Nigeria Data Protection Commission (NDPC) has slammed a ₦766,242,500 fine on MultiChoice Nigeria for breaching the Nigeria Data Protection Act (NDPA).
NDPC is a public institution that processes data in furtherance of its mandate as Nigeria’s data protection authority and relies on recognised lawful bases for data processing, such as consent, legal obligation, and contract.
The fine was contained in a statement signed by the Head, Legal, Enforcement & Regulations, NDPC, Mr. Babatunde Bamigboye.
According to him, the investigation, which commenced in the second quarter of 2024, was triggered by suspected breach of privacy rights of Multichoice subscribers and illegal cross-border transfer of personal data of Nigerians.
“The NDPC found, among others, that Multichoice violated the data privacy rights of subscribers and their friends who are not necessarily subscribers.
The Commission also found that Multichoice carries out illegal cross-border transfer of personal data relating to data subjects in Nigeria.
The depth of data processing by Multichoice is patently intrusive, unfair, unnecessary, and disproportionate. This is a grave affront to fundamental right to privacy as enshrined in Section 37 of the 1999 Constitution of the Federal Republic of Nigeria.”
In line with its standard remediation procedure, the Commission directed Multichoice to carry out appropriate remedial measures. However, the Commission found the measures undertaken by Multichoice in this regard unsatisfactory.
For want of cooperation, the Commission has directed Multichoice to pay ₦766,242,500 for violating the Nigerian Data Protection Act.
“Nigeria is entitled to protect her citizens and data sovereignty under both international and extant municipal laws, as these have far-reaching implication for rule of law, national security, and economic growth.” the statement said.
Babatunde also revealed that NDPC National Commissioner, Vincent Olatunji, has directed that all outlets through which Multichoice is collecting personal data of Nigerian citizens should be investigated for non-compliance.
He added that any outlet that processes personal data in violation of the NDP Act is liable to penalty under the Act.
