AUG 2021 NEWS
TOLULOPE AYANBOLA, LOLADE TIJANI, AND
On 17 August 2021, NITDA issued a press release stating that it had imposed a monetary sanction of ₦10,000,000 (Ten Million Naira), amongst other penalties, on an online lending platform, Soko Lending Company Limited (Soko Loans), for privacy invasion. These penalties were imposed on Soko Loans due to NITDA receiving a series of complaints against Soko Loans for unauthorised disclosures, failure to protect customers’ personal data and defamation of character. NITDA found that Soko Loans violated the following provisions of the Nigeria Data Protection Regulation (NDPR):
- Use of a non-conforming privacy notice, contrary to Article 2.5 and 3.1(7) of the NDPR;
- Insufficient lawful basis for processing personal data, contrary to Articles 2.2 and 2.3 of the NDPR;
- Illegal data sharing without appropriate lawful basis, contrary to Article 2.2 of the NDPR;
- Unwillingness to cooperate with the NDPR, contrary to Article 3.1 (1) of the NDPR Implementation Framework; and
- Non-filing of NDPR audit reports through a licensed Data Protection Compliance Organisation (DPCO), contrary to Article 4.1(7) of the NDPR
In this article, we discuss the process of enforcement under the NDPR; and the legality and extent of NITDA’s power to impose fines.
