Fidelity Bank kicks as NDPC issues N555.8m ‘full penalty’ for alleged data violations

*Dr. Vincent Olatunji, National Commissioner/CEO of the Nigeria Data Protection Commission, affirms Fidelity Bank’s data violations are serious, and despite working with the financial institution to address the issues since April 2023, ‘their arrogance’ ultimately, led the regulatory Commission to impose the full N555.8million penalty

*Fidelity Bank didn’t violate any law because there’s no data breach ─Head of Brand and Communications

Isola Moses | ConsumerConnect

Sequel to recent fine imposed on the financial institution for alleged infraction, Fidelity Bank Plc has denied allegations of data breach the Nigeria Data Protection Commission (NDPC) has preferred against it.

Meksley Nwagboh, Divisional Head of Brand and Communications of Fidelity Bank, in a recent statement argued that the bank “conducted itself to the highest ethical standards by ensuring full compliance with extant laws on data protection” in the banking sector of the economy.

ConsumerConnect reports the country’s data regulatory Commission had slammed N555.8 million heavy fine on Fidelity Bank for purportedly violating data privacy laws in the West African economy.

Dr. Vincent Olatunji, National Commissioner/Chief Executive Officer (CEO) of NDPC, disclosed this development during a Validation Workshop on the Nigeria Data Protection Act General Application and Implementation Directive held Wednesday, August 21, 2024, in Abuja, FCT.

The bank was found to have breached the Nigeria Data Protection Regulation (NDPR) of 2019 and the Nigeria Data Protection (NDP) Act of 2023.

Olatunji also affirmed that the penalty which the NDPC has imposed on the bank is the largest ever the Commission has issued against any organisation.

Fidelity Bank didn’t violate any law because there’s no data breach: Official

Nwagboh, Divisional Head of Brand and Communications of Fidelity Bank, in the statement also reacted to the fine, noting that the commercial bank said the alleged data breach was investigated.

He stated that it was discovered that “an account opening request was received online, but the account was not operational due to incomplete documentation.”

The bank also contended that it “carried out due diligence by immediately blocking the account and subsequently closing it when outstanding documents were not provided.”

The Nigerian financial institution explained: “On April 30th, 2023, we received a notice of investigation from the Nigeria Data Protection Agency (NDPA), now the Nigeria Data Protection Commission (NDPC).

“The investigation was in respect of a complaint from (name has been withheld to protect the identity of the complainant) who claimed that (name withheld) details were used to open an account in the bank without (name withheld) consent.”

In regard to the “account immediately put on post no debit” which reportedly culminated in the huge penalty the regulator has imposed on it, Fidelity Bank said based on the notice it had received, the bank conducted an internal investigation into the circumstances around the claim.

According to Nwagboh, the bank discovered that “an account opening request was received online in the name of [name withheld], and an e-mail was sent to the email address attached to the request informing them about this.

“In compliance with our Data Protection policy, accounts created online without full documentation are not allowed to be operational and are closed after 30 days if the outstanding documents are not provided to authenticate the identity of the person seeking to open the account.”

Bank further noted: “In compliance with our data protection laws, the account was not allowed to be operational as the passport photograph and BVN were not provided.

“The account was immediately placed on ‘Post No Debit’ status as the applicant was expected to complete the account opening process by providing the outstanding documents for verification within 30 days.

“This was not done, and the account was eventually closed.”

The Head of Brand and Communications said: “On May 2nd, 2023, we responded to the NDPC that the bank did not violate any law because there was no data breach and that the account opening process was not completed.

“On our part, we carried out due diligence by immediately blocking the account and subsequently closing the account when we did not receive the outstanding documents.

“At no point in the process was the account ever operational.”

He also stated: “On July 7th, 2023, we were invited for a Pre-Action meeting with NDPC. During the meeting, we restated our position as earlier communicated to them in our letter dated May 2nd.

“However, despite our explanation and evidence provided to support our claim, the agency informed us that they had concluded to impose a penalty on the bank.”

The bank said: “On 5th December of 2023, we got a letter from NDPC demanding we pay a ‘remedial fee’ of N250 million within 21 days.

“We immediately commenced another round of engagements with the Commission as we were convinced we had not breached any extant law or regulation.”

Fidelity Bank claimed while it was still engaging with the NDPC on resolving the alleged data violations, the bank received another letter August 20 this year, indicating the imposition of N555.8 million fine on the banking institution.

NDPC: Why data regulatory Commission imposes huge fine on Fidelity Bank

The National Commissioner of NDPC disclosed the data regulatory Commission aggravated the penalty because of the bank’s corporate irresponsibility, “lack of cooperation” and “dismissive attitude during the investigation”.

Dr. Olatunji stated: “Since we began enforcing data protection regulations, this is the most significant penalty we’ve issued.

“Fidelity Bank’s violations were serious, and despite working with them since April 2023 to address these issues, their arrogance ultimately led us to impose the full penalty.”

Dr. Olatunji further stressed the significance of data protection compliance in the economy.

According to him, penalties for non-compliance with the NDP Act 2023 can range from N10million to two percent of an organisation’s gross earnings.

Meanwhile, the NDPC since Wednesday, August 21 has given Fidelity Bank two weeks to pay the fine upon receiving the notice.

It is noted that this action underscores the Commission’s commitment to enforcing data protection laws, and holding organisations accountable for safeguarding consumers’ data in the Nigerian economy.

Kindly Share This Story