The Nigeria Data Protection Commission (NDPC) has fined Multichoice Nigeria the sum of N766.2 million for violating the Nigeria Data Protection Act (NDP Act).
The Commission disclosed in a statement signed by its Head of Legal, Enforcement & Regulations, Babatunde Bamigboye, which was released on Sunday.
According to the Commission, the investigation of Multichoice, which commenced in the second quarter of 2024, was triggered by suspected breach of privacy rights of Multichoice subscribers and illegal cross-border transfer of personal data of Nigerians.
Multichoice Nigeria’s offenses
The NDPC said it found, among others, that Multichoice violated the data privacy rights of subscribers and their friends who are not necessarily subscribers.
- The Commission also found that Multichoice carries out illegal cross-border transfer of personal data relating to data subjects in Nigeria.
- According to the NDPC, the depth of data processing by Multichoice is “patently intrusive, unfair, unnecessary and disproportionate.”
“This is a grave affront to fundamental right to privacy as enshrined in section 37 of the 1999 Constitution of the Federal Republic of Nigeria,” the Commission stated.
NDPC noted that Nigeria is entitled to protect its citizens, and data sovereignty under both international and extant municipal laws, as these have far-reaching implications for rule of law, national security, and economic growth.
Unsatisfactory remediation
NDPC stated that in line with its standard remediation procedure, the Commission had directed Multichoice to carry out appropriate remedial measures.
“However, the Commission found the measures undertaken by Multichoice in this regard unsatisfactory.
“For want of cooperation, the Commission has directed Multichoice to pay N766,242,500 for violating the Nigeria Data Protection Act,” it stated.
- The Commission said its National Commissioner, Dr Vincent Olatunji, has also directed that all outlets through which Multichoice is collecting personal data of Nigerian citizens should be investigated for non-compliance.
- It added that any outlet that processes personal data in violation of the NDP Act is liable to penalty under the Act.
What you should know
The fine against Multichoice Nigeria comes as the largest single fine coming from the NDPC since the NDP Act came into force in 2023.
This is because the NDPC has adopted a remediation approach, which ensures that companies found to have violated the Act do the right thing to escape being fined.
The NDPC’s National Commissioner, Dr. Vincent Olatunji recently told Nairametrics that the remediation approach is being adopted to ensure business sustainability, but noted that any organization that fails to comply with its remediation recommendations will be fined.
“Usually, when we investigate and find a breach, if they are ready to comply with the law, what is the point of making noise?
“It’s only when an organization is unwilling to comply with the law that we are forced to impose sanctions,” he said.
He added that the Commission is also taking the nation’s economy into consideration by not making pronouncements that could discourage investments.
