Safeguarding The Personal Data Of Bank Customers, Its Breach And Legal Implications.

According to the Nigerian Data Protection Act 2023 (“the Act”), Data can be said to be characters, symbols, or binary on which operations are performed by a computer, which may be stored or transmitted in the form of electronic signals, stored in any format or any device, while “Personal Data” (PD) means any information relating to an identified or identifiable natural person. According to the Act, a Data Subject (DS) is an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It can be anything from a name, address, a photo, an email address, bank details, posts on social networking websites, medical information, and other unique identifier such as, but not limited to MAC address, IP address, IMEI number, IMSI number, SIM, Personal Identifiable Information (PII) and others.

The acknowledgment of the need for data protection in Nigeria was prompted by advancements in technology and the rise of the digital economy. Legislative activities also influenced this recognition in other jurisdictions. Despite these regulatory efforts, data protection in Nigeria still faces challenges. Data protection in Nigeria has had a turbulent past which is characterized by inadequate record-keeping, lack of judicial interest, and political disputes. According to some experts, the Computer Security and Critical Information Infrastructure Protection Bill marked the initial significant effort to regulate data protection in the country. While the 1999 Constitution of the Federal Republic of Nigeria, guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversation, and telegraphic communications, it lacks the explicit provisions present in the constitutional documents of other countries or organizations like Argentina, and the European Union. On the other hand, the Nigerian constitution does not explicitly mention data protection or provide for its explicit protection. However, there has been a recent development in Nigeria where the Court of Appeal, in its first appellate resolution on the subject, has offered some guidance by stating that data protection is guaranteed by, and subsumed under Section 37, of the Constitution which provides for right to privacy.

Data protection has become a significant concern in today’s digital age, particularly in the banking sector, where handling personal and financial information is inevitable. As banks increasingly rely on technology to provide efficient and convenient services, ensuring robust data protection measures is essential to maintaining trust, protecting customer privacy, and defending against cyber threats. Data has become a valuable asset in an increasingly digital economy, and protecting it has become paramount. Nowhere is this more critical than in the banking sector, where sensitive financial information is entrusted to financial institutions by their customers.

In Nigeria’s financial sector, the Banking and Other Financial Institutions Act regulates banking and other financial institutions and matters connected to them. The Central Bank of Nigeria (‘CBN’), through the Central Bank of Nigeria Act also regulates the banking sector. The BOFIA and CBN Act do not make specific provisions for data protection in the finance sector. However, specific guidelines issued by the CBN, such as the Consumer Protection Framework (‘the Framework’) and the draft Consumer Protection Guidelines of Disclosure and Transparency, make some provisions for data protection and privacy in the financial sector.

The Nigeria Data Protection Regulation (NDPR), although considered as a subsidiary legislation, is the extant data protection guide in Nigeria and mainly makes provisions for the protection of the personal data of individuals as opposed to that of corporate and legal entities.

This article will delve into the importance of data protection in the banking sector, explore its challenges, and highlight the measures to be taken, to ensure the security and privacy of customers’ financial data with relative cognizance of the Nigeria Data Protection Regulation. (NDPR) 2019, Nigeria Data Protection Act 2023 and its provisions on data protection for the personal data of individuals.