The Nigeria Data Protection Commission (NDPC) has warned that the recent directive by the Central Bank of Nigeria (CBN) mandating banks to start demanding social media handles of their customers as part of mandatory information in the KYC indices may constitute impediments in the bid to ensure security of customers data in Banks.
Speaking at a virtual Media Parley, NDPC National Commissioner and CEO, Dr. Vincent Olatunji disclosed that the directive, if implemented, will pose some challenges to both the banks and the customers.
He disclosed that the Commission has scheduled a meeting with the CBN to amicably seek other options, while pointing out the dangers of accessing customers’ social media handles by banks.
According to him, “The CBN mandate is wrong. To access customers’ data, data consent is required from the data subjects.”
He further noted that banks will be at risk handling such customers data as it is prone to easy cyber attack and penetration, while banks can be blamed for such breaches.
Dr. Adetunji pointed out that the current KYC parameters are sufficient as they already have other means of identifying customers.
The NDPC, which was recently established as a full-fledge Commission under the Federal Government, operated as a Board under the National Information Technology Development Agency (NITDA) until the Bill establishing it as an independent Commission to implement the Nigeria Data Protection Regulation (NDPR) was signed into law on June 12, 2023.
By the Act, all government Ministries, Departments and Agencies (MDAs), including private organisations are to comply by the NDPR , and the regulatory dictates of the Commission.
While speaking on the Commission’s plans, Dr. Olatunji disclosed that the NDPC targets to have 500,000 Data Processing Officers (DPOs) work in offices across Nigeria.
“We are going to work with the Data Processing and Compliance Offices (DPCOs) and national certification bodies to ensure that only certified individuals are recruited and trained.”
He also noted that 160 data compliance monitoring organisations (DCMOs) have been licensed. They are to issue certifications based on a predetermined curriculum and training format.
While acknowledging that the data protection ecosystem is still in its emerging state in Nigeria, Dr. Olatunji said the campaign by NDPC will be to ensure that data controllers and processors know their obligations, while data consumers should know their rights.
He further noted that the Commission will embark on capacity building, an ecosystem that will create jobs and be globally competitive. “There is shortage of Data Processing Officers. Measures are already in place to get them.”
Dr. Olatunji also assured that every section of the data protection law will be broken down to address specific needs in data security and protection to the understanding of every Nigerian, even those at the grassroots, using its collaboration with the National Orientation Agency (NOA) as leverage.
He expressed satisfaction in the level of growth in compliance by both the government and private establishments, which stood at 9% for public sector organisations, and 49% for the private sector, as at February, just one year after the establishment of the Board. He however noted that the federal government has directed all MDAs to comply with the NDPR.
While stating that the NDPC is more interested in compliance than in penalizing non-compliant organisations, Dr. Olatunji noted that now that the Board has been turned to a Commission, the growth level will increase.
“What is really important to us is compliance, not the fines. We want to create the culture of data security, and responsible use of public and private data . So even when you pay the fines, we still monitor you for the next six months to know if you are maintaining it.”
