The Nigerian Data Protection Commission (NDPC) has announced that it will now hold Ministries, Agencies, and Department (MDAs) chief executives accountable for any data breach that takes place while they are in charge.
The National Commissioner of the NDPC, Dr Vincent Olatunji, stated the people in charge of the MDAs will be sanctioned since the government cannot be forced to pay a fine from its coffers in an interview with Nairametrics about the implementation of the Nigeria Data Protection Act. At the same time, he revealed that MDAs’ level of compliance with data protection laws has recently increased from 4% to 9%.
Under the Nigerian Data Protection Regulation (NDPR), the Commission has punished private corporations, but no government organization has received a penalty, despite fears that they are the most responsible for data breaches.
However, Olatunji said that era is now over with the signing of the Data Protection Bill into law.
Olatunji said that the degree of compliance by private sector entities now stands at 49%, greatly above the 9% by the public sector, apparently as a result of the execution of sanctions.
The data protection chief announced that the is beginning capacity building across the nation to train more data protection officers to increase compliance by both public and commercial entities.
According to legal regulations, even the CEO of an MDA could go to jail if there is a data breach that affects the data subject. Additionally, we have published a circular stating that all MDAs are required to designate a permanent Data Protection Officer (DPO), train every member of their staff on data protection, and allocate adequate funds for data protection.
So, we expect the compliance level by MDAs to increase from now. We are also creating awareness to ensure that all MDAs comply with the provisions of the law. But if there is any breach, yes, we can’t find government to pay the government, but somebody is responsible for that, and that is the CEO. And that is why the DPOs should report to the CEO of any organization they work with so that there are no ambiguities in whatever they are supposed to be doing. So, whatever happens, the CEO will be held responsible,” he said.
Governmental organizations, some of which are currently the biggest processors of Nigerians’ data, include the National Identity Management Commission (NIMC), Nigeria Immigration Service (NIS), and Federal Road Safety Corp (FRSC), which are also required to abide by the data protection law, which was recently signed.
According to Olatunji, in the case of a Data Controller dealing with more than 10,000 Data Subjects, the NDPR stipulates the payment of a fine of 2% of the organization’s annual gross revenue of the preceding year or the payment of the sum of N10 million, whichever is greater.
In the case of a Data Controller dealing with less than 10,000 Data Subjects, the sanction involves the payment of a fine representing 1% of the organization’s annual gross revenue of the preceding year or payment of the sum of N2,000,000.00 (two million Naira) (approx. EUR 2,000), whichever is greater.
