TECHDIGEST – The National Information Technology Development Agency engaged in 17 data breach investigations and issued N15m fines in 2021, a new report has revealed.

This was disclosed in the Nigeria Data Protection Regulation Performance Report 2020-2021, which was launched by the Minister of Communications and Digital Economy, Prof Isa Pantami, last week.

The report further disclosed that seven investigations were concluded and sanctions were imposed on three entities.

It was also disclosed that the number of ongoing investigations on alleged data breaches rose from 15 in 2020 to 17 in 2021, while the number of investigations concluded rose from one in 2020 to seven in 2021.

In addition, the amount of fines issued rose from N1m in 2020 to 15m in 2021.

The report further disclosed NITDA that was partnering with key stakeholders to ascertain appropriate sanctions for different kinds of violations of the Nigeria Data Protection Regulation.

It read in part, “NITDA is partnering with stakeholders to determine administrative sanctions for identified categories of the NDPR breaches. This would provide clarity and predictability to the NDPR enforcement efforts and serve as a good foundation for any future data protection law.”

Earlier this month, The Director General of the National Information Technology Development Agency (NITDA), Kashifu Inuwa Abdullahi revealed that as part of the NITDA’s 2021 vision, the Agency is poised to develop a toolkit for sector stakeholder to agree on a single, workable template for data privacy compliance in their sector, standardize NIDPR courses trainings in order to develop a multi-billion naira sector that would create thousands of jobs for trainers, content providers and other professionals, rejig enforcement mechanism for data protection compliance as it has become a pivot for the continued growth of the digital economy, among other plans.

In March 2021, NITDA ordered a data controller, Electronic Settlement Limited, to pay the sum of N5m as a fine for certain breaches on personal data entrusted to the company.

In August 2021, NITDA imposed a sanction of N10m on an online lending platform, Soko Lending Company Limited, for data privacy invasion.

In November 2021, NITDA partnered with the Federal Competition and Consumer Protection Commission to address the increasing rates of data privacy abuse by money lending organisations, particularly fintech firms.

The post NITDA Probes 17 Firms Over Breach Of Customers’ Private Data appeared first on Tech Digest News.

TECHDIGEST – The National Information Technology Development has stated that it is working with the Nigerian police to investigate online lending platforms, over their alleged breaches of customers’ data privacy.

This was disclosed by the Director-General, National Information Technology Development Agency, Kashifu Inuwa while addressing journalists ahead of the National Privacy Week 2022.

In August, NITDA had imposed a sanction of N10 million on an online lending platform, Soko Lending Company Limited (Soko Loans), for data privacy invasion.

From the Findings, it showed that a number of these loan app operators now send embarrassing short messages service (SMS) and WhatsApp messages to the close contacts of their loan defaulters with the intention of shaming the defaulters, tagging them with terms like ‘criminal,’ ‘fraudster,’ and ‘terrible debtor’ among others.

In some cases, the full names, phone numbers and pictures of the alleged loan defaulters are shared with their contacts like religious leaders, members of churches and mosques, close friends, bosses, colleagues and family members.

In November 2021, NITDA partnered with the Federal Competition and Consumer Protection Commission (FCCPC) to address the increasing rates of data privacy abuse by money lending organisations, particularly fintech firms.

The NITDA boss stated the importance of data protection being the core responsibility of the organization.

He said, “We are working with relevant agencies to make sure we address that challenge because it is not only NITDA’s mandate that governs everything. When you talk about any financial services, it is the CBN. When you talk about general complaints, there is a commission for that. But NITDA plays a critical role because of the breach of data privacy.”

The agency said it was working with the Nigeria Police Force and other relevant agencies to investigate several lending platforms, popularly called loan shark platforms.“We have sanctioned some of them. We are working with the Nigerian police, investigating many of them. We are working to address the challenge,” Inuwa said.

The post NITDA,Police To Investigate Customers’ Data Breaches By Lending Platforms appeared first on Tech Digest News.

TECHDIGEST – The National Information Technology Development Agency (NITDA) has sanctioned an online lending platform, Soko Lending Company Limited (Soko Loans), for privacy invasion.

