The Nigeria Data Protection Commission (NDPC) has imposed a ₦766.2 million fine on Multichoice Nigeria for breaching the Nigeria Data Protection Act (NDPA).
The development was announced on Sunday via an official statement signed by Babatunde Bamigboye, Head of Legal, Enforcement & Regulations at the Commission.
Privacy Violations and Cross-Border Data Transfers
According to the NDPC, the penalty follows an extensive investigation that began in the second quarter of 2024, spurred by reports of suspected violations of subscribers’ privacy rights and unauthorized cross-border transfer of Nigerian users’ personal data.
The Commission noted that its findings revealed that Multichoice, the parent company of DSTV and GOtv, failed to comply with several key provisions of the Nigeria Data Protection Act.
Key Areas of Non-Compliance
-
Breach of data subject rights: The company reportedly failed to obtain valid consent from users before processing their personal data.
-
Unlawful cross-border data transfer: Multichoice allegedly transferred subscribers’ personal data to foreign entities without necessary safeguards or the approval of the NDPC.
-
Lack of adequate data security measures: The investigation also cited lapses in data protection governance frameworks within the company.
NDPC’s Regulatory Position
The Commission emphasized that the fine was part of a broader enforcement effort to strengthen data governance and safeguard Nigerians’ digital rights in line with the Nigeria Data Protection Act 2023.
“The NDPC is committed to ensuring that all data controllers and processors operating in Nigeria abide by the law. The protection of the personal data of Nigerian citizens is non-negotiable,” Bamigboye stated.
The NDPC added that Multichoice has the opportunity to either comply fully with the enforcement order or seek redress through legal means as stipulated under the Act.
Implications for the Industry
This marks one of the most significant fines issued since the enactment of the Nigeria Data Protection Act in 2023 and signals the Commission’s intent to hold multinational corporations accountable for data privacy violations in Nigeria.
