The Federal Government of Nigeria has initiated investigations into the activities of tech giant Meta (formerly Facebook), international haulage company DHL, and online payment platform OPay over alleged data breaches.
If found liable, these companies may be required to forfeit two percent of their annual gross revenue to the government.
Numerous complaints from Nigerian citizens regarding violations of data subjects’ rights prompted these investigations. The Nigeria Data Protection Commission (NDPC) has launched inquiries into the data processing practices of these companies. This marks the second time that the NDPC has probed companies, banks, and universities in Nigeria for alleged data infractions.
Dr. Vincent Olatunji, the National Commissioner of NDPC, previously cautioned that infractions would be met with penalties in accordance with the Nigeria Data Protection Act, 2023.
He emphasised the commission’s commitment to safeguarding the integrity of Nigeria’s data economy ecosystem and warned data controllers and processors against non-compliant data processing practises. Chief Executive Officers of government ministries, departments, and agencies could also be held responsible for infractions.
Complaints against Meta (formerly Facebook) involve allegations of behavioral advertising without explicit consent from data subjects.
It is estimated that approximately 40 million Facebook accounts in Nigeria may have been affected by the ongoing data processing investigation, which has significant implications for Nigeria’s digital economy.
DHL is under investigation for potentially violating the lawful basis and principles of data protection. Sources familiar with the investigations have indicated that DHL’s data processing practices do not meet the confidentiality standards outlined in the Nigeria Data Protection Act.
OPay may face questions regarding allegations of opening bank accounts for data subjects without their consent, a serious violation of data privacy rights. OPay reportedly has about 40 million data subjects.
The Nigeria Data Protection Commission has issued a Notice of Investigation to each of these data controllers, affording them the opportunity to defend themselves in accordance with the country’s laws.
