The Nigerian Data Protection Commission (NDPC) says the federal government has fined Fidelity Bank Plc. N555.8 million for data breaches.
NDPC National Commissioner, Vincent Olatunji, stated this at the validation workshop of the General Implementation and Enforcement Directive (GAID) of the Nigerian Data Protection Act (NDP) in Abuja.
Mr. Olatunji recalled that President Bola Tinubu signed the NDP Act into law on June 12, 2023, thereby empowering the commission to enforce data protection compliance in organisations through fines and other means.
He said the commission launched an investigation into Fidelity Bank in April 2023 and upon completion found it to be in default.
“The fine is huge if you fail to comply; penalties can range from N10 million to even two percent of the organization’s annual gross revenue from the previous year.
“In most of the breaches we have dealt with, we look at the level of the breach, the impact, the number of data subjects affected and the level of cooperation involved.
“Since we started, the only time we have imposed a major penalty was yesterday on Fidelity Bank – a fine of N555.8 million after we observed some infractions.
Article page with promotion of financial support
READ ALSO: Fidelity Bank Plc conducts N29.6 billion rights issue and N97.5 billion public offering
“We have been working with them since April 2023 on the investigation and, when we completed it, we decided to impose a full fine on them, which is approximately 0.1 percent of 2023 gross revenue.”
Mr. Olatunji also explained that the commission was engaging with stakeholders across the board and gathering their inputs, which would form the final guidance document.
He recalled that a similar workshop was held in Lagos on June 19 for approximately 70 percent of private sector data protection organizations.
“We want to make sure that everyone is involved in what we are doing and when the document comes out we will all see that we have been able to make our own contribution; it is just an extension of the law.
“We will study the relevance of the contributions and use them to develop a standard document that can have a global standard.”
He said the commission was implementing a Public Private Partnership model to ensure data protection compliance.
“We have graduated around 194 data protection professionals.
“Authorized data protection professionals visit organizations and guide them in complying with regulations regarding the development of their privacy policy.
“They help raise awareness within organisations, making them aware of their obligations under the law and carrying out data protection impact assessments.
“They train the staff, register them with us and submit their annual report to the NDPC, so we will know the level of compliance.”
The Commissioner noted that successful implementation of the NDP Act required collaborative efforts between all relevant stakeholders, organisations, businesses and data protection professionals.
He therefore called for constant dialogue and communication with the Commission to implement the PND Law.
“Collaborative efforts will foster a data ecosystem that respects privacy and protects personal data subjects,” Olatunji said.
(YAYA)