The Nigeria Data Protection Commission (NDPC) has announced that the federal government has imposed a hefty fine of N555.8 million on Fidelity Bank Plc for data breaches.
Vincent Olatunji, the National Commissioner of NDPC, revealed this information during the Nigeria Data Protection (NDP) Act General Application and Implementation Directive (GAID) validation workshop held in Abuja.
He explained that the commission’s authority to enforce compliance through fines stems from the NDP Act, which President Bola Tinubu signed into law on June 12, 2023.
“Since we started, the only time we issued a major penalty was yesterday on Fidelity Bank; a fine of N555,800,000 after we observed some breaches,” Mr. Olatunji stated.
He further elaborated that the investigation into Fidelity Bank commenced in April 2023 and concluded with the finding that the bank had defaulted on data protection regulations.
The commissioner highlighted the severity of non-compliance penalties, noting that fines can range from N10 million to up to two percent of an organization’s annual gross income for the previous year. In Fidelity Bank’s case, the fine represents approximately 0.1 percent of its gross earnings for 2023.
Mr. Olatunji emphasized the commission’s approach to determining penalties: “Most of the breaches we have treated, we look at the level of the breach, the impact, the number of data subjects affected and the level of cooperation that is involved.”
The NDPC is actively engaging with stakeholders across various sectors to develop comprehensive guidelines for data protection.
The commission has already conducted a similar workshop in Lagos on June 19, involving about 70 percent of data protection organizations in the private sector.
To ensure widespread compliance, the NDPC is implementing a Public Private Partnership model.
“We have licensed about 194 professionals on data protection,” Mr. Olatunji said.
These licensed professionals assist organizations in crafting privacy policies, creating awareness about legal obligations, conducting data protection impact assessments, and training staff.
The commissioner stressed the importance of collaborative efforts among stakeholders, organizations, businesses, and data protection professionals for the successful implementation of the NDP Act.
He called for ongoing dialogue and communication with the Commission to foster “a data ecosystem that respects privacy and protects personal data subjects.”
