By ABUJA, Nigeria — The Nigeria Data Protection Commission (NDPC) has imposed a fine of zero point one percent of Fidelity Bank’s two thousand twenty-three revenue, equivalent to five hundred fifty-five million, eight hundred thousand naira (three hundred fifty-eight thousand, five hundred eighty dollars), for alleged violations of data protection laws, the agency announced on Thursday.
This fine represents the largest penalty the NDPC has levied against an entity for data breaches to date. The NDPC has instructed Fidelity Bank, a mid-tier lender in Nigeria, to remit the fine within fourteen days.
The commission’s investigation, which began in April two thousand twenty-three, focused on the bank’s practices in collecting personal data for opening customer accounts. The NDPC alleges that Fidelity Bank illegally collected personal data during an account opening process.
In its review of Fidelity’s data processing platforms, the NDPC claims to have found instances where “the bank processes personal data without informed consent of data subjects.” The commission also asserts that Fidelity deployed tools such as cookies and banking applications in violation of existing laws.
Fidelity Bank has contested the NDPC’s findings. In a statement released Thursday, the bank denied any violation of data protection laws, asserting that no data breach occurred. The bank maintains that it did not complete the account opening process for the unnamed customer whose complaint initiated the NDPC’s investigation.
“As a bank, we remain in discussions with the NDPC over an amicable resolution to this matter,” Fidelity Bank’s statement read.
The case highlights the increasing scrutiny of data protection practices in Nigeria’s financial sector. It also underscores the growing role of the NDPC in enforcing data privacy regulations within the country.
As discussions between Fidelity Bank and the NDPC continue, the outcome of this case may set a precedent for how data protection laws are enforced in Nigeria’s banking industry.
The NDPC has not provided further details on the specific nature of the alleged violations or the identity of the customer who filed the initial complaint.
Reuters
