Fidelity Bank fined N555.8m by NDPC for data breach

The National Data Protection Commission (NDPC) has imposed a huge fine of N555.8 million on Fidelity Bank for violating customer data protection regulations.

Topnaija.ng reports that this penalty comes in response to breaches of the Nigeria Data Protection Act (NDP Act) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019.

The announcement was made by the National Commissioner of the NDPC, Vincent Olatunji, during a validation workshop on the Nigeria Data Protection Act General Application and Implementation Directive in Abuja on Wednesday.

Olatunji stated that the fine, which amounts to 0.1 per cent of the bank’s annual gross revenue for 2023, was imposed not only for the data breach but also due to the bank’s lack of cooperation during the investigation.

Olatunji highlighted the NDPC’s commitment to enforcing compliance with data protection laws, warning that non-compliance would result in strict penalties.

He explained that the NDPC typically focuses on raising awareness and encouraging adherence to regulations but felt compelled to impose the maximum penalty on Fidelity Bank due to their poor cooperation.

Olatunji said, “Data protection compliance is important, and we have stated that non-compliance will be punished. We have penalties that range from N10 million or up to two percent of gross earnings for the previous year.

“But our approach has been creating awareness and letting people know what we are supposed to be doing, and for most of the breaches, we try to look at the level of breach, the impact, the number of data subjects affected, and the level of cooperation by the organisation involved in the remuneration fee.”

The NDPC has been engaged with Fidelity Bank on this issue since April 2023.

However, the bank’s dismissive attitude and lack of cooperation during the investigation prompted the NDPC to impose the full penalty.

Olatunji said, “By the time we finalised our findings, they became arrogant, and we decided to issue a full penalty on them.”

This fine, the largest ever imposed by the commission, must be paid within 14 days of receiving the notice.