NDPC Declares CBN’s KYC Social Media Policy Illegal

By Adedapo Adesanya

The Nigeria Data Protection Commission (NDPC) has said the new directive by the Central Bank of Nigeria (CBN) to commercial banks that they should collect their customers’ social media handles is against the law.

The National Commissioner of NDPC, Mr Vincent Olatunji, said this in a statement issued by Mr Itunu Dosekun, Head of Media, on Thursday in Abuja.

The central bank, on June 26, directed banks to obtain the social media handles of customers as part of enhanced Customer Due Diligence (CDD) regulations.

The move has drawn ire from Nigerians as well as Socio-Economic Rights and Accountability Project (SERAP) challenging the move, with threats of a lawsuit.

Mr Olatunji said that before the establishment of the Nigerian Data Protection Act (NDPA) on June 12, indiscriminate collection of citizens’ data by Data Controller Organisations was not taken seriously.

He explained that there were prerequisite steps any data controller must take prior to the collection of data from data subjects, stressing that any defaulting organisation was going against the law and causing a data breach, as well as would attract a fine.

“There are provisions in the law to go against any data controller, be it private or government office, NGOs, hotels, because we are pro-citizens.

“The whole idea of this law is to protect the rights, the interests of Nigerians who are data subjects.

“We are already engaging with the CBN to let them know that what they have done is against the law because there are basic principles you must meet when you want to collect citizens’ data.

“There is data minimisation, meaning you don’t collect data beyond the purpose for which it was intended, purpose limitation, what purpose is it for,’’ he explained.

According to him, asking for social media handles is not necessary.

He, however, said that if the collection of the social media handles happened under public interest, which could include monitoring some transactions, there should be proper awareness among the customers.

Mr Olatunji added that they would be inquiring about why the CDD regulation came up and how best to resolve that in line with global best practices.

On the issue of the government tapping into some citizens’ mobile communications, perhaps for national security, among other reasons, Olatunji said that there were guidelines to follow.

He said the commission would be engaging with a lot of government institutions, and data controllers to sensitise them on the requirements of the NDPA and data collection prerequisites.