Nigeria Fines Multichoice ₦766.242,500 for Data Breach

The Nigeria Data Protection Commission (NDPC) has imposed a significant fine of ₦766.242,500 on Multichoice Nigeria for breaching the Nigeria Data Protection Act (NDP Act). The penalty was announced on Sunday, July 6, and was detailed in a press release signed by Babatunde Bamigboye, the NDPC’s Head of Legal, Enforcement & Regulations. The investigation into Multichoice began in the second quarter of 2024, prompted by reports of privacy breaches affecting subscribers. The NDPC found that Multichoice had engaged in unauthorized data transfers, compromising the personal information of subscribers and their non-subscriber contacts. This practice was deemed intrusive and unnecessary, violating the privacy rights enshrined in section 37 of the 1999 Constitution.

The NDPC’s findings highlighted the severity of the violation, noting that the depth of data processing by Multichoice was unfair, unnecessary, and disproportionate. The Commission emphasized that illegal data transfers have far-reaching implications for the rule of law, national security, and economic growth, stressing the broader impact on Nigeria’s sovereignty and international standing. The fine reflects the gravity of the offence and serves as a warning to other data outlets. The NDPC directed Multichoice to implement remedial measures to address the breach but expressed frustration over the company’s response, leading to the hefty fine. The Commission also called for cooperation but enforced the penalty when that fell short.

The fallout extends beyond Multichoice. NDPC National Commissioner, Dr. Vincent Olatunji, issued a stern warning to all outlets collecting Nigerian data, stating that any outlet processing personal data in violation of the NDP Act is liable to penalty under the Act. This move comes amid growing concerns over data security in Nigeria, underscoring the need for stricter enforcement of data protection laws. The NDPC’s action against Multichoice serves as a reminder to all data processors of the importance of compliance with data protection regulations and the consequences of non-compliance.