DATA COMPLIANCE IN THE NIGERIAN BANKING/FINANCE INDUSTRY
Author: O. M. Atoyebi S.A.N FCIArb. (U.K.)., Contributor: Love Elizabeth Ebekhile
In recent times, the financial sector has experienced a significant amount of development owing to the implementation of technology in its day-to-day transactions with consumers. The reason for this development is not far-fetched as consumers want their demands met and within a reasonable timeframe, all of which technology provides, alongside some sense of ease.
In furtherance of the above, we see Institutions clearly merging the concept of Finance and Technology into one (Fintech). With the above developments, one would largely hold the presumption that there are no challenges posed to consumers who chose this medium to commence and finalize financial transactions. However, this proves not to be the case as consumers have on several occasions, raised issues of data breaches by financial institutions.
This article is primarily aimed at understanding Data Compliance issues in the Banking Industry, and proposing a way forward.
What is Data?
In general parlance, data refers to facts and statistics collected together for reference or analysis. However, the concept of data is defined by the Nigerian Data Protection Regulation (NDPR) 2019 to mean characters, symbols and binary on which operations are performed by a computer, which may be stored or transmitted in the form of electronic signals, stored in any format or any device. Section 37 of the Constitution of the Federal Republic of Nigeria (CFRN) 1999 as amended as well as other Legislations such as the Cybercrime (Prohibition, Prevention etc.) Act 2015 and the Freedom of Information Act 2011 (the FoI Act) all make significant references to the importance of data protection.
Data Protection in the Banking Sector:
The Nigerian banking sector, as well as any other form of Financial Institutions, are largely regulated by the provisions of the Banking and Other Financial Institutions Act 1991 (BOFIA and the Central Bank of Nigeria (CBN), albeit through the provisions of the Central Bank of Nigeria Act 2007 and the CBN Cybersecurity Guidelines 2018 (The Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers).
When an individual opens a bank account, he does same with the term “safe” in mind, he harbors the belief that whatever transactions occur between himself and the bank is private, and that the Bank will treat the relationship with the same level of cordiality. However, I also think, that the bank expects that the individual protects his information.
In my opinion, I believe that the above was the position up until data buckets in certain financial institutions that had been left unsecured were breached, which brought to question, the high probability of identity theft of consumers’ personal information. Identifiably, it has also been reported that the root of this issue rests in the continuous occurrence of cyberattacks and data breach incidents, which are downplayed and not paid any mind by financial institutions. This lack of attention to cybersecurity does not only indicate the failure of some of these financial institutions in enlightening their customers, but also results in a depletion of the good faith placed by customers in these financial institutions.
With the National Information Technology Development Agency, largely overseeing cybersecurity and data protection, it has within its mandate developed the NDPR as a way to curb the nuances of data breaches in Organizations. The NDPR is well placed in ensuring that organizations which have the personal data of individuals within its administration, process these data in a way that preserves the confidentiality and integrity of the data. Section 3.1(1) of the NDPR provides that a data controller to take appropriate measures to provide any information relating to processing to the data subject in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, and for any information relating to a child.
Who is a Data Controller?
Section 1.3 (x) of the NDPR identifies a data controller as a person who either alone, jointly with other persons or in common with other persons or a statutory body determines the purposes for and the manner in which Personal Data is processed or is to be processed.
In light of the above, it will therefore be true to identify financial institutions as data controllers, due to the fact they process consumer data such as Names, signatures, biometrics, passcodes, email addresses etc., in order to provide them with access to the available services.
Having identified that all Financial Institutions irrespective of the nature of data (large or small) are data controllers, it is expected that certain obligations will be applicable to them. Some of these obligations are as follows:
- Data processing:
Section 2.1 of the NDPR provides that:
(1) In addition to the procedures laid down in this Regulation or any other instrument for the time being in force, Personal Data shall be:
(a) Collected and processed in accordance with specific, legitimate and lawful purpose consented to by the Data Subject; provided that:
(i) Further processing may be done only for archiving, scientific research, historical research or statistical purposes for public interest;
(ii) Any person or entity carrying out or purporting to carry out data processing under the provision of this paragraph shall not transfer any Personal Data to any person;
(b) Adequate, accurate and without prejudice to the dignity of human person;
(c) Stored only for the period within which it is reasonably needed, and
(d) Secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulations of any kind, damage by rain, fire or exposure to other natural elements.
