Two Nigerian banks, GTB and Zenith Bank, are accused of having data breaches, and the Nigeria Data Protection Bureau has launched an inquiry.
According to a statement released by the agency on Monday, claims of unauthorised access to and processing of personal data as well as unauthorised disclosure of banking records to a third party sparked the investigations.
The investigation is being conducted in accordance with the instruction of the National Commissioner and CEO of the NDPB, Dr Vincent Olatunji. It also applies to all third parties engaging in data processing activities.
The bureau is concerned about how few data privacy and protection laws and best practices are actually put into practice at the lower levels of Nigeria's main data controllers' organisational structures.
It also exhorts organisations to follow federal government circulars and general compliance notices instructing them to give the bureau the names of their data protection officers and contacts.
According to figures from the Nigeria Inter-Bank Settlement System (NIBSS), fraudsters tried 46,126 attacks in the first nine months of 2020, and they were successful 41,979 times, or 91% of the time.
“This level of vulnerability to a data breach is unacceptable and it can only be addressed through foolproof data security and data privacy measures by data controllers/data processors in the industry,” the NDPB statement signed by its head of legal enforcement and regulations, Babatunde Bamigboye, said.
It quoted the NDPB National Commissioner as enjoining all financial institutions to emulate the example of the Central Bank of Nigeria in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and in creating a robust data governance system.