The National Information Technology Development Agency (NITDA) has wielded the big stick on Electronic Settlement Limited by fining the company N5, 000. 0000 over what it described as Data Protection Breach, saying the fine in line with the requirements of the National Data Protection Regulation.
Apart from the monetary fine, Electronic Settlement Limited shall be under a six-month information technology oversight by NITDA, which shall involve oversight of the implementation of prescribed security controls and processes.
Other punishments meted to the company in order to prevent a repeat of this unfortunate breach, include:
- That a clear data security and governance document is drawn up between the Electronic Settlement Limited and all its Information Technology services vendors identifying roles, responsibilities and processes involved in securing and protecting personal data.
- That the company conducts regular NDPR training for all staff, publish and implement appropriate policies as required by the NDPR.
- Submit 2020/2021 regulatory audit as required by Article 4.1.6 of the NDPR, conducted by a Data Protection Compliance Organization (DPCO) as licensed by NITDA.
- Conduct Data Protection Impact Assessment on some data-intensive applications and products.
This is coming as NITDA conducted an investigation process on the personal data breach by Electronic Settlement Limited. The investigative process involved an analysis of the company’s applications and websites; a visit to the company’s office in Lagos, a review of its technical documents as submitted to the Agency and an interrogation of its officials by the NITDA investigation team in Abuja.
The objective of the investigation, according to NITDA was to assess the risk resulting from the breach, with a view to identifying the causes, remedial actions taken and other necessary issues to avoid recurrence. The company has been well briefed on our prescriptions for better information security and protection of personal data.