Somewhere in the footage from every sponsored event is a face that never agreed to endorse a product or brand. For years, that risk was often treated as the price of free admission to the event. In Larry Nwabueze v. Nigerian Breweries Plc, however, the High Court of Lagos State took a different view.

It held that an identifiable photograph constitutes personal data under the Nigeria Data Protection Act 2023; that using such an image in advertising amounts to processing; and that a general crowd-release notice displayed at the venue does not provide sufficient authority for that use.

In this publication, TEMPLARS Partner, Femi Oyewole, SAN, FCIArb, and Associates, Nafisa Haliru and Obinna Onyishi, examine the wider implications of the judgment. They distinguish copyright in a photograph from the separate right to commercialise the likeness of the person captured in it.

Businesses should treat images from events as personal data and manage them with the same discipline applied to other regulated data assets. This includes: obtaining consent that is specific, informed, and properly documented; including photography and image-use clauses in registration forms, ticket terms, and event notices; securing model releases where an identifiable face will be used to support a campaign; and embedding image governance into broader data protection compliance processes.

The central premise has changed: a photograph is no longer merely creative material. Where it identifies a person, it is also personal data, and it carries legal obligations wherever it is used.