The Nigeria Data Protection Commission (NDPC) has imposed a fine of ₦766,242,500 on MultiChoice Nigeria for violations of the Nigeria Data Protection Act (NDPA), following confirmed breaches of subscribers’ privacy rights and illegal cross-border data transfers.
The sanction was announced in a statement issued on Sunday in Abuja by Mr. Babatunde Bamigboye, NDPC’s Head of Legal, Enforcement and Regulations, revealed that the penalty came after a formal investigation launched in the second quarter of 2024 into MultiChoice’s handling of subscribers’ personal data.
According to Bamigboye, the investigation uncovered that MultiChoice not only violated the privacy rights of its subscribers but also infringed on the rights of individuals whose personal data was processed through its systems, even if they were not direct subscribers.
He stated that MultiChoice engaged in unauthorised cross-border transfers of personal data belonging to Nigerian citizens—an act deemed both unlawful and a direct violation of national data sovereignty.
“The depth of data processing by MultiChoice is patently intrusive, unfair, unnecessary, and disproportionate. This is a grave affront to the fundamental right to privacy as enshrined in Section 37 of the 1999 Constitution of the Federal Republic of Nigeria,” Bamigboye said.
He emphasized that under both international and national law, Nigeria has the right to protect the data and privacy of its citizens—a critical issue with implications for national security, the rule of law, and economic development.
As part of its standard remediation procedure, the NDPC had initially directed MultiChoice to implement corrective measures.
However, Bamigboye noted that the commission found MultiChoice’s response and efforts unsatisfactory, ultimately leading to the imposition of the fine.
“For want of cooperation, the commission has directed MultiChoice to pay ₦766,242,500 for violating the Nigeria Data Protection Act,” he stated.
The National Commissioner of the NDPC, Dr. Vincent Olatunji also ordered that all platforms and channels used by MultiChoice to collect and process the personal data of Nigerian citizens be further investigated for compliance with the NDPA.
He reiterated that any entity—whether digital, physical, or third-party affiliated—that processes personal data in violation of the NDPA is liable to sanctions under the law.
The NDPC, as Nigeria’s designated Data Protection Authority, operates under legally recognised bases for processing personal data, including consent, legal obligations, and contractual necessity.
