Four Nigerian banks, others fined N400m for data breaches

The Nigeria Data Protection Commission (NDPC) has disclosed that over 1,000 financial institutions, schools, insurance companies, and consultancy firms are under investigation for various data breaches.

Vincent Olatunji, the National Commissioner of the NDPC, revealed that four major banks and three other institutions have been sanctioned and fined a total of N400 million for breaches of citizens’ data. This announcement was made on Tuesday during an interactive session with journalists to mark the first anniversary of the Nigeria Data Protection Commission Act, signed into law by President Bola Tinubu on June 12, 2023. This act was designed to advance privacy rights and other fundamental freedoms in both digital and analogue transactions.

The legislation empowers Nigerians to seek redress for data breaches and mandates that data be processed in a fair, lawful, and accountable manner.

Olatunji emphasized the growing importance of data protection, noting that the nation’s data ecosystem is now valued at over 10 billion naira. He stressed the Commission’s commitment to safeguarding citizens’ data in line with global best practices to ensure its safety, security, and protection.

He stated, “Cumulatively, we have had over 1,000 reports of data breaches since we started. The number is relatively low due to the low level of awareness among Nigerians. Out of these cases, around 400 involve digital revenue companies, commonly known as loan sharks. We have conducted investigations in various sectors including education, financial institutions, real estate, insurance, consulting, and schools. As of today, we have finalized four major investigations, and some entities have paid their remediation fees. Under the law, we can fine companies based on the nature of the breach, its impact on the subjects, and their level of cooperation, resulting in N400 million from remediation fees.”

Olatunji also highlighted ongoing investigations into data infractions and noted an increase in compliance with the Nigeria Data Protection Act. He mentioned that private sector compliance has risen from 49% to over 55%, while public sector compliance has improved from 4% to 15%.