The Nigeria Data Protection Bureau (NDPB) has opened an investigation into allegations of data breach by two Nigeria Banks, GT Bank and Zenith Bank. The investigations were triggered by allegations of unlawful disclosure of banking records to third party and unlawful access and processing of personal data. This disclosure came from the National Commissioner and CEO of NDPB, Dr. Vincent Olatunji, at a briefing to mark this year’s National Privacy Week, in Abuja.
According to the NDPB chief, the investigation covers the data governance practice of the banks in all their branches in Nigeria and extends to all third parties carrying out data processing activities.
The Bureau noted with concern that many data privacy and protection regulations and best practices are hardly implemented down the organisational strata of major data controllers in Nigeria.
The NDPB Commissioner therefore enjoined organisations to heed the Federal Government circulars and general compliance notice directing them to send the names of their Data Protection Officers/Contacts to the Bureau.
There are reports by Nigeria Inter Bank Settlement System (NIBSS) which indicated that within 9 months of 2020, fraudsters attempted 46,126 attacks and they were successful in 41,979, representing 91% success rate.
“This level of vulnerability to data breach is unacceptable and it can only be addressed through foolproof data security and data privacy measures by data controllers/data processors in the industry.
The National Commissioner enjoins all financial institution to emulate the example of the Central Bank of Nigeria in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and in creating a robust data governance system,” Olatunji noted.
The Minister of Communications and Digital Economy, Prof. Isa Ali Ibrahim Pantami, had in his speech at the flag off of the National Privacy Week last weekend in Abuja enjoined Nigerians to report any data breach to the NDPB so that a proper investigation can be done.
The Minister said: “Banks have been sanctioned. Operators in our sector have been sanctioned. Many more operators are being investigated today. So, continue investigating. To ensure that we improve in that level of compliance is very important.”
He further noted: “Whenever we see any breach of data, let us confidentially draw the attention of the Bureau to go and investigate. By doing that, we will play a significant role.”
The Minister added: “In addition, if you look at it, the quantity of data that is being generated today, if there is no data privacy compliance in place, definitely it will compromise global security. If you have a mobile phone, you’ll discover that with some applications, if care is not taken, the information the controllers of these gadgets have about you, you don’t even know it. They know more about you than you know about yourselves.
With our situation today, local and international companies are illegally and secretly commercialising citizens’ data without their knowledge.”
“The National Privacy Week is an opportunity for all organisations to set their records straight on how they handle the data of citizens. Enforcement measures will be taken against willful violators of privacy rights forthwith”, Olatunji had earlier noted.
