The Nigeria Data Protection Commission (NDPC) has initiated an investigation into three banks, a university, and several suspects in relation to an alleged data breach. A data breach refers to the unauthorized access of confidential information.
Among the entities being investigated are Zenith, Fidelity, and Guarantee Trust Banks, as well as Babcock University and Leadway Insurance, among others, as listed by the commission. In a statement, Vincent Olatunji, the national commissioner of NDPC, disclosed the investigation, which was prompted by complaints from data subjects. He emphasized that the newly enacted Nigerian Data Protection Act (NDPA) empowers the commission with a legal framework to address incidents of data breaches affecting citizens.
Over the past few weeks, NDPC has received complaints related to unlawful data processing, unauthorized access to personal data, and violations of data subjects’ rights, explained Mr. Olatunji. He further stated, “Under Part 10 of the recently signed NDPA 2023, a data controller with an annual turnover of N200 billion may face penalties of up to N2 billion, representing two percent of their gross revenue.” Additionally, offenders could face up to one year of imprisonment. The ongoing investigation focuses on Guarantee Trust Bank, Fidelity, Unity, Zenith banks, Leadway Insurance, Babcock University, and others for their involvement in the data breach.
Mr. Olatunji highlighted that numerous microfinance banks have yet to align their operations with the requirements of data privacy and protection. He also revealed that loaning organizations would be subject to the law under the new mandate of the Federal Competition and Consumer Protection Commission. This mandate necessitates loan organizations to obtain compliance and clearance from NDPC before approving online lenders.
“The commission is currently investigating over 400 complaints in the online lending sector. Soko Loan is in the process of making a comeback to the digital lending market, but awaits approval,” the commissioner stated. He further emphasized that NDPC is conducting awareness campaigns to ensure data controllers understand the consequences of data breaches.
