The Nigeria Data Protection Bureau (NDPB) has commenced a full-scale investigation into alleged data breaches by two Nigeria tier one banks- Guarantee Trust Bank and Zenith Bank Plc.
Head, Legal Enforcement and Regulations of NDPB, Mr Babatunde Bamigboye, disclosed this in a statement issued in Abuja.
Bamigboye said the investigations followed allegations of unlawful disclosure of banking records to a third party, unlawful access and processing of personal data.
According to the statement, NDPB’s National Commissioner, Dr Vincent Olatunji explained that the investigation would cover the data governance practice of the two banks in all their branches across the country.
The investigation would extend to all third parties carrying out their data processing activities.
The statement added: “The bureau notes with concern that many data privacy and protection regulations and best practices are hardly implemented down to the organizational strata of major data controllers in Nigeria.
“Similarly, the bureau enjoins rganisations to heed the Federal Government circulars and general compliance notice directing them to send the names of their Data Protection Officers/Contacts to the Bureau.
“There are reports by Nigeria Inter Bank Settlement System (NIBSS) which indicated that within nine months of 2020, fraudsters attempted 46,126 attacks and they were successful with 41,979 occasions representing 91 per cent of the time.
“This level of vulnerability to data breach is unacceptable.”
Olatunji stated that such attacks can only be addressed through foolproof data security and data privacy measures by data controllers, data processors in the industry.
He advised all financial institutions to emulate the Central Bank of Nigeria in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 by creating a robust data governance system.
The News Agency of Nigeria reports that Olatunji also urged all organisations to leverage the ongoing National Privacy Week to set their records straight on how they handle the data of citizens.
He vowed that henceforth, enforcement measures would be taken against wilful violators of privacy rights.