Data Protection and the Right to Privacy: Should Phone Numbers Be Recyclable ?

Some months ago, I purchased a new sim card. Two days later, I began to receive calls and messages from strangers. When I registered on a fintech application with that same number, I was automatically logged into another person's account and the information belonging to that individual was displayed to me. Eventually, I discovered that the phone number I had just purchased was a recycled number.

A phone number can identify an individual, and it provides access to personal information and financial data because it serves as a key that unlocks access to personal conversations, payments, and sensitive information. Therefore, a phone number qualifies as personal data under the Nigeria Data Protection Act 2023 and, where applicable, the General Data Protection Regulation.1 This leads to an important question: if a phone number constitutes personal data, should it be capable of being re-assigned to another individual?

This blog will examine the reasons why phone numbers are recycled, the privacy risks associated with recycled numbers, and the possible legal and policy measures that may be taken to protect individuals’ privacy in the context of phone number recycling.

BACKGROUND

Phone number recycling is a process by which telecom operators reassign an inactive number to a new subscriber after a certain period of time.2 A phone number is recycled when it becomes inactive or lost and cannot be reactivated after six months, and there are no other activities on the line for another three months.3 Inactive phone numbers are recycled primarily because numbering resources are limited and scarce. Telephone numbers must comply with established numbering structures and formats, including those set out under the International Telecommunication Union's E.164 Recommendation. As a result, the number of valid telephone numbers available for assignment is limited within any numbering plan. Thus, leaving inactive numbers vacant permanently wastes numbering resources since it reduces the amount of numbers available for potential new subscribers. Phone-number recycling enables telecommunications regulators and operators to reallocate unused numbering resources to new subscribers. This promotes the efficient use of available numbers and supports the continued provision of telecommunications services.4 Personal data, according to the Nigeria Data Protection Act, 2023 and the General Data Protection Regulation, is defined as “any information relating to an identified or identifiable natural person directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual”.5 Under modern data protection frameworks, such as the European Union's General Data Protection Regulation (GDPR) and the Nigeria Data Protection Act (NDPA), a phone number is recognized as personal data because it serves as a unique numeric locator that can identify a specific individual, either directly or indirectly. Phone numbers have the same value as any other personal data; therefore, phone numbers obtained from recycled mobile numbers can only be used legitimately with the consent of the data owner or for specific lawful processes.6

Although phone number recycling serves as an important telecommunications function, it, however, raises significant privacy and data-protection concerns. When a phone number is recycled, it can still be associated with the previous subscriber’s personal information, accounts, and even communication data. Hence, a recycled phone number can cause harassment of the new subscriber, account takeover, unexpected financial alerts, privacy breaches, and even legal issues tied to the former subscriber.7

Phone number recycling, therefore, poses privacy and security risks to both the previous and new subscribers because it makes personal information accessible to unauthorized persons. These concerns form the basis for examining whether telephone numbers, as personal data capable of being linked to individuals, should be capable of being reassigned at all.

CRITICAL ANALYSIS

Nigeria's data-protection framework is rooted in the Constitution of the Federal Republic of Nigeria 1999 (as amended). Section 37 states that "the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected." This constitutional provision is the basis for Nigeria’s current data protection regime. It recognizes the right to privacy as a fundamental right that must be protected by law. In addition to the constitutional provision above, the Nigeria Data Protection Act (NDPA) 2023 serves as the principal legislation governing the processing and protection of personal data in Nigeria. The Act established the Nigeria Data Protection Commission (NDPC) as the regulatory authority responsible for regulating data protection practices and ensuring that individuals' privacy rights are protected.9

Beyond the constitution, the Nigeria Data Protection Act (NDPA) 2023 sets out the legal standards for the protection and processing of personal data. Specifically, Section 24(1) requires that personal data be processed fairly, lawfully and transparently. This requires organizations and individuals to handle personal information lawfully while ensuring the process is open and fully understood by data subjects.10

The application of these principles to phone-number recycling raises a significant legal question. When a phone number is reassigned to a new subscriber, personal information may remain associated with that number through third-party applications, financial services, messaging platforms and other accounts. The reassignment of phone numbers may therefore create serious privacy and security risks for both the previous and new subscribers. These risks may include the exposure of personal communications, harassment, financial data exposure, and unauthorized access to accounts and authentications linked to the recycled number.

