Digital Culpability and Platform Liability in Nigeria: Analysing Principal–Agent Dynamics in Data Protection after Femi Falana v Meta

Abstract This paper examines the doctrine of principal–agent relationship and its implications for liability arising from personal data violations under Nigerian law. Underscoring the new phenomenon of digital culpability, the article undertakes a critical analysis of the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive (GAID) 2025, with particular reference to judicial reasoning in Femi Falana v Meta Platforms Inc. The study interrogates the extent to which digital platforms, operating as intermediaries, may incur liability as principals for the acts of third parties within the data processing ecosystem. It further evaluates how Nigerian courts address issues of jurisdiction, attribution of liability, and enforcement challenges in cross-border data protection disputes. The paper argues that Nigerian law is progressively expanding the scope of vicarious liability in data protection, especially in circumstances where digital platforms exercise substantial control over the means and purposes of data processing. It concludes that a purposive and technologically responsive application of agency principle is essential to ensure effective protection of privacy rights in Nigeria’s evolving digital environment.