The Nigeria Data Protection Commission (NDPC) has slammed MultiChoice Nigeria with a ₦766,242,500 fine for violating the Nigeria Data Protection Act (NDPA), following an investigation into its handling of subscribers’ personal data.
The Commission’s Head of Legal, Enforcement and Regulations, Mr. Babatunde Bamigboye, disclosed the decision in a statement issued Sunday in Abuja. According to him, the penalty followed a second-quarter 2024 investigation into suspected violations of privacy rights and unlawful cross-border data transfers involving Nigerian citizens.
“NDPC found, among other things, that MultiChoice violated the data privacy rights of its subscribers and individuals associated with them who are not necessarily subscribers,” Bamigboye said.
The Commission also discovered that the company engaged in illegal cross-border transfers of personal data belonging to Nigerian data subjects, describing the scale of processing as intrusive, unfair, unnecessary, and disproportionate.
“This is a grave affront to the fundamental right to privacy as enshrined in Section 37 of the 1999 Constitution of the Federal Republic of Nigeria,” he added.
Bamigboye emphasized that Nigeria has a sovereign right to protect its citizens’ data under both international law and domestic legal frameworks, citing the implications for national security, rule of law, and economic development.
According to the Commission, MultiChoice was directed to carry out remedial actions during the investigation in line with the NDPA’s compliance procedures. However, its response was deemed unsatisfactory.
“For want of cooperation, the Commission has directed MultiChoice to pay ₦766,242,500 for violating the Nigeria Data Protection Act,” Bamigboye stated.
The Commission’s National Commissioner, Dr. Vincent Olatunji, also directed that all channels used by MultiChoice to collect personal data from Nigerian citizens be placed under review for non-compliance.
He warned that any data processing outlet in breach of the NDPA would face sanctions under the law.
NDPC reaffirmed its mandate to uphold privacy rights and ensure that data controllers and processors in Nigeria comply with recognized legal bases, including consent, contractual obligation, and legal duty.
