected that argument, holding that the word “MAY” is permissive and does not create a condition precedent a legal requirement that must be fulfilled before a lawsuit can be filed.

That finding was significant but it also meant the NDPA entered the judgment mainly as a procedural issue rather than as the primary legal framework governing unsolicited marketing.

A GAP BEHIND THE GAP

Since 2016, telecom subscribers have been able to text "STOP" to 2442 to opt out of marketing communications but researchers examining that framework have noted that it was designed largely for unsolicited text messages, not repeated robocalls.

Even a consumer who diligently blocked unwanted numbers as Amadi did had no formal regulatory mechanism specifically designed to stop automated marketing calls. But that gap did not remain unanswered.

In Abdulmalik Muhaimin Onimisi v. Guaranty Trust Holding Company Plc (Federal High Court, Abuja, 11 June 2026), a non-customer who repeatedly received marketing messages from GTCO pleaded both Section 37 of the Constitution and Sections 24, 34, 35 and 36 of the NDPA.

The court held that the bank had failed to establish any lawful basis under Section 25, that Section 36 required marketing communications to stop once the recipient objected, and that the continued processing was unlawful. The court ordered the bank to cease further communications and awarded ₦200,000 in damages, although it declined to compel disclosure of how the phone number had been obtained.

Unlike Amadi, the NDPA became the substantive legal foundation of the claim.

WHAT THIS MEANS FOR PRACTICE

For lawyers handling unsolicited marketing cases, Amadi’s case remains valuable for two important propositions: Section 46 is not a mandatory gateway before approaching the courts and a general denial cannot defeat detailed, exhibited evidence. Onimisi’s case now offers stronger authority on the substantive application of the NDPA to unsolicited marketing.

These two decisions suggest that pleading practice is beginning to evolve. Instead of relying solely on Section 37 of the Constitution, future claims are likely to place Sections 24 to 36 of the NDPA at the centre of the action, with constitutional privacy serving as the broader safeguard behind the statutory framework.

The lesson from these cases emphasizes that Nigerians have a right to privacy, and that data protection claims now matter as much as the rights themselves. As more unsolicited marketing disputes reach Nigerian courts, these decisions will help shape how privacy rights are enforced in practice.