Truecaller has said Nigerians who do not use its service can remove their phone numbers and associated caller information from its searchable database, following a Lagos High Court ruling in a privacy case brought by non-users.
The caller-identification company said that its unlisting tool allows people who have never used Truecaller to request the removal of their numbers from its active database.
The clarification follows a legal dispute over Truecaller’s processing of phone numbers and names belonging to people who have not registered for the service.
The applicants, including the Incorporated Trustees of the Data Privacy Lawyers Association, had asked the Lagos High Court to declare that Truecaller’s collection, storage and disclosure of non-users’ phone numbers violated their constitutional privacy rights and provisions of the Nigeria Data Protection Act.
They also sought orders preventing the company from processing non-user data, requiring the deletion of information already held and awarding ₦300 million in general and exemplary damages.
The court dismissed the applicants’ claims and rejected their requests for injunctions and damages. However, its reasoning drew an important distinction between consent and whether the applicants had provided sufficient evidence to establish an actionable breach of their fundamental rights.
The court rejected the argument that a Truecaller user’s acceptance of the company’s terms or decision to upload contacts automatically amounted to consent from people whose numbers appeared in that contact list.
“The user of the app voluntarily consented to the upload of contact details on the user’s phone to the respondent is insufficient to establish implied consent,” the court held.
It further stated that accepting such an interpretation of implied consent would undermine the privacy protections and definition of consent provided under the data protection law.
The court also said Truecaller, in the circumstances considered, had responsibilities as a data controller and processor to safeguard personal information and ensure that it was not disclosed without legitimate justification.
Olumide Babalola, chair of the Nigerian Bar Association’s Data Protection Committee and lawyer to the applicants, said that the dismissal should not be interpreted as a complete endorsement of Truecaller’s consent model.
“The only issue the court found, which helps them, is that we did not attach evidence of damages,” Babalola said, adding that this did not remove the court’s findings concerning consent and legitimate interest.
Truecaller has maintained that consent is not its only legal basis for processing the information. The company has pointed to public-interest and legitimate-interest provisions under the Nigeria Data Protection Act and the constitutional provisions relating to public safety.
The company said its caller-identification and spam-detection functions help people identify suspicious calls and protect against scams, fraud and harassment.
However, the court’s reasoning also indicated that legitimate interest does not automatically override a person’s fundamental rights. It noted that legitimate interest is limited where it conflicts with the rights, freedoms and interests of the person whose data is being processed.
Truecaller also argued that its service operates primarily as a “number-for-name” system, meaning a person searching for an identity must already possess the relevant phone number before information can be displayed.
The company said it does not automatically upload users’ address books. According to the judgment, contact information is uploaded in certain versions of the service only when a user activates an optional Enhanced Search feature and confirms they are authorised to share the contacts.
Truecaller said it would continue operating its Nigerian service and would not suspend or redesign the platform as a result of the ruling.
The company also said anyone, whether a user or non-user, can remove their number through its unlisting service.
It said that after a number is removed, it retains a one-way cryptographic hash to prevent the number from being accidentally re-uploaded when an active user synchronises a phonebook. Truecaller said the hash cannot be reversed to recover the original number.
The applicants are expected to appeal the court’s treatment of injury arising from the alleged privacy violations, according to their lawyer.
The case therefore leaves unresolved questions about how Nigerian data protection law should apply to services that process information supplied by one person about another, particularly in areas such as caller identification, contact discovery and social platforms.