Recycled telephone numbers often remain linked to messaging apps, social media, email, and financial platforms long after a subscriber stops using them. When a number is reassigned, the new holder may receive the former subscriber's calls, texts, and notifications, while the former subscriber may still be contacted by people who have not updated their records, sometimes exposing either party to disputes, harassment or unwanted involvement in situations they have no connection to. An example is the popular case of Anthony Okolie, the man who was arrested and detained by the Department of State Service (DSS) for about 15 weeks for using a phone line previously used by the daughter of former President Muhammadu Buhari, Hanan.12

Recycled phone numbers also pose a distinct danger to financial security and account authentication. Because phone numbers are widely used for banking apps, fintech and mobile-money services, transaction alerts, and verification codes, a reassigned number can unknowingly give a new subscriber access to sensitive financial information belonging to someone else—data that falls squarely within the scope of data-protection and confidentiality obligations. Adding to this, many online platforms rely on phone numbers for two-factor authentication and identity verification, meaning reassignment can let a new subscriber be mistakenly recognized as the original account holder. 13 This raises concerns under the principles of privacy and lawful processing of personal data.

In Incorporated Trustees of Digital Rights Lawyers Initiative v L. T Solutions & Multimedia Ltd, the Court held that a data subject's rights under the Nigerian Data Protection Regulation (NDPR) may be enforced as a constitutional right under the Fundamental Rights Enforcement Procedure 2009. (FREP) Rules. Also, the case of Emerging Market Telecommunication Services v Barr Godfrey Nya Eneye (2018) emphasizes the protection of individual privacy, as well as the right to the privacy of a personal telephone line in accordance with section 37 of the Constitution of the Federal Republic of Nigeria.14 Although these cases do not specifically mention phone number recycling, it is relevant because the reassignment of a phone number may expose the former subscriber's personal communications to the new subscriber thereby violating the former subscriber’s right to privacy.

Thus, a critical question arises: whether current protective measures hold telecommunications operators and data controllers sufficiently accountable to stop these data exposure, or whether the risks of number recycling demand stricter regulatory oversight. Ultimately, these risks highlight a fundamental conflict between principles of lawful and transparent processing and the extent to which telecommunications providers and other data controllers should anticipate and mitigate such risks.

COMPARATIVE ANALYSIS

The European Union provides a useful point of comparison because the General Data Protection Rules (GDPR) adopts a broad, rights-based approach to the protection of personal data. Article 5 requires personal data to be processed lawfully, fairly and transparently and to be kept accurate and secure.15 The GDPR therefore provides principles that are directly relevant where a phone number remains connected to the personal information of a former subscriber after reassignment. However, the GDPR does not prohibit the recycling of telephone numbers, rather, it places obligations on controllers to ensure that personal data is processed and protected appropriately. This suggests that, from an EU perspective, the existence of number recycling is not necessarily incompatible with data protection, provided adequate safeguards are in place.16 Where the EU’s approach is principle based, the United States offers a more targeted mechanism-specific model to number recycling. Following the TRACED Act, the Federal Communications Commission (FCC) concluded that a 45-day aging period was appropriate, allowing 31 days to ensure each month's permanent disconnections are logged before a number is reassigned, plus a two-week buffer to protect consumers. Beyond this cooling-off period, service providers are required to maintain records of when each number was permanently disconnected, report these disconnections monthly to a Reassigned Numbers Database Administrator, and age numbers for at least 45 days before reassignment. Crucially, the database allows any caller to verify whether a number has been reassigned before contacting it, giving businesses, banks, and other third parties a practical tool to prevent misdirected communications.17 The comparison reveals an important distinction for Nigeria. While the EU approach primarily regulates the protection and security of personal data, the U.S. approach demonstrates a more specific mechanism for addressing the practical consequences of number reassignment. Nigeria already recognises telephone numbering as a scarce resource and its National Numbering Plan is designed to promote efficient allocation and avoid shortages.18 The comparative approaches therefore support retaining number recycling while introducing stronger safeguards— such as adequate cooling-off periods, reliable records of reassigned numbers and mechanisms that enable organisations relying on telephone numbers for authentication or communication to verify whether a number remains associated with its intended subscriber. This could provide a better balance between the efficient use of scarce numbering resources and the protection of individuals' privacy and security.

RECOMMENDATIONS

Based on the risks associated with number recycling and the comparative analysis of number recycling in the United States and the European Union, the following recommendations are proposed to address the vulnerabilities created by number recycling in Nigeria.

