The Nigeria Data Protection Commission (NDPC) has imposed a fine of N766,242,500 on Multichoice Nigeria for violating the provisions of the Nigeria Data Protection Act (NDP Act).
The fine, announced in a statement issued on Sunday by the NDPC Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, followed a one-year investigation into the operations of the South African-owned pay TV provider.
Bamigboye said the investigation began in the second quarter of 2024, following reports of alleged breaches of privacy rights of Multichoice subscribers and illegal cross-border transfer of their personal data.
“The NDPC found, among others, that Multichoice violated the data privacy rights of subscribers and third parties who were not necessarily subscribers,” the statement read.
The Commission also discovered that the company was involved in the unlawful transfer of the personal data of Nigerian citizens outside the country without legal basis.
According to the NDPC, “The depth of data processing by Multichoice is patently intrusive, unfair, unnecessary and disproportionate. This is a grave affront to the fundamental right to privacy as guaranteed in Section 37 of the 1999 Constitution of the Federal Republic of Nigeria.”
The Commission noted that the protection of citizens’ personal data and national data sovereignty is a critical aspect of Nigeria’s commitment to international data governance principles, national security, and economic development.
As part of its standard enforcement procedure, NDPC said it directed Multichoice to implement remedial actions to correct the violations. However, it said the company’s response and level of cooperation were unsatisfactory.
“For want of cooperation, the Commission has directed Multichoice to pay N766,242,500 for violating the Nigeria Data Protection Act,” Bamigboye added.
The NDPC further disclosed that its National Commissioner, Dr Vincent Olatunji, has ordered a full compliance audit of all Multichoice data collection outlets across Nigeria.
According to the Commission, any outlet found to be processing personal data in violation of the NDP Act would be penalised in line with the law.
