TECHDIGEST – The National Information Technology Development Agency (NITDA) has sanctioned an online lending platform, Soko Lending Company Limited (Soko Loans), for privacy invasion.

This action was taken after receiving series of complaints against the company for unauthorized disclosures, failure to protect customers’ personal data and defamation of character as well as carrying out the necessary due diligence as enshrined in the Nigeria Data Protection Regulation (NDPR).

One of such complaints filed by Bloomgate Solicitors on behalf of its client, the data subject, was received on Monday, 11th November 2019. NITDA, as part of its due diligence process, commenced investigation over the alleged infractions of the provisions of the NDPR.

Soko Loans grants its customers uncollateralised loans and requires a loanee to download its mobile application on their phone and activate a direct debit in the company’s favour. The app gains access to the loanee’s phone contacts.

According to one of the complainants, when he failed to meet up with his repayment obligations due to insufficient credit in his account on the date the direct debit was to take effect, the company unilaterally sent privacy invading messages to the complainant’s contacts.

Investigation revealed that complainants’ contacts who were neither parties to the loan transaction nor consented to the processing of their data have confirmed the receipt of such messages. The Agency made strident efforts to get Soko Loan to change the unethical practice but to no avail.  After the Agency’s investigation team secured a lien order on one of the company’s accounts by which it could come up with privacy enhancing solutions for its business model, Soko Loan decided to rebrand and directs its customers to pay into its other business accounts.

The Agency’s investigation further revealed that the company embeds trackers that share data with third parties inside its mobile application without providing users information about it or using the appropriate lawful basis.

NITDA has therefore found Soko Loan and its entities in violation of the following legal provisions:

1.   Use of non-conforming privacy notice, contrary to Article 2.5 and 3.1(7) of the NDPR;
2.   Insufficient lawful basis for processing personal data, contrary to Articles 2.2 and 2.3 of the NDPR;
3.   Illegal data sharing without appropriate lawful basis, contrary to Article 2.2 of the NDPR;
4.   Unwillingness to cooperate with the Data Protection Authority, contrary to Article 3.1 (1) of Data Protection Implementation Framework; and
5.   Non-filing of NDPR Audit reports through a licensed Data Protection Compliance Organisation (DPCO), contrary to Article 4.1(7) of the NDPR.

In view of the foregoing and in consideration of its implication on the privacy of Nigerians and erosion of trust in the digital economy, NITDA hereby:

a)   imposes a monetary sanction of Ten Million Naira (N10,000,000) on Soko Lending Company Limited.
b)  directs that no further privacy invading messages be sent to any Nigerian until the company and its entities show full compliance with the NDPR.
c)   directs the company to pay for the conduct of a Data Protection Impact Assessment by a NITDA appointed DPCO on its operation; and
d)  Placement on a mandatory Information Technology and Data Protection oversight for 9 months.

It may be noted that the criminal aspects of this investigation has been deposited with the Nigeria Police to determine if the executives of the company are liable to imprisonment for violating Section 17 of the NITDA Act, 2007.

NITDA therefore uses this medium to remind all Nigerian businesses and data controllers of their obligation to engage NITDA-licensed Data Protection Compliance Organisations (DPCO) to guide them towards compliance with the data protection law. The Agency is poised to fully enforce the NDPR with the aim of sanitising the operating environment, instilling confidence in the digital economy and protecting the right to privacy of Nigerians.

The National Information Technology Development Agency (NITDA) is the apex regulator for Information Technology in Nigeria under the supervision of the Federal Ministry of Communication and Digital Economy. The Agency is empowered by Section 6(c) of the NITDA Act, 2007 to develop guidelines for electronic governance and monitor the use of electronic data interchange and other forms of electronic communication transactions in Nigeria. The Agency issued the Nigeria Data Protection Regulation (NDPR) as Nigeria’s first comprehensive framework for the protection of personal data. The NDPR provides the principles and framework for the protection and processing of personal data of Nigerians and residents.

