The Nigeria Data Protection Commission (NDPC) has levied a fine of N555.8 million against Fidelity Bank PLC for breaches of the Nigeria Data Protection Act, 2023, and the Nigeria Data Protection Regulation, 2019.
The fine, representing 0.1% of the bank’s annual gross revenue in 2023, must be paid within 14 days of the notice’s receipt.
According to a statement issued by Babatunde Bamigboye, Head of Legal, Enforcement, and Regulations on Wednesday in Abuja, that fine followed an investigation launched after a complaint from a data subject in April 2023.
The complaint alleged that Fidelity Bank had collected personal data without a lawful basis to open an account.
During its review, the Commission discovered that the bank processed personal data without obtaining informed consent from data subjects. These breaches were found to involve tools such as cookies and the bank’s mobile app, which had been downloaded over one million times.
In addition to its non-compliance, Fidelity Bank was found to be relying on third-party data processors that were also not compliant with the regulations. Under the law, organizations are not only required to be compliant but must also ensure that their vendors, agents, and contractors adhere to the same standards when handling personal data.
The Commission’s initial decision was issued in July 2023, followed by a directive in December 2023 to pay a remedial fee. Despite over ten correspondences and repeated warnings, the bank failed to present a satisfactory remedial plan.
The NDPC stated that it had given Fidelity Bank ample opportunity over the past year to demonstrate accountability and promote a culture of compliance.
Vincent Olatunji, National Commissioner and CEO of the NDPC stressed the importance of data protection in maintaining trust and confidence in Nigeria’s economic systems. He warned that a lack of accountability in handling personal data could severely impact economic growth, but compliance with data protection laws would drive sustainable development in the country.
The enforcement action underscores the Commission’s commitment to protecting the rights and freedoms of individuals in Nigeria’s digital economy.
