Data Privacy and Protection Club, UI.

Data Privacy & Protection Club, UI|Promoting awareness and advocacy for data protection rights|Safe Data, Smart Future|Join Us!
[email protected]

[Data Privacy and Protection Club, UI. @DPPCUI]

THE DATA PRIVACY AND PROTECTION CLUB, UI IS RECRUITING!!!

“Your phone knows you better than your friends.

Your data shapes your life… without your consent.

Join the *Data Privacy and Protection Club* to learn the LAW, master the TECH and reclaim CONTROL.”

[Data Privacy and Protection Club, UI. @DPPCUI]

In celebration of this year Data Privacy Awareness Week, the club participated in the Secondary School Outreach organization by @HiveAdvisory and YHSP Magazine at Command Day Secondary, Odogbo, Ibadan.

#dataprivacyweek #DataProtection
#DataPrivacyDay

[Data Privacy and Protection Club, UI. @DPPCUI]

We welcome you to a month filled with love.*💚

As you look forward celebrating what matters most, always remember to protect what you love—keep your data safe and secure.

With love,💚
DPPC, UI.

[Data Privacy and Protection Club, UI. @DPPCUI]

We welcome you to a month filled with love.*💚

As you look forward celebrating what matters most, always remember to protect what you love—keep your data safe and secure.

With love,💚
DPPC, UI.

[Data Privacy and Protection Club, UI. @DPPCUI]

Happy New Year, and welcome to a new chapter 🚀✨🎉

We look forward to another year of meaningful conversations, impactful activities, and shared growth with you all.

With love, 💕
DPPCUI.

[Celia @CeliaBedelia]

I called my dad yesterday to tell him I had been thinking about Christmas Eves from my childhood. I realized that some of my happiest memories are of being a little girl at my grandparents’ house, being sent to bed early on Christmas Eve, and knowing the house was full of adults who loved me, all while waiting for the magic of Christmas morning. I could hear them laughing and enjoying each other’s company, and even today, I can imagine no better sound to fall asleep to.

Is there a word, though, for knowing a nostalgic memory can never be revisited? Because telling my dad all of this also made me sad. My grandparents are no longer alive, and I will never be that little girl falling asleep on Christmas Eve again. All I can do now is try to create that same kind of magic for my own kids going forward.

[Data Privacy and Protection Club, UI. @DPPCUI]

privacy into systems and projects right from the design phase.

A big thank you to our trainer, moderator, and all attendees for making this session impactful.

[Data Privacy and Protection Club, UI. @DPPCUI]

DPPCUI Training Series — Session 2: Privacy by Design and Default (November 9th)

On November 9th, DPPCUI hosted the second session of our training series, focusing on Privacy by Design and Default: Embedding Privacy in Systems.

The session was expertly delivered

[Data Privacy and Protection Club, UI. @DPPCUI]

by Ganiyat Yusuff, with Zainab Yusuf moderating.

Members explored:
• Principles of Privacy by Design
• Practical case studies
• How to embed privacy in every project from the start

The training was highly interactive, offering participants practical insights into integrating

[Data Privacy and Protection Club, UI. @DPPCUI]

• Lawful bases for data processing and;

• Data privacy considerations in commercial transactions

The session was highly interactive, with engaging discussions and quizzes that helped reinforce key concepts. It was an insightful and practical start to our training lineup.

[Data Privacy and Protection Club, UI. @DPPCUI]

DPPCUI Training Series — Session 1 Highlights (November 2nd)

On the 2nd of November, DPPCUI successfully held the first session of our training series, focusing on the Essentials of Data Privacy and Compliance.

We were privileged to have James OYEKUNLE as our trainer,

[Data Privacy and Protection Club, UI. @DPPCUI]

with Zainab Yusuf moderating the session seamlessly.

Participants gained foundational knowledge on:

• The meaning and importance of Data Privacy

• The origins of data protection

• Existing laws guiding data privacy

• Principles of data protection

• Data subject rights

[Data Privacy and Protection Club, UI. @DPPCUI]

@RubbBandGrant P
.

P

.op

P...p.p
...
.
"$

[Data Privacy and Protection Club, UI. @DPPCUI]

@RubbBandGrant Gwmpp mmwmgk.

