Accuracy of Employees Records: Spotting some Data Protection Issues from the Facts of Ologe v. Corporate Affairs Commission as Decided by the National Industrial Court

By Olumide Babalola

Coincidentally, I penned this article today (18 March 2025), a day the Nigerian Bar Association Data Protection Committee (which I modestly chair) holds its inaugural webinar titled “Data Protection in Nigeria: Milking A New Practice Area” to further sensitize lawyers on why they should take issues of data protection more seriously.

In his characteristic manner, Mr. Folabi Kuti, SAN, one of the foremost labor and employment lawyers in our country, shared an interesting decision of the National Industrial Court between Olumide Abayomi Ologe and Corporate Affairs Commission & Anor. (unreported Suit No. NICN/ABJ/375/2024), where the court ruled on the effect of a letter of promotion that was delivered to an ex-employee two years after his resignation. Outside the labor law issues of facts and law, I spotted some quick lessons in data protection from the facts, thus:

The Importance of Rectifying Employee Records under the Nigeria Data Protection Act 2023
The Claimant resigned in December 2022; his records ought to have been rectified to reflect his status as an ex-employee, and his file moved to the appropriate storage section/folder, whether manual or electronic. The Nigeria Data Protection Act 2023 (NDPA) mandates organizations to uphold the rights of individuals regarding the processing of personal data, in this case storage. One of the key rights under this Act is the right to rectification (section 34(1)(c), which allows individuals to ensure that their personal data is accurate, complete, and up-to-date.

In the case of an employee who resigns, it is crucial for the employer to update the individual’s records in a timely manner. For instance, if an employee, such as the Claimant, resigns in December 2022, their employment status should be immediately reflected in both manual and electronic records. This is not just a matter of internal housekeeping; it’s a legal obligation to ensure that the employee’s status is accurately documented and that their data is properly handled.

The NDPA envisions that once an employee ceases to be part of an organization, their personal data should no longer be classified as “active” in the organization’s system. The employer must ensure that the former employee’s file is moved to the appropriate storage section or folder—whether in physical archives or electronically. Failure to do so could violate the employee’s right to rectification, which could lead to legal consequences for the organization as a result of the ensuing confusion.

Moving the data to the correct storage ensures the security and privacy of the ex-employee’s data while complying with the principles of data minimization and purpose limitation—these are obligations provided in the Act. Keeping outdated or incorrect employment information can not only result in potential data breaches but also expose the organization to legal liabilities for non-compliance as well as payment of entitlements to ex-employees, as claimed in Ologe’s case.

It is advised that organizations must prioritize the rectification of personal data records and ensure that any data about former employees is appropriately updated, secured, and archived in accordance with the Nigeria Data Protection Act 2023. This step is essential not only for legal compliance but also to protect employees privacy and data subject rights.

The Principle of Accuracy Under the NDPA: Consequences of Misleading Employment Records
The NDPA provides certain principles designed for entities to ensure that personal data is handled responsibly. One of the principles is the “accuracy” principle (section 24(1)(e), which mandates that personal data must be accurate, complete, and kept up-to-date. This principle is fundamental in safeguarding individuals’ rights to have their data correctly represented, and it holds particular significance in the context of (current or past) employee records.

In the case of a Claimant who resigned in December 2022, his employment status and position within the organization should have been promptly updated to reflect his actual status as an ex-employee. However, an issue arose when the employer issued a letter of promotion to the Claimant – after two years of his resignation, recognising to him as a “Director” rather than his correct position of “Principal Manager” before resignation. The employer explained its position in court, arguing that the Claimant’s last official role was that of Principal Manager and that the Claimant ought not to have countenanced the letter and its contents. This discrepancy raises concerns under the NDPA’s accuracy principle.

The principle of accuracy mandates that all personal data, including employment records, must be kept precise and free from errors. Referring to an individual by a title that does not correspond to their actual position creates misleading information and violates the obligation to maintain accurate records. In this case, addressing the Claimant as a “Director” in the promotion letter, despite their last position being “Principal Manager,” represents an inaccuracy in the personal data of the Claimant, which led to the ex-employee’s demand for arrears of salaries and entitlements as a director. The error in the promotion letter also highlights a failure on the part of the employer to update and rectify the Claimant’s records in a timely manner following his resignation. According to the NDPA, an organization must ensure that any personal data held, such as job titles, is both accurate and up-to-date. Failure to amend such records can be interpreted as non-compliance with the data protection dictates.

Conclusion

Concluding, the failure to correct the Claimant’s employment records, particularly in addressing him as a “Director” in a letter written in January 2024—two years after his resignation—is misleading as it constitutes a clear violation of the rectification and accuracy principles under the Nigeria Data Protection Act 2023. The Act mandates that personal data must be accurate, complete, and kept up-to-date, especially when an individual’s employment status changes. By continuing to refer to the Claimant by an incorrect job title, the employer has not only breached the legal obligation to rectify and maintain accurate records but has also undermined the integrity of the data processing practices. It is crucial for organizations to prioritize timely updates and ensure that all personal data, including employment titles and statuses, reflect the true and current state of affairs to remain compliant with the NDPA and protect the rights of the data subject. As a result of the misleading letter, the employee can maintain an action under the Nigeria Data Protection Act 2023, especially since he has suffered some injury (financial, psychological, emotional) by the employers’ processing activities.

Source: loyalnigerialawyer