FIDELITY Bank has disputed data breach allegations leveled against it by the Nigerian Data Protection Commission (NDPC).
In a statement issued on Wednesday, July 21, a spokesman for the bank, Meksley Nwagboh, said no data law was violated to warrant the imposition of N555.8m by the commission.
The ICIR reported that the NDPC had levied Fidelity Bank for violation of some customers’ data and imposed a fine on the financial institution.
The fine equals 0.1 per cent of Fidelity Bank’s annual gross revenue in 2023.
A check on Fidelity Bank’s 2023 audited financial statements shows the bank posted gross earnings of N555.83 billion.
The commission said Fidelity Bank breached the Nigeria Data Protection Regulation (NDPR) of 2019 and the Nigeria Data Protection (NDP) Act of 2023.
The commission also blamed the bank’s lack of cooperation during an investigation before arrival at the penalty.
However, the bank said it conducted itself to the highest ethical standards by ensuring full compliance with extant laws on data protection.
“As a Bank, we remain in discussions with the NDPC over an amicable resolution to this matter,” Nwagboh said in a statement.
Fidelity Bank gave a breakdown of its dealings with the NDPC on the matter and said:
“On April 30th, 2023, we received a notice of investigation from the Nigerian Data Protection Agency (NDPA), now the Nigerian Data Protection Commission (NDPC). The investigation was in respect of a complaint from [name has been withheld to protect the identity of the complainant] who claimed that [name withheld] details were used to open an account in the bank without [name withheld] consent.
“Based on this notice, we conducted an internal investigation into the circumstances around the claim and discovered as follows: An account opening request was received online in the name of [name withheld], and an email was sent to the email address attached to the request informing them about this,”the bank said.
The bank also disclosed that in compliance with its data protection policy, accounts created online without full documentation are not allowed to be operational and are closed after 30 days if the outstanding documents are not provided to authenticate the identity of the person seeking to open the account.
“In compliance with our data protection laws, the account was not allowed to be operational as the passport photograph and BVN were not provided.
“The account was immediately placed on “Post No Debit” status as the applicant was expected to complete the account opening process by providing the outstanding documents for verification within 30 days. This was not done, and the account was eventually closed,” it added.
The bank stated that on May 2nd, 2023, it responded to the NDPC that the bank did not violate any law because there was no data breach and that the account opening process was not completed.
“On our part, we carried out due diligence by immediately blocking the account and subsequently closing the account when we did not receive the outstanding documents. At no point in the process was the account ever operational,” it said while presenting its side of the story.
It further stated that on July 7, 2023, they were invited for a pre-action meeting with NDPC, wherein it restated its position as earlier communicated to the government agency in a letter dated May 2nd.
The bank, noted, however, that despite its explanation and evidence provided to support its claim, the agency said it had concluded to impose a penalty on the bank.
“On 5th December of 2023, we got a letter from NDPC demanding we pay a ‘remedial fee’ of N250 million within 21 days.“We immediately commenced another round of engagements with the Commission as we were convinced, we had not breached any extant law or regulation,” it said.
“While discussions were still ongoing with the NDPC, we received another letter on the 20th of August demanding that we now pay N555.8m naira,” the bank added in the statement.
Harrison Edeh is a journalist with the International Centre for Investigative Reporting, always determined to drive advocacy for good governance through holding public officials and businesses accountable.