The Nigerian government has commenced investigations into the activities of Meta (formerly known as Facebook), DHL, and online payment platform OPay for alleged data breaches.

The companies if found liable, could forfeit two percent of their annual gross revenue to the government.

The investigations were opened following a barrage of complaints from Nigerians over the violation of their data privacy rights.

The Nigeria Data Protection Commission (NDPC) is investigating the data processing activities of the affected data controllers. This is the second time the NDPC has opened probes into the activities of companies, banks, and universities in the country over alleged data infractions.

The National Commissioner of NDPC, Dr. Vincent Olatunji, had previously warned that infractions would attract penalties in accordance with the letter and spirit of the Nigeria Data Protection Act, 2023. He said the commission would not hesitate in “safeguarding the integrity of Nigeria’s data economy ecosystem.”

Meta

Complaints against Meta touch on behavioural advertising without the explicit consent of data subjects. Reports show that approximately 40 million Facebook accounts in Nigeria might have been affected by the data processing under investigation.

DHL

DHL is facing an investigation for allegedly violating the lawful basis and principles of data protection. Sources privy to the inquiry said DHL’s data processing falls short of the confidentiality standard prescribed under the Nigeria Data Protection Act. The Act in section 24(2) (2) notes that “A data controller and data processor shall use appropriate technical and organisational measures to ensure confidentiality, integrity, and availability of personal data.”

OPay

OPay is accused of opening bank accounts for data subjects without their consent. If this is true, it would amount to a grave violation of the data privacy rights of affected data subjects. Reports have it that the platform has about 40 million data subjects.

It is understood that the NDPC has served each of the data controllers with a Notice of Investigation.