Fidelity Bank fights N555.8m NDPC fine amid alleged data breach

Business a.m.

Fidelity Bank has rejected the Nigerian Data Protection Commission’s (NDPC) allegation of a data breach and the N555.8 million fine imposed as a result.

 In a recent statement, the bank asserted that it followed all relevant laws concerning data protection and that it adhered to the highest ethical standards throughout the handling of its customers’ data.

Meksley Nwagboh, the divisional head of brand and communications at Fidelity Bank, issued a statement  asserting that the bank conducted itself to the highest ethical standards by ensuring full compliance with extant laws on data protection.

The NDPC, however, remained adamant that Fidelity Bank had violated data privacy laws and was therefore subject to the hefty fine. Vincent Olatunji, the national commissioner of the NDPC, asserted that the bank’s perceived arrogance was a significant factor in the decision to impose the full penalty, indicating that the commission views Fidelity Bank’s handling of the matter as a serious breach of regulatory compliance. 

In response to the fine, Fidelity Bank provided clarification on the alleged breach, stating that it involved an incomplete account opening request received online, which was never activated due to incomplete documentation. The bank further noted that it took prompt action by blocking the account and ultimately closing it when the necessary documents were not submitted.

Fidelity Bank provided additional information on the timeline of events surrounding the alleged data breach, stating: “On April 30th, 2023, we received a notice of investigation from the Nigerian Data Protection Agency (NDPA), now the Nigerian Data Protection Commission (NDPC). The investigation was in respect of a complaint from [name withheld] who claimed that [name withheld] details were used to open an account in the bank without [name withheld] consent.

“Fidelity Bank conducted an internal investigation in response to the notice and discovered that “an account opening request was received online in the name of [name withheld], and an email was sent to the email address attached to the request informing them about this.

“In compliance with our Data Protection policy, accounts created online without full documentation are not allowed to be operational and are closed after 30 days if the outstanding documents are not provided to authenticate the identity of the person seeking to open the account.”  

Fidelity Bank also clarified that, in adherence to data protection laws, the account in question was not allowed to be operational due to the absence of required documents, such as a passport photograph and a Bank Verification Number (BVN).

 The bank further explained that, following the incomplete application process, the account in question was placed on a ‘Post No Debit’ status, meaning that no transactions could be carried out on the account. The bank maintained that this was a necessary step to ensure compliance with data protection laws, as the applicant was expected to complete the account opening process by providing the outstanding documents for verification within 30 days. 

Fidelity Bank recalled that in its communication with the NDPC on May 2nd, 2023, it reiterated that no data breach had taken place and that the account opening process was never finalised.

“On our part, we carried out due diligence by immediately blocking the account and subsequently closing the account when we did not receive the outstanding documents. At no point in the process was the account ever operational,” the bank stated.

Fidelity Bank revealed that, in response to the NDPC’s investigation, they were invited to attend a pre-action meeting on July 7, 2023, during which they restated their stance that no data breach occurred.  

According to the bank, despite presenting evidence to back up its assertions, the NDPC went on to impose a penalty. Fidelity Bank reported receiving a letter from the NDPC on December 5, 2023, demanding a remedial fee of N250 million within 21 days. However, the bank expressed shock when, while still in discussions with the commission, it received a subsequent letter on August 20, 2024, escalating the fee to N555.8 million.