NDPC seeks clarification from INEC over alleged data breach

The Nigeria Data Protection Commission (NDPC) says it has twice requested the Records of Processing Activities (ROPA) of the Independent National Electoral Commission (INEC) over allegations of a data breach.

The National Commissioner of NDPC, Dr Vincent Olatunji, disclosed this in Abuja during a media parley to mark three years of the commission.

Olatunji said the request followed the signing of the Nigeria Data Protection Act by President Bola Tinubu on June 12, 2023, noting that it was part of efforts to safeguard the integrity of Nigeria’s electoral database.

He also said the commission treated every reported breach with diligence and had taken action on all cases brought before it, irrespective of the status of the institutions involved.

“There is no breach reported to us that we have not acted on, whether in government or private institutions.

“For instance, INEC has been asked twice for its Records of Processing Activities. The matter is sensitive because the country is moving towards another election, and it speaks to the credibility of the database.

“It is of utmost urgency, and we are acting immediately,” he said.

The NDPC boss said the commission had investigated several organisations, including Meta, TikTok, Temu, Remita and Sterling Bank, stressing that no organisation was exempted from scrutiny.

According to him, the commission prefers to focus on due process and avoid prejudicing cases or investigating complaints from any quarters.

He said every organisation invited by the commission had honoured its invitations and cooperated with investigations.

“I cannot remember any organisation that was invited and did not show up. All of them have appeared and engaged with us,” he said.

Olatunji explained that the commission adopted a developmental and compliance-driven approach to regulation rather than one aimed at imposing punitive fines.

He said that after investigating a reported breach, the commission carried out a holistic assessment of an organisation’s data protection practices, including registration status, audit filings, appointment of data protection officers, privacy policies and technical safeguards.

According to him, organisations with substantial compliance records are usually directed to remedy identified gaps within a specified period and may be required to pay remediation fees instead of fines.

“The objective is compliance and not punishment. We do not want to stifle innovation or drive away investors.

“Our law is a developmental law designed to stimulate sustainable growth,” he said.

The NDPC chief said the commission’s dispute with Meta was the only matter that proceeded to court after the company challenged a 32 million dollar penalty imposed by the commission.

He said the matter was later settled out of court after both parties agreed on measures that would ensure compliance and support data protection initiatives in Nigeria.

According to him, the commission could have pursued a much higher sanction but chose for a settlement in the interest of the economy and millions of Nigerians who rely on Meta platforms for their livelihoods.

“What we desire is compliance, not embarrassment or driving companies or investors away from Nigeria.

“The agreement reached is a win-win situation that protects Nigerians and ensures responsible handling of personal data,” he said.

Olatunji said the commission had maintained high ethical standards, insisting that integrity and credibility remained central to its operations.

He added that the NDPC would continue to work with stakeholders across the public and private sectors to deepen data protection and privacy awareness in the country. (NAN)

The post NDPC seeks clarification from INEC over alleged data breach appeared first on Vanguard News.