National Data Protection Commission (NDPC) has imposed N555.8 million fine on a Nigerian bank for violating its customers’ data privacy.
Consequently, the commission has given the bank 14 days’ ultimatum to pay the fine upon receiving the notice, stating that the action underscores the NDPC’s commitment to enforcing data protection laws and holding organisations accountable for safeguarding customers’ data.
National Commissioner, Vincent Olatunji, who disclosed this at a validation workshop on the Nigeria Data Protection Act General Application and Implementation Directive, yesterday, in Abuja, noted that the bank was found to have breached the Nigeria Data Protection Regulation (NDPR) of 2019 and the Nigeria Data Protection (NDP) Act of 2023, adding that the fine, which amounted to 0.1 per cent of the bank’s yearly gross revenue for 2023, is the largest ever issued by the commission.
Olatunji observed that the penalty was aggravated due to the lack of cooperation and arrogant disposition of the bank during the investigation.
The commissioner emphasised the importance of data privacy and protection compliance, stressing that penalties for non-compliance could range from N10 million to up to two per cent of an organisation’s gross earnings.
He said: “Since we started, the only time we issued a major penalty was yesterday on Fidelity Bank, we issued a fine of about N555 million that they have to pay. We observed some breaches, we have been working with them since April 2023 on the investigation and by the time we finalised, they became arrogant; so, we decided to issue a full penalty on them, which is about 0.1 per cent of the gross earning for 2023.
“The penalty is huge if you don’t comply, penalties can range from 10 million naira even up to two per cent of their annual gross income for the previous year”.
Olatunji highlighted the sector’s growth due to increased investment in data protection infrastructure, expertise, and services, driven by the demand for data-driven services across various industries.
