By Clifford Agugoesi, Editor-in-Chief
The National Data Protection Commission(NDPC) will penalise individuals and organizations infringing upon the data protection and privacy rights of citizens based on the impact of the data protection breaches on the victims, the National Commissioner, NDPC, Dr. Vincent Olatunji has said.
Dr. Olatunji made this declaration Sunday at an interactive session with ICT journalists on the activities of the Commission. According to him, the NDPC was independent based on the law that set it up and would be able to sustain itself financially from licencing of data protection officers( DPOs), annual returns and fines from data protection breaches.
So far, the NDPC has concluded and fined three out of the seven organizations it has commenced investigations on for possible data breaches. He did not disclose the organizations fined. However, Cyber Era NG gathered that Fidelity Bank, Guaranty Trust Bank, Leadway Assurance and Babcock University are still under the agency’s lens for possible data protection breaches.
Dr. Olatunji also explained the Commission’s stand on the recent order by the Central Bank of Nigeria(CBN) to the Commercial banks to integrate social media handles of their customers as part of the requirements under Know Your Customers.
“Now, coming to the one on CBN asking for social media handles of their clients, I have said it severally that that is not proper, because for you to do this kind of a thing, the number one thing that you need is to have the CONSENT of the Data Subjects, in this case, the bank customers. You need their consent. Have the banks sought the consent of their customers before issuing such an order?
“Two, there is what is called DATA MINIMISATION, which is part of the principles of Data Processing and Data Protection. Now, you are asking for the social media handles of the customers to these banks whereas we have NIN, International Passports, Drivers Licenses and Home addresses which already they have submitted to the banks and a lot of people now have their email addresses submitted to the banks. So, I think these instruments should be enough to know their customers very well. Now, if it (submission of social media handles) has to be done, definitely there are some controls, some safeguards that must be put in place; because, even the banks, themselves, are at high risk when they collect such data, because anybody can just make use of it and use it in a malicious manner without the consent of the data subjects. And that is really key.
“And, in any case, for instance, Twitter has started charging. If other social media platforms say users must pay for the services they are rendering ; are they now going to compell Nigerians to start paying for the services? Whereas, if it is only about Know Your Customers I think the instruments that they already have are enough for the banks to Know Their Customers. Now there are some principles under which you can ask for further details of the Data Subjects: For instance, if it is for security purpose and there are provisions in the Law and guidelines that you have to follow for you to be able to do that and you need to adequately inform the Data Subjects. Also, on the issue of PURPOSE LIMITATION. For the purpose of knowing your customer, now asking for social media handles, is going overboard, since you have other things that you can use to identify them. “
As hinted by Dr. Olatunji, the Commission had written to the CBN on this matter. “The most important thing,” he says,” is for us to meaningfully engage them and let them know the challenges that may come up with this kind of regulation that has been issued. We are meeting with the bank MDs and hopefully we are going to iron these things out.”
