The National Information Technology Development Agency (NITDA) has fined an online lending platform, Soko Lending Company Limited (Soko Loans), N10 million for privacy invasion.
The 10 million Naira fine is coming after the IT regulatory agency carried an investigation on series of complaints against Soko Loan, invading people’s privacy and found out the loan company failed to protect customers’ personal data and defamation of character as well as carrying out the necessary due diligence as enshrined in the Nigeria Data Protection Regulation (NDPR).
Apart from the N10million fine, NITDA also directs that no further privacy-invading messages be sent to any Nigerian until the company and its entities show full compliance with the NDPR.
It also directs the company to pay for the conduct of a Data Protection Impact Assessment by a NITDA appointed DPCO on its operation; and placement on a mandatory Information Technology and Data Protection oversight for 9 months.
Part of the statement by NITDA reads: “Soko Loans grants its customers uncollateralised loans and requires a loanee to download its mobile application on their phone and activate a direct debit in the company’s favour. The app gains access to the loanee’s phone contacts.
“According to one of the complainants, when he failed to meet up with his repayment obligations due to insufficient credit in his account on the date the direct debit was to take effect, the company unilaterally sent privacy-invading messages to the complainant’s contacts.
“Investigation revealed that complainants’ contacts who were neither parties to the loan transaction nor consented to the processing of their data have confirmed the receipt of such messages. The Agency made strident efforts to get Soko Loan to change the unethical practice but to no avail. After the Agency’s investigation team secured a lien order on one of the company’s accounts by which it could come up with privacy-enhancing solutions for its business model, Soko Loan decided to rebrand and directs its customers to pay into its other business accounts.
“The Agency’s investigation further revealed that the company embeds trackers that share data with third parties inside its mobile application without providing users information about it or using the appropriate lawful basis.”
NITDA said Soko Loan and its entities were found to be in violation of the following legal provisions:
- Use of non-conforming privacy notice, contrary to Article 2.5 and 3.1(7) of the NDPR;
- Insufficient lawful basis for processing personal data, contrary to Articles 2.2 and 2.3 of the NDPR;
- Illegal data sharing without appropriate lawful basis, contrary to Article 2.2 of the NDPR;
- Unwillingness to cooperate with the Data Protection Authority, contrary to Article 3.1 (1) of Data Protection Implementation Framework; and
- Non-filing of NDPR Audit reports through a licensed Data Protection Compliance Organisation (DPCO), contrary to Article 4.1(7) of the NDPR.