This action was taken after receiving series of complaints against the company for unauthorized disclosures, failure to protect customers’ personal data and defamation of character as well as carrying out the necessary due diligence as enshrined in the Nigeria Data Protection Regulation (NDPR).

One of such complaints filed by Bloomgate Solicitors on behalf of its client, the data subject, was received on Monday, 11th November 2019. NITDA, as part of its due diligence process, commenced investigation over the alleged infractions of the provisions of the NDPR.

Soko Loans grants its customers uncollateralised loans and requires a loanee to download its mobile application on their phone and activate a direct debit in the company’s favour. The app gains access to the loanee’s phone contacts.

According to one of the complainants, when he failed to meet up with his repayment obligations due to insufficient credit in his account on the date the direct debit was to take effect, the company unilaterally sent privacy invading messages to the complainant’s contacts.

Investigation revealed that complainants’ contacts who were neither parties to the loan transaction nor consented to the processing of their data have confirmed the receipt of such messages. The Agency made strident efforts to get Soko Loan to change the unethical practice but to no avail.  After the Agency’s investigation team secured a lien order on one of the company’s accounts by which it could come up with privacy enhancing solutions for its business model, Soko Loan decided to rebrand and directs its customers to pay into its other business accounts.

The Agency’s investigation further revealed that the company embeds trackers that share data with third parties inside its mobile application without providing users information about it or using the appropriate lawful basis.

NITDA has therefore found Soko Loan and its entities in violation of the following legal provisions:

1.   Use of non-conforming privacy notice, contrary to Article 2.5 and 3.1(7) of the NDPR;
2.   Insufficient lawful basis for processing personal data, contrary to Articles 2.2 and 2.3 of the NDPR;
3.   Illegal data sharing without appropriate lawful basis, contrary to Article 2.2 of the NDPR;
4.   Unwillingness to cooperate with the Data Protection Authority, contrary to Article 3.1 (1) of Data Protection Implementation Framework; and
5.   Non-filing of NDPR Audit reports through a licensed Data Protection Compliance Organisation (DPCO), contrary to Article 4.1(7) of the NDPR.

In view of the foregoing and in consideration of its implication on the privacy of Nigerians and erosion of trust in the digital economy, NITDA hereby:

a)   imposes a monetary sanction of Ten Million Naira (N10,000,000) on Soko Lending Company Limited.
b)  directs that no further privacy invading messages be sent to any Nigerian until the company and its entities show full compliance with the NDPR.
c)   directs the company to pay for the conduct of a Data Protection Impact Assessment by a NITDA appointed DPCO on its operation; and
d)  Placement on a mandatory Information Technology and Data Protection oversight for 9 months.

It may be noted that the criminal aspects of this investigation has been deposited with the Nigeria Police to determine if the executives of the company are liable to imprisonment for violating Section 17 of the NITDA Act, 2007.

NITDA therefore uses this medium to remind all Nigerian businesses and data controllers of their obligation to engage NITDA-licensed Data Protection Compliance Organisations (DPCO) to guide them towards compliance with the data protection law. The Agency is poised to fully enforce the NDPR with the aim of sanitising the operating environment, instilling confidence in the digital economy and protecting the right to privacy of Nigerians.

The National Information Technology Development Agency (NITDA) is the apex regulator for Information Technology in Nigeria under the supervision of the Federal Ministry of Communication and Digital Economy. The Agency is empowered by Section 6(c) of the NITDA Act, 2007 to develop guidelines for electronic governance and monitor the use of electronic data interchange and other forms of electronic communication transactions in Nigeria. The Agency issued the Nigeria Data Protection Regulation (NDPR) as Nigeria’s first comprehensive framework for the protection of personal data. The NDPR provides the principles and framework for the protection and processing of personal data of Nigerians and residents.

Mrs Hadiza Umar, MNIPR, M.APRA, MCIPR
Head, Corporate Affairs and External Relations

The post NITDA Fine SokoLoan N10m for Privacy Invasion appeared first on Tech Digest News.