Customer Data: Commission Faults CBN’s directive to financial institutions
Na'ankwat Dariem
The Nigeria Data Protection Commission(NDPC)has said it is inappropriate for the Central Bank of Nigeria, CBN, to mandate the financial institutions in the country to obtain personal data via the social media handles of customers.
The National Commissioner/Chief Executive Officer of the Nigeria Data Protection Commission, NDPC, Dr. Vincent Olatunji, said this when he featured in a Voice of Nigeria interactive Programme, IN THE NEWS in Abuja, Nigeria’s capital.
He described the collection of such data as a violation of the rights of citizens.
He explained that NDPC has been empowered by law to protect, manage and ensure that the personal data of Nigerians is effectively and efficiently treated.
He noted that this became possible after President Bola Ahmed Tinubu signed into law, an Act which has transformed the former Nigeria Data Protection Bureau, NDPB, to a commission.
Dr. Olatunji said with this empowerment of the commission, it has the mandate to fine, enforce and even prosecute defaulters of the law both at the public and private levels.
He said plans are already on, to officially communicate to the CBN on the matter.
“We will formally write to CBN on that, if this has to be done, there are procedures to follow especially in the case of public interest, there are guidelines to that rather than just to impose it on customers, it is not right,” he said.
Basic Principles
The National Commissioner/CEO of NDPC, disclosed that in dealing with data protection and privacy issues, especially data processing, there are basic principles to be followed.
“We have what we call Purpose Limitation. When you are collecting data of anybody you must not collect it for any other purpose apart from that for which the data is collected. In this case, if it’s is for financial transaction all you need is the basic things you need to identity them.The issue of asking for their social media is not really necessary.”
“Secondly, we have Data Maximization; For what purpose do you need to collect data? Is it really important? If you need for public interest, there should be guidelines,(criteria/
In view of this, he said that if the Apex Bank needs to use such data under public interest as a regulator to monitor financial transactions, there are guidelines to follow.
One of such guidelines include informing the customers and stating the purpose.
However, the NDPC Boss noted that “ideally, that should not happen. We are engaging the CBN on this.”
The National Commissioner said already, “when opening an account we have National Identity Number, NIN, BVN, International Passport among others which to a large extent recognises you as a Nigerian, so the social media handles are completely unnecessary.”
He added that “you don’t collect data more than what you need, so there is no point in collecting such data. So, we will definitely take them up on it and work with them and look at the best solution out of it.”
The CBN had earlier mandated financial institutions to obtain the social media handle, e-mail addresses, telephone numbers, residential addresses, and more of their customers.
On creating awareness, He said the commission is engaging relevant stakeholders and partners to educate citizens and residents on their rights on data safety and privacy .
“We have been creating awareness through stakeholders engagement, programmes and projects, we are also working towards enlightenment campaigns at the grassroots to ensure inclusiveness across board.
He added that the Commission is carrying out massive capacity building in the public and private sectors to adhere to the guidelines stipulated in the Nigeria Data Protection Act and also for data controllers to know their obligations among other things.