Mrs Hadiza Umar, MNIPR, M.APRA, MCIPR
Head, Corporate Affairs and External Relations

The post NITDA Fine SokoLoan N10m for Privacy Invasion appeared first on Tech Digest News.

TECH DIGEST – Data protection is the nucleus of digital economy, the CEO of Data Services Protection Limited (DSPL), Mr. Tunde Balogun, has said.

Mr Balogun, who is also the convener of the Association of Licensed Data Protection Compliance Organisations of Nigeria (ALDPCON), said Nigeria’s increasing official interest in data is because government is coming to terms with data as the real asset of the new or digital economy.

He spoke, on Sunday, during a training session for some ministries, departments and agencies (MDAs) in Ibadan, Oyo state.

According to him the Federal Government in its wisdom, through the National Information Technology Agency (NITDA), issued the Nigeria Data Protection Regulation (NDPR) of 2019 as the principal data protection legislation to address concerns around privacy and protection of personal data which also focuses on the grave consequences of leaving personal data processing unregulated.

The NDPR issued by the NITDA on 25 January 2019 pursuant to Section 32 of the NITDA Act 2007 as subsidiary legislation to the NITDA Act 2007 is only a purveyor of the wider sets of data legislations now at the National Assembly expected to guide Nigeria’s data protection journey and march into the digital economy said Balogun whose company is licensed to operate as a Data Protection Organisation (DPCO).

DPCOs are licensed under the NDPR to provide professional data protection services to public and private entities. There about over 70 licensed DPCOs tasked with monitoring compliance to the NDPR.

Balogun, whose company offer data protection tasks for a number of private and public clients including the governments of Plateau and Oyo states, admitted that there is a growing awareness among stakeholders on data as an asset worth a high level of protection.

“The good thing is that some of our people are beginning to understand why data must be protected in all ramifications. Plateau state started this journey last year. Also, a good example is the government of Oyo state where we are currently implementing data protection services for about eight ministries, departments and agencies as part of the first phase of the scheme,” he said.

The post Data Protection Is The Nucleus Of Digital Economy appeared first on Tech Digest News.

TECH DIGEST – The Director General of National Information Technology Development Agency (NITDA), Mallam Kashifu Inuwa says that in less than two years, NITDA has achieved several milestones, while also recording unprecedented achievements in the implementation of the Nigeria Data Protection Regulation (NDPR).

He said by implementing NDPR, NITDA has licensed 70 Data Protection Compliance Organizations, (DPCO); created over 2,686 new jobs roles in the industry; and also developed a new data protection sector which is valued at over 2 million naira.

Inuwa, made this known at a webinar themed, “Personal Data Protection and Cybersecurity,” organized by Africa Data Protection Conclave.

The event was aimed at bringing together the leading African nations in data protection and cybersecurity.

Mal. Inuwa, noted that long before the European Union (EU) issued the General Data Protection Regulation, NITDA had a focused perspective about data privacy and protection.

“The NITDA Act 2007 empowers us to develop guidelines for electronic governance and monitor the use of electronic data interchange and other forms of electronic communication transactions as an alternative to paper-based methods in government, commerce, education, the private and public sectors, labour, and other fields, where the use of electronic communication may improve the exchange of data and information,” he said.

He added that the NITDA approach is to unlock opportunities for our talented youths to harness data, the world’s most valuable resource in the digital economy.

The NITDA Director General further said, “NITDA has remitted the sum of over N15 million to Federal Government consolidated revenue account from DPCO licensing and Audit report filing; issued 230 compliance and enforcement notices; initiated and deposited 8 data breach cases with the Police and resolved over 790 issues.

“The Agency has also successfully investigated and issued a data breach fine on a public institution making it the first and only data breach fine in Africa for 2020, issued a Guidelines on Use of Personal Data by Public Institutions, 2020, launched the NDPR Portal for filing of audit reports and reporting of breaches; and issued the NDPR Implementation Framework 2020.”

The post How NITDA Licensed 70 Data Compliance Organisations- Kashifu Inuwa appeared first on Tech Digest News.