The Nigeria Data Protection Commission (NDPC) has twice requested the Records of Processing Activities (ROPA) from the Independent National Electoral Commission (INEC) over allegations of data breaches.
NDPC National Commissioner Dr. Vincent Olatunji disclosed this in Abuja during a media briefing marking the commission’s third anniversary.
Olatunji said the requests followed the signing of the Nigeria Data Protection Act by President Bola Tinubu on June 12, 2023, as part of efforts to protect Nigeria’s electoral database integrity.
He emphasized that the commission treats every reported breach seriously and has acted on all cases, regardless of the institution involved.
“There is no breach reported to us that we have not addressed, whether in government or private sector. For example, INEC has been asked twice for its Records of Processing Activities. This is a sensitive matter, especially with another election approaching, as it concerns the credibility of the database. We are acting urgently,” he said.
Olatunji also stated that the NDPC has investigated organizations including Meta, TikTok, Temu, Remita, and Sterling Bank, with no organization exempt from scrutiny.
He explained that the commission prioritizes due process and avoids prejudging cases or investigations from any source.
“All invited organizations have cooperated fully,” he added.
The commissioner noted that the NDPC adopts a developmental and compliance-based approach rather than punitive fines.
After investigations, the commission assesses organizations’ data protection practices—including registration, audit filings, data protection officers, privacy policies, and technical safeguards.
Organizations with good compliance are usually directed to fix gaps within a set period and may pay remediation fees instead of fines.
“The goal is compliance, not punishment. We want to encourage growth and innovation,” he said.
Olatunji mentioned that the only case that went to court involved Meta, which challenged a $32 million penalty. The matter was later settled out of court with measures to ensure compliance and support data protection efforts in Nigeria.
He explained that the settlement was preferred over pursuing higher sanctions, to protect Nigeria’s economy and the livelihoods of Nigerians relying on Meta platforms.
“What we want is compliance, not embarrassment or driving away investors,” he said.
Olatunji affirmed that the NDPC maintains high ethical standards, emphasizing integrity and credibility.
He added that the commission will continue collaborating with public and private sector stakeholders to strengthen data protection and privacy awareness across Nigeria.