● Mandatory Quarantine (Cooling-off Periods): The Nigerian Communication Commission’s (NCC) recommends a 180-day subscriber notice, allowing consumers to transfer accounts before the number is recycled. However, the 18-month waiting period proposed by Nigerian lawmakers is a good starting point for cooling-off periods. The waiting period can be modified by operators but should be mandatory and not optional, as companies may exploit short-term contracts.19

● Pre-Termination Warnings: Operators should be required to notify subscribers before a number is flagged for recycling so that they can reassign accounts to unlock their data from the phone number. This directly addresses the gap exposed by the Okolie case, where reassignment occurred without any mechanism to alert affected parties.20

Consent and Judicial Recognition: A recycled number still linked to a former subscriber's data should be treated as a live concern under the Nigeria Data Protection Act 2023, not merely a telecom matter. Consent given to third parties by the original subscriber should not automatically extend to the new one. In addition, courts should be able to prosecute institutions or individuals found to be responsible for the privacy challenges created by recycled numbers.21

● Data Purging Obligations: Banks, fintechs, and platforms relying on phone numbers for verification should be required to delete or update account associations once a number is confirmed reassigned, prompting re-verification through alternative means. This mirrors the logic of the United States Reassigned Numbers Database, shifting the burden of verification from individual subscribers to the institutions best placed to prevent misuse.22 Together, these measures would reframe number recycling in Nigeria from a purely administrative numbering issue into a coordinated data protection and consumer rights concern.

CONCLUSION

Flowing from the foregoing, the recycling of phone numbers exposes individuals' personal, financial, and communication data to third parties who have no legitimate claim to it, thereby resulting in a privacy breach with real consequences. Addressing this requires more than piecemeal solutions; the layered regulatory measures proposed — quarantine periods, pre-termination warnings, clearer consent rules, and data purging obligations— offer a more proportionate and coordinated response.

Ultimately, these risks point to a deeper, unresolved question: whether telephone numbers should function as stable identity credentials or their actual nature— temporary, recyclable telecom resources. Until this tension is directly confronted through deliberate regulatory reform, individuals will remain exposed to risks that current safeguards were never designed to prevent. Nigeria's regulators, telecom operators, and data protection authorities must therefore treat

1. AMINA MIANGO, Personal Data: What the Law Says?, CJID(June 4, 2026)

2. NHI MGMT GROUP, Mobile Number Recycling, NON-HUMAN & AI IDENTITY J. (July 11,2026).

3. OLUWANIFEMI KOLAWOLE, Here Is Why Telcos Recycle Phone Numbers, TECHPOINT AFRICA (Jan. 15,2020).

4. ABIMBOLA ABATTA, How Recycled Phone Numbers Expose Nigerians to Data Risk, Financial Losses, FOUNDATION FOR INVESTIGATIVE JOURNALISM (June 4, 2025).

5.Nigeria Data Protection Act, No. (25) (2023), § 65 (Nigeria); Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), o.j. (L 119) 1, art. 4(1).

6. Personal Data, GDPR-INFO.EU (intersoft consulting services AG), ; MIANGO, supra note 1.

7. O. M. ATOYEBI, Data Protection Concerns of SIM Card Recycling in Nigeria, OMAPLEX LAW FIRM (June 10,2024)

8. CONST. OF NIGERIA (1999), § 37; MIANGO, supra note 1.

9. MIANGO, supra note 1.

10. Id.

11. ATOYEBI, supra note 7.

12. Id.

13. ABATTA, supra note 4.

14. Emerging Market Telecommunication Services v. Barr Godfrey Nya Eneye, (2018) LPELR-46193 (CA);Incorporated Trustees of Digital Rights Lawyers Initiative v. L.T. Solutions & Multimedia Limited, Suit No.AB/83/2020 (Ogun State HC) (Unreported).

15. Principles of Data Protection, DATA PROTECTION COMMISSION,(last visited Aug. 15, 2026).

16. GDPR, supra note 5, art. 5(1)

17. FEDERAL COMMUNICATIONS COMMISSION, REASSIGNED NUMBERS DATABASE (RND) TECHNICAL REQUIREMENTS DOCUMENT 14 (2020)

18. NIGERIAN COMMUNICATIONS COMMISSION, DEVELOPMENT OF A NEW NUMBERING PLAN FOR NIGERIA: DRAFT FINAL REPORT (2020),Straight From Naija, Nigerian Lawmakers Push for 18-Month Waiting Period Before Recycling Inactive Phone Numbers, FACEBOOK (Apr. 28, 2026).

20. Punch Newspapers, NCC Proposes 14-Day Notice Before SIM Deactivation, FACEBOOK (Mar. 2, 2026).

21. HARRISON EDEH & EHIME ALEX, Regulatory Gaps on Phone Number Recycling Fuel Identity Theft, Data Breaches, THE ICIR (June 8, 2025).

1. Straight From Naija, supra note 19.