7 banks, others pay over ₦200m for data privacy violations

Seven Nigerian banks and other erring institutions have paid penalties of over ₦200 million to the government for violating the data privacies of Nigerians. The National Commissioner of Nigeria Data Protection Commission (NDPC), Dr Vincent Olatunji said this while meeting reporters at the Commission’s headquarters in Abuja after the President, Bola Tinubu signed the data protection act into law. With the surge in data breaches over the years, the new law seeks to make available, a legal framework to regulate personal information in the country. The new law aims to create a more robust framework around protecting personal information and making them more private so hackers and other unscrupulous elements do not get access to personal data.

Due to privacy breaches, some customers have been affected and have either lost cash or their personal identity to hackers. Olatunji cited instances where customers could not access their funds in the banks because their personal data were wrongly captured during onboarding. Other customers failed to access their funds because the banks could not effectively secure their data thus allowing them to be exposed to hackers who took advantage of the breaches to steal their funds. Olatunji noted that the penalties came after the institutions which include a private university and some insurance companies, were found culpable for several privacy infractions after a series of investigations were conducted by the commission in a space of a year.

Although it was confirmed that seven banks were held responsible and made to pay the fines, the National Commissioner, however, did not reveal the identities of the erring financial institutions. He confirmed that within the past year, over 100 private sector institutions have been in their investigative net for various degrees of data privacy violations. Chief Executive Officers of Ministries, Departments and Agencies (MDAs) have also been warned that they would be held responsible and will be prosecuted if any such data privacy breach is traced to their institutions.