The National Information Technology Development Agency (NITDA) has slammed a N10 million sanction on an online lending platform, Soko Lending Company Limited (Soko Loans), for privacy invasion.

This was after a series of complaints against the company for unauthorized disclosures, failure to protect customers’ personal data and defamation of character as well as not carrying out the necessary due diligence as enshrined in the Nigeria Data Protection Regulation (NDPR).

NITDA, as part of its due diligence process, commenced investigation over the alleged infractions of the provisions of the NDPR.

Soko Loans grants its customers uncollateralised loans and requires a loanee to download its mobile application on their phone and activate a direct debit in the company’s favour. The app gains access to the loanee’s phone contacts.

According to one of the complainants, when he failed to meet up with his repayment obligations due to insufficient credit in his account on the date the direct debit was to take effect, the company unilaterally sent privacy invading messages to the complainant’s contacts.

Investigation revealed that complainants’ contacts who were neither parties to the loan transaction nor consented to the processing of their data have confirmed the receipt of such messages.

The agency made strident efforts to get Soko Loans to change the unethical practice but to no avail. After the agency’s investigation team secured a lien order on one of the company’s accounts by which it could come up with privacy enhancing solutions for its business model, Soko Loans decided to rebrand and direct its customers to pay into its other business accounts.

NITDA’s investigation further revealed that the company embeds trackers that share data with third parties inside its mobile application without providing user’s information about it or using the appropriate lawful basis.

In a press statement to Daily Sun, NITDA said the agency found Soko Loans and its entities in violation of the following legal provisions:

“Use of non-conforming privacy notice, contrary to Article 2.5 and 3.1(7) of the NDPR; insufficient lawful basis for processing personal data, contrary to Articles 2.2 and 2.3 of the NDPR; illegal data sharing without appropriate lawful basis, contrary to Article 2.2 of the NDPR; unwillingness to cooperate with the Data Protection Authority, contrary to Article 3.1 (1) of Data Protection Implementation Framework; and non-filing of NDPR audit reports through a licensed Data Protection Compliance Organisation, contrary to Article 4.1(7) of the NDPR.”

In view of the foregoing and in consideration of its implication on the privacy of Nigerians and erosion of trust in the digital economy, NITDA imposed a monetary sanction of N10 million on Soko Lending Company Limited and directed that no further privacy-invading messages be sent to any Nigerian until the company and its entities show full compliance with the NDPR.

The agency also directed the company to pay for the conduct of a Data Protection Impact Assessment by a NITDA-appointed DPCO on its operations and placement on a mandatory Information Technology and Data Protection oversight for nine months.

The criminal aspects of the investigation has been deposited with the Nigeria Police to determine if the executives of the company are liable to imprisonment for violating Section 17 of the NITDA Act, 2007.

PrinceOfLagos:
That was how one idiot called me the other day and was reporting someone to me and even went as far as threatening over something i know nothing about

Is04970:
CBN and NITDA are both compromised. The fine should be in the region of 50 million Naira.
Imagine giving out a loan for 6 days with 25% interest? What are the regulatory bodies doing to protect Nigerians?
Shame on them all.

seunmsg:


Now that Buhari is doing something about the problem, we should appreciate and encourage the effort.

seunmsg:


Now that Buhari is doing something about the problem, we should appreciate and encourage the effort.

FarahAideed:


There is no problem here in the first place because before people borrow they are have to agree to allow their phone books to be cached and they all agree ...The simple solution is to decline the phone book access from the onset

Maxymilliano:
I got a Whatsaap message from these loan sharks few weeks back saying I should warn a certain lady who collected money and ran away with it.

I was like "Abi werey nse awon eleyi ni"

PrinceOfLagos:

Got same about a lady I used to know back in the day , didn't know she still got my number.

The most annoying part s that I was told in the text message that she used my name as collateral and I was like what the Bleep

Is04970:
CBN and NITDA are both compromised. The fine should be in the region of 50 million Naira.
Imagine giving out a loan for 6 days with 25% interest? What are the regulatory bodies doing to protect Nigerians?
Shame on them all.