FIRS-France tax deal: Expert worry over Nigeria trading data sovereignty

When the Federal Inland Revenue Service (FIRS) signed a Memorandum of Understanding with France’s tax authority on December 10, 2025, officials assured Nigerians that data sovereignty is assured. But according to expert lawyer Oladipupo Ige, that assurance may be technically correct yet substantively misleading.

“The statement may be formally correct but might be substantively inaccurate,” Ige explains. “We do not have access to the MoU, so whatever we state is subject to getting a copy and subjecting it to analysis.”

His concern centres on a critical distinction many Nigerians may miss, that is, the difference between granting formal access to Nigerian information and the functional exposure that technical assistance inevitably requires.

Data sovereignty concerns mount over the FIRS + France partnership

From his experience with international technical assistance agreements, Ige notes that while France may not be granted custody or operational control over Nigerian tax systems, access to the information can still occur through system demonstrations, dataset gathering, joint audit simulations, and advisory roles requiring system visibility.

The nature of the data at stake heightens these concerns. FIRS processes sensitive personal information of individual taxpayers and financial data of companies and their employees. “From the angle of personal data, data in their custody are at high risk. From the angle of economic data, financial data of companies is high risk,” Ige states.

He argues that the level of access French advisers would need for meaningful technical assistance would necessarily be high, given tasks like AI-powered tax audits, system optimisation, and compliance analytics.

Read also: Tax: FG partners US, UK, Canada, others to track remote workers earning dollars

“Setting all these up would typically require understanding the system architecture, training the AI with datasets of Nigerians, reviewing data flows, testing models on real datasets, and evaluating enforcement thresholds,” he explains.

Even without direct implementation, these advisory functions require substantial exposure. “The advisory label alone does not sufficiently safeguard sovereignty,” Ige warns.

Under the Nigeria Data Protection Act 2023, such processing requires a lawful basis, purpose limitation, data minimisation, and adequate safeguards. While the Act permits data processing in the public interest, Ige emphasises a crucial gap: “We do not know the level of exposure, actual details about the processing, risks involved, as well as the type of security systems in place to protect data subjects.”

He insists that FIRS should conduct a Data Protection Impact Assessment before implementing the MoU and inform all data subjects about the processing modalities.

Beyond individual privacy, Ige sees broader economic intelligence risks. Even aggregated or anonymised tax data carries re-identification risks when combined with other datasets. “Such aggregate data can reveal our strategic economic vulnerabilities, our industry-specific compliance gaps, our revenue dependencies, our enforcement weaknesses, and the persons or companies used as the data sources,” he notes.

The asymmetry troubles him most. France maintains strict digital protectionism through policies like SecNumCloud and strong data localisation requirements, resisting foreign access to French public sector data. “France protects its data as a matter of sovereignty yet engages in agreements that expose developing partners’ digital governance structures,” Ige observes.

Yet the partnership offers potential benefits. Nigeria could gain access to advanced tax enforcement experience, exposure to mature AI-assisted compliance models, and international credibility signals to donors and investors.

For FIRS, the path forward requires careful balancing. The agency maintains that all Nigerian data protection laws remain applicable and that the partnership is purely advisory. They emphasise that France’s Direction Générale des Finances Publiques brings decades of tax modernisation expertise that could transform Nigeria’s revenue collection.

The Nigeria Data Protection Commission should play a central oversight role, Ige suggests, reviewing the MoU for compliance, approving or rejecting exposure frameworks, and monitoring implementation.

“The issue is not whether France will own the Nigerian tax data,” Ige concludes, “but whether Nigeria is ceding strategic informational advantage without commensurate safeguards, transparency, or long-term capacity gains.”