In light of the above, it will therefore be true to identify financial institutions as data controllers, due to the fact they process consumer data such as Names, signatures, biometrics, passcodes, email addresses etc., in order to provide them with access to the available services.
Having identified that all Financial Institutions irrespective of the nature of data (large or small) are data controllers, it is expected that certain obligations will be applicable to them. Some of these obligations are as follows:
- Data processing:
Section 2.1 of the NDPR provides that:
(1) In addition to the procedures laid down in this Regulation or any other instrument for the time being in force, Personal Data shall be:
(a) Collected and processed in accordance with specific, legitimate and lawful purpose consented to by the Data Subject; provided that:
(i) Further processing may be done only for archiving, scientific research, historical research or statistical purposes for public interest;
(ii) Any person or entity carrying out or purporting to carry out data processing under the provision of this paragraph shall not transfer any Personal Data to any person;
(b) Adequate, accurate and without prejudice to the dignity of human person;
(c) Stored only for the period within which it is reasonably needed, and
(d) Secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulations of any kind, damage by rain, fire or exposure to other natural elements.
(2) Anyone who is entrusted with the Personal Data of a Data Subject or who is in possession of the Personal Data of a Data Subject owes a duty of care to the said Data Subject;
(3) Anyone who is entrusted with the Personal Data of a Data Subject or who is in possession of the Personal Data of a Data Subject shall be accountable for his acts and omissions in respect of data processing, and in accordance with the principles contained in this Regulation.
- PROCURING CONSENT:
Section 2.3 of the NDPR principally provides that no data shall be obtained except the specific purpose of collection is made known to the Data Subject, while also informing the Data Subject of his right to withdraw consent at any time.
- DATA SECURITY:
Section 2.6 of the NDPR provides that “anyone involved in data processing or the control of data shall develop security measures to protect data; such measures include but not limited to protecting systems from hackers, setting up firewalls, storing data securely with access to specific authorized individuals, employing data encryption technologies, developing organizational policy for handling Personal Data (and other sensitive or confidential data), protection of emailing systems and continuous capacity building for staff”.
The above-highlighted requirements are essential in ensuring that a Bank reasonably meets with data compliance requirements. This is because a Financial Institution is bound to interface with the personal data of both natural and artificial persons.
In the following paragraph(s) we will be examining the extent to which Banks have complied with provisions of Data Protection by taking into consideration three salient issues such as, Banking Secrecy and Confidentiality and Enforcement Procedures.
- Banking Secrecy and Confidentiality:
The NDPR, as well as the Implementation framework of the NDPRA, provides for the protection of consumer assets and privacy. To that end, it is required that Financial Institutions even in the use of technology or the development of services rendered to consumers, maintain the financial and personal information of consumers and only release same upon the consent of the consumer. However, we find that this is usually not the case, as we find financial institutions who issue loans access a Consumer’s National Identification Number (NIN), finding a way to access the contact list of these consumers when the consumer fails to meet stipulated payment deadlines and request the monies from them.
As provided by the NDPR Framework, certain consumer information such as Contact details, account number, balance, account statements etc. and should be protected by Financial Institutions
2. Data Compliance In The Nigerian Banking/Finance Industry
On the issue of data security, the NDPR mandates organizations to protect consumer data by installing measures to protect systems from hackers through the installation of firewalls, and email protection amongst others. However, the CBN Cybersecurity Guidelines provide for a Risk Management System to reduce any incidences that could negatively affect an organization.
The risk management system was created to address issues surrounding threats, mitigate exposure, and reduce vulnerability and must incorporate cyber risk management with their institution-wide risk management framework and governance requirements. The CBN Cybersecurity Guidelines also outline that Data Security and risk assessment should include the following:
- Risk measurement.
- Risk mitigation/risk treatment.
- Risk monitoring and reporting.
Notwithstanding the above, we find that breaches still occur in financial institutions, which has led to the CBN enforcing certain penalties.
In cases where there is a breach, a few of these enforcement procedures are:
- Suspension from inter-bank activities.
- Suspension/withdrawal of foreign exchange dealership license.
- Denial of approvals.
- Publication of infractions and sanctions.
- Monetary penalties.
- Product recall.
- Warning letters to management/board.
- Suspension/removal of board/management staff/employees.
- Referral to law enforcement agencies for prosecution.
- Revocation of banking license.