[A. O Akinyemi Esq - LLB, BL @heisrahman]

The new “Automatic Account Location” feature being rolled out by X has triggered important legal questions about the lawfulness of this form of data processing. X has stated that the objective of the feature is to promote transparency, combat misinformation and inauthentic behaviour, and address the rise of AI-generated spam.

Determining whether this processing is lawful requires answering three core questions:

1) Are the data shared through the feature “personal data”?

2) If yes, has X lawfully processed them?

3) If not personal data, does any privacy obligation still arise?

1. Are the data being shared by X “personal data”?

Article 4 of the GDPR defines personal data as information relating to an identified or identifiable natural person. Identification may be direct or indirect.

X is a platform with millions of users, many of whom operate under pseudonyms, parody identities, fictional names, or anonymous fan accounts. A large number of accounts do not reflect an identified natural person at all.

The question therefore arises: does the disclosure of a non-precise, non-real-time location (e.g., “Country of use”) amount to personal data?

Under the GDPR, the answer is “no” where the account is not tied to an identifiable natural person. For parody accounts, bot accounts, organizational accounts, burner accounts, or fictional identities, the disclosed information does not relate to a known or identifiable data subject. In such cases, the GDPR and similar legislation such as the NDPA do not apply, because their scope is limited strictly to personal data.

The information disclosed is neither an IP address nor a real-time geolocation. It is too coarse and too detached from a specific, identifiable human being to meet the definition of personal data for these categories of accounts.

However, for identified natural persons, the location information does qualify as personal data under the GDPR and NDPA. Therefore, the next question is whether X has lawfully processed such data.

2. If they are personal data, has X lawfully processed them?
Data protection laws provide specific grounds for lawful processing. One of these is compliance with a legal obligation imposed on the data controller. Article 6(1)(c) of the GDPR states that processing is lawful when:
“Processing is necessary for compliance with a legal obligation to which the controller is subject.”

To rely on this ground, two sub-questions naturally follow:

(1) Were users notified of this basis/processing before processing?

Transparency and accountability are non-negotiable principles under the GDPR and other legislations like the NDPA. X’s Privacy Policy (effective July 28, 2025) discloses under section 2.2 that user information may be used to foster safety and security of users and to defend against fraud.

Section 3.3 further states that X may share or disclose user information where reasonably necessary to comply with law, protect the safety or integrity of the platform, prevent spam, abuse, or malicious activity, and address fraud and security risks.

Therefore, the notification and transparency requirements are met.

(2) Is there a legal obligation that necessitates this processing?
X is subject to several regulations globally as a large online platform.

For the purpose of this analysis, the EU Digital Services Act (DSA) is instructive. The DSA, widely regarded as a gold-standard regime, requires platforms to implement technical and organisational measures that ensure:

- a high level of privacy and safety,

- protection for minors and vulnerable users,

- consumer protection in environments where the platform facilitates trade,

- mitigation of illegalities such as fraud, misinformation, impersonation, & deceptive content.

Given X’s stated purpose for the feature, promoting transparency, combating misinformation, addressing inauthentic behaviour, and fighting AI-generated spam, the measure is clearly aligned with its compliance obligations under...

1/2

[Data Privacy and Protection Club, UI. @DPPCUI]

Today, We formally inducted our new member. 🥳🎊🎉

This is a thread of our activities timeline over the weeks.

[Data Privacy and Protection Club, UI. @DPPCUI]

OUR PIONEER VP,

ONYISHI CHRISTIAN
LLB(HONS), University of Ibadan.

Congratulations on your Convocation. We celebrate your dedication to leadership, policy advocacy and development. Thank you for your efforts in setting up the club, The world is your to take. 🎉 🎓

[Chioma was bored so she @C_AfrobeatsHead]

@DPPCUI @Legal_Starboy Congratulations @Legal_Starboy

[Sultan @Legal_Starboy]

Thank you for the kind congratulations. I’m immensely proud to have contributed to establishing the club and wish you all continued success in your important work 👏💚

[O.Tanimola @timi_samm]

Tax Tree 🌴

[Data Privacy and Protection Club, UI. @DPPCUI]

Meet Our Pioneer Gen Sec.

ENIOLA SULTAN
LLB(HONS), University of Ibadan.

Congratulations on your convocation, Eniola. Thank you very much for leaving a legacy in Data Privacy awareness, literacy and protection. We wish you success in your future endeavors. @Legal_Starboy