(2) Anyone who is entrusted with the Personal Data of a Data Subject or who is in possession of the Personal Data of a Data Subject owes a duty of care to the said Data Subject;
(3) Anyone who is entrusted with the Personal Data of a Data Subject or who is in possession of the Personal Data of a Data Subject shall be accountable for his acts and omissions in respect of data processing, and in accordance with the principles contained in this Regulation.
- PROCURING CONSENT:
Section 2.3 of the NDPR principally provides that no data shall be obtained except the specific purpose of collection is made known to the Data Subject, while also informing the Data Subject of his right to withdraw consent at any time.
- DATA SECURITY:
Section 2.6 of the NDPR provides that “anyone involved in data processing or the control of data shall develop security measures to protect data; such measures include but not limited to protecting systems from hackers, setting up firewalls, storing data securely with access to specific authorized individuals, employing data encryption technologies, developing organizational policy for handling Personal Data (and other sensitive or confidential data), protection of emailing systems and continuous capacity building for staff”.
The above-highlighted requirements are essential in ensuring that a Bank reasonably meets with data compliance requirements. This is because a Financial Institution is bound to interface with the personal data of both natural and artificial persons.
In the following paragraph(s) we will be examining the extent to which Banks have complied with provisions of Data Protection by taking into consideration three salient issues such as, Banking Secrecy and Confidentiality and Enforcement Procedures.
- Banking Secrecy and Confidentiality:
The NDPR, as well as the Implementation framework of the NDPRA, provides for the protection of consumer assets and privacy. To that end, it is required that Financial Institutions even in the use of technology or the development of services rendered to consumers, maintain the financial and personal information of consumers and only release same upon the consent of the consumer. However, we find that this is usually not the case, as we find financial institutions who issue loans access a Consumer’s National Identification Number (NIN), finding a way to access the contact list of these consumers when the consumer fails to meet stipulated payment deadlines and request the monies from them.
As provided by the NDPR Framework, certain consumer information such as Contact details, account number, balance, account statements etc. and should be protected by Financial Institutions
2. Data Compliance In The Nigerian Banking/Finance Industry
On the issue of data security, the NDPR mandates organizations to protect consumer data by installing measures to protect systems from hackers through the installation of firewalls, and email protection amongst others. However, the CBN Cybersecurity Guidelines provide for a Risk Management System to reduce any incidences that could negatively affect an organization.
The risk management system was created to address issues surrounding threats, mitigate exposure, and reduce vulnerability and must incorporate cyber risk management with their institution-wide risk management framework and governance requirements. The CBN Cybersecurity Guidelines also outline that Data Security and risk assessment should include the following:
- Risk measurement.
- Risk mitigation/risk treatment.
- Risk monitoring and reporting.
Notwithstanding the above, we find that breaches still occur in financial institutions, which has led to the CBN enforcing certain penalties.
In cases where there is a breach, a few of these enforcement procedures are:
- Suspension from inter-bank activities.
- Suspension/withdrawal of foreign exchange dealership license.
- Denial of approvals.
- Publication of infractions and sanctions.
- Monetary penalties.
- Product recall.
- Warning letters to management/board.
- Suspension/removal of board/management staff/employees.
- Referral to law enforcement agencies for prosecution.
- Revocation of banking license.
CONCLUSION
The issue of data breach in Financial Institutions is still an issue that has to be dealt with specifically. Regulations that specifically address these issues should be made to further accommodate technological development. Adherence to these regulations should be strict amongst financial institutions. Sensitization of Employees in maintaining data protection standards should also be carried out.