An information security expert and European engineer, Dr. Kingsley Chibuzor Aguoru, has cautioned that the Memorandum of Understanding (MoU) between the Federal Inland Revenue Service (FIRS) and France’s tax authority, the Direction Générale des Finances Publiques (DGFiP), may expose Nigeria to latent data security and digital sovereignty risks, despite official assurances that no Nigerian taxpayers’ data will be accessed or compromised.
Dr. Aguoru warned that from an information security standpoint, tax and revenue systems constitute some of the most sensitive elements of national digital infrastructure. He noted that such systems hold vast amounts of personally identifiable information, financial records, behavioural data and strategic economic intelligence. According to him, data compromise does not occur only through direct database access or copying, but can also arise from system visibility, architectural influence and process alignment.
He explained that while international cooperation agreements can be structured to avoid direct data exposure, meaningful technical assistance in digital tax reform typically involves examination of system architecture, data flows, analytics models and compliance mechanisms. Even in the absence of login credentials or database access, he said, risks may emerge through architecture reviews, data-flow mapping, fraud detection model analysis, standards alignment and long-term technological dependencies.
“In information security, the claim of ‘no direct access’ does not automatically mean ‘no risk’,” Aguoru said. “Modern cyber and data risks often arise from metadata, system logic and analytics models rather than from the outright extraction of raw data.”
He further warned that the MoU could have complex regulatory implications under global data protection regimes, particularly the European Union’s General Data Protection Regulation (GDPR). He noted that GDPR determines data controllership and joint controllership not only by physical possession of data, but also by influence over how data is processed, classified, retained or governed.
“If an EU-based tax authority provides advisory input that shapes the processing or governance of Nigerian taxpayer data, questions may arise about indirect processing influence and cross-border compliance exposure under GDPR-style frameworks, especially in the event of future disputes or data breaches,” he said.
Dr. Aguoru also expressed concern that a memorandum of understanding, unlike a treaty, does not automatically attract legislative scrutiny, enforceable safeguards or independent technical validation. He argued that reliance on assurances that existing data protection and cybersecurity laws remain applicable is inadequate, as such laws are largely remedial and take effect only after damage has occurred.
“Cybersecurity and data protection are preventive by design,” he said. “For systems as sensitive as national tax infrastructure, protection must be embedded at the architectural and governance levels, not assumed through post-event legal remedies.”
The expert questioned the absence of clarity on what France stands to gain from the agreement, observing that advanced tax authorities do not engage in international digital cooperation solely for altruistic reasons. He said transparency demands that the strategic interests and benefits to all parties be clearly stated, warning that failure to do so fuels public suspicion and undermines trust.
He cautioned that digital sovereignty is rarely lost through sudden or dramatic breaches, but is often eroded gradually through opaque frameworks, standards dependency and long-term system influence. According to him, control over tax data amounts to control over national economic intelligence, and once external influence over standards or system logic becomes entrenched, reversing such dependency becomes increasingly difficult.
Dr. Aguoru called on the Federal Government to rebuild public confidence by publishing the full terms of the MoU, explicitly prohibiting any form of system visibility or data-flow exposure, subjecting the agreement to an independent cybersecurity and data protection impact assessment, and fully briefing the National Assembly.
He concluded that public scrutiny of the agreement should not be dismissed as political hostility, stressing that vigilance in data governance is an essential defence of national security, regulatory integrity and citizens’ privacy in an increasingly digital economy.