When Consent Cannot Bear the weight: Artificial Intelligence, Algorithmic POWER and the Limits of Data Privacy Self-Management in Nigeria

Abstract

Nigeria’s data protection laws rely on a borrowed foundation. The Nigeria Data Protection Act 2023, like the regulation it replaced, treats the individual’s consent as the moral and legal centre of gravity of lawful processing, reiterating the control-based conception of privacy that Nigerian courts have read into section 37 of the Constitution. This article argues that artificial intelligence has undermined that foundation. Machine learning systems derive their value from processing that individuals cannot foresee, inspect, or meaningfully refuse: large-scale inference, profiling that outruns any disclosed purpose, the repurposing of ordinary data as training material, and the fusion of biometric identity infrastructures whose consequences cannot be withdrawn. Drawing on Nigeria’s own experience, including the compulsory linkage of the National Identity Number to mobile SIM cards, the opening of the national biometric database to security agencies, and the punitive analytics of digital lenders, the article shows that consent in the age of artificial intelligence functions less as a safeguard than as a ritual of authorisation that transfers risk to the very people it purports to protect. It contends that reform should shift the centre of gravity of Nigerian privacy law from individual control towards institutional accountability and data justice: enforceable purpose limitation, mandatory algorithmic impact assessment built on the Act’s existing machinery, genuine constraints on solely automated decisions, and collective avenues of redress. Privacy, so understood, is not a private preference to be waived but a public safeguard on algorithmic power.