NITDA Slams N5M Fine On Electronic Settlement Limited Over Breach
The National Information Technology Development Agency (NITDA) has demanded the Payment of five million naira as fine in line with the requirements of the NDPR from Electronic Settlement Limited over data breach.
The fine came on the heels of the concluded investigation process on the personal data breach by Electronic Settlement Limited. The investigative process involved an analysis of the company’s applications and websites; visit to the company’s office in Lagos, review of its technical documents as submitted to the Agency and interrogation of its officials by NITDA investigation team in Abuja. At the end of the process, it was established that there was a data breach involving the company.
According to Nitda, it commends Electronic Settlement Limited for the actions taken to mitigate this breach. Particularly, it’s taking full responsibility for the breach, updating identified security issues, cooperation with NITDA investigation team, recruitment of a data protection compliance organization, submission of its annual NDPR audit report and generally improving its compliance with the NDPR. The company’s actions demonstrate its sense of responsibility and duty to protect the data of Nigerians and customers in general.
The agency in its statement signed by the agency’s Head, Corporate Affairs and External Relations, Mrs Hadiza Umar, outlined that aside from the monetary fine, Electronic settlement would have to be under a six-month information technology oversight.
“The oversight shall involve oversight of implementation of prescribed security controls and processes. That a clear data security and governance document is drawn up between the Electronic Settlement Limited and all its Information Technology services vendors identifying roles, responsibilities and processes involved in securing and protecting personal data”.
The company is also mandated to conduct regular NDPR training for all staff, publish and implement appropriate policies as required by the NDPR. Submit 2020/2021 regulatory audit as required by Article 4.1.6 of the NDPR, conducted by a Data Protection Compliance Organization (DPCO) as licensed by NITDA. And Conduct Data Protection Impact Assessment on some data intensive applications and products.
“The objective of our investigation was to assess the risk resulting from the breach, with a view to identifying the causes, remedial actions taken and other necessary issues to avoid recurrence . The company has been well briefed on our prescriptions for better information security and protection of personal data”.