Nigeria, through the Federal Competition and Consumer Protection Commission (FCCPC), has fined Meta, the parent company of WhatsApp, Facebook, and Instagram, $220 million for alleged data privacy breaches.
The commission has disclosed that it found Meta culpable of denying Nigerians the right to self-determination and unauthorised data transfer and sharing, including cross-border storage, discrimination, disparate treatment, abuse of dominance, and tying and bundling practices.
Meta is set to appeal this ruling. A WhatsApp spokesperson stated, “We disagree with both this decision and the fine and will appeal.”
The FCCPC began investigating Meta for violating provisions of the Federal Competition and Consumer Protection Act (FCCPA) 2018 and the Nigeria Data Protection Regulation 2019 (NDPR), which were in force before the enactment and operationalisation of the Nigeria Data Protection Act 2023 (NDPA).
According to the FCCPC, the decision was reached after a 38-month joint investigation with the Nigeria Data Protection Commission (NDPC) (May 2021 and December 2023). The investigation examined Meta’s conduct, privacy policies, and operations.
BusinessDay’s analysis of the investigative report of the FCCPC and the NDPC and the executive summary revealed the timeline of events leading to the FCCPC’s fine:
1. May 2021: The FCCPC became aware of WhatsApp’s Updated Privacy Policy, which became effective on May 15, 2021. Available evidence and consumer feedback suggested to the commission that the policy was imposed on Nigerians in a manner that did not meet applicable fairness standards.
2. June 10, 2021: The FCCPC issued an Order to Show Cause (OSC) pursuant to Section 17 of the FCCPA, informing Meta of its initial findings and inviting responses.
3. July 9, 2021: Meta responded to the commission’s OSC.
Read also: FG Fines meta $220m for privacy violations, market abuse
4. July 23, 2021: The commission received representation from Meta’s external and local Nigerian counsel, who considered the regulatory intervention unwarranted.
5. August 19, 2021: The FCCPC responded to Meta Parties, reiterating its analysis and providing detailed responses to the Meta presentation of July 23. The commission highlighted the disparate treatment of consumers in different jurisdictions under similar regulatory frameworks and prevailing legal standards. The commission further asked for information to support or substantiate Meta’s position and assertions.
In particular, the commission asked for the privacy policies that were then in force, privacy policies that were no longer in force, technical white papers, the identities of business solution providers (past, current, and prospective), and the number of WhatsApp users in Nigeria who have accepted the Privacy Policy (including dates of acceptance).
6. October 4, 2021: Meta challenged the commission’s August 19 response, arguing that the commission’s assertions and findings lacked factual evidentiary support.
7. December 14, 2021 – March 4, 2022: Meta and the FCCPC engaged in discussions regarding the investigation.
8. March 4, 2022: Meta met with the investigating parties and was presented with the evidence gathered and the commission’s thoughts about the investigation. In response, the tech giant reiterated its policy’s intended purpose and effect.
In addition, Meta responded to specific inquiries from investigators regarding the scope, purpose, uses, and sharing (including sharing with third parties and such uses, including Meta), amongst other things.
9. April 1, 2022: Meta requested 21 days to present a comprehensive response to the issues raised in the investigation.
10. May 18, 2023: The FCCPC conducted an independent market study to validate the information provided by Meta and assess the market landscape.
11. May 24, 2023: The FCCPC asked Meta for information on the location(s) where the gathered data in Nigeria is stored.
12. June 5, 2023: Meta informed the commission that the data in question is stored in its data centres at multiple locations: United States, European Union, and Singapore. This request was to assess compliance with Clause 2.11 of the NDPR under the rubric of both regulatory compliance and disparate treatment from users in Europe under the GDPR.
13. January 13, 2024: The FCCPC conveyed its investigative report, executive summary, order and Notice to Show Cause (ONSC) to Meta.
14. March 1, 2024: Meta submitted its response to the commission.
15. March 18, 2024: Meta’s legal representatives, Messrs. Udo Udoma & Belo Osagie, requested a meeting with the commission, noting that “WhatsApp is prepared to cooperate with the Commission to identify and implement practical solutions to address the Commission’s concerns with a view to reaching an amicable resolution of this matter.”
16. April 4, 2024: Meta proposed a remedy package to address the commission’s concerns.
17. April 19, 2024: Meta sent a detailed remedy package to the commission. According to FCCPC, it was not convinced that the proposed remedies satisfied the concerns that prompted the present investigation. It stated that it provided more detailed reasons in its letter to the commission dated May 6, 2024.
18. July 19, 2024: The FCCPC issued a final order against Meta, imposing a $220 million fine on Meta, among other penalties.
Commenting on this order on X, Babatunde Irukera, the FCCPC’s former chairman, said, “In this matter of protecting consumers and fair market regulation, Nigeria didn’t proceed at dawn, but as a testament to Nigerian ingenuity and resilience, we have made such progress ahead of dusk! Leading continental digital markets accountability is reflective of who Nigerians are.”
