The Nigeria Data Protection Commission (NDPC) has imposed a substantial fine of N766.24 million on Multichoice Nigeria for egregious violations of the Nigeria Data Protection Act (NDP Act). This landmark penalty, the largest single fine issued by the NDPC since the NDP Act came into force in 2023, was officially disclosed in a statement released on Sunday, signed by Babatunde Bamigboye, Head of Legal, Enforcement & Regulations for the Commission.

The investigation into Multichoice commenced in the second quarter of 2024, prompted by suspected breaches of the privacy rights of Multichoice subscribers and the alleged illegal cross-border transfer of personal data belonging to Nigerian citizens. The Commission's findings revealed that Multichoice had violated the data privacy rights not only of its subscribers but also of their friends, who are not necessarily subscribers themselves. Furthermore, Multichoice was found to be engaging in the unlawful transfer of personal data of Nigerian data subjects across international borders.

The NDPC characterized the depth of data processing by Multichoice as “patently intrusive, unfair, unnecessary and disproportionate.” This conduct, according to the Commission, constitutes a “grave affront to fundamental right to privacy as enshrined in section 37 of the 1999 Constitution of the Federal Republic of Nigeria.” The Commission underscored Nigeria's inherent right to protect its citizens and uphold data sovereignty under both international and existing municipal laws, highlighting the far-reaching implications of these principles for the rule of law, national security, and economic growth.

In line with its standard remediation procedures, the NDPC had initially directed Multichoice to implement appropriate corrective measures to address the identified violations. However, the Commission found the measures undertaken by Multichoice to be unsatisfactory. Consequently, due to what the NDPC described as “want of cooperation,” the decision was made to levy the N766,242,500 fine for violating the NDP Act.

Dr. Vincent Olatunji, the NDPC's National Commissioner, has further directed that all outlets through which Multichoice collects personal data of Nigerian citizens should be thoroughly investigated for non-compliance with the NDP Act. He emphasized that any outlet found to be processing personal data in violation of the Act is liable to penalties as prescribed by the legislation.

The NDPC typically adopts a remediation-first approach, aiming to ensure business sustainability by encouraging companies to rectify breaches before imposing fines. Dr. Olatunji previously stated that financial penalties are reserved for organizations unwilling to comply with remediation recommendations, ensuring that the Commission's actions do not unduly discourage investments while still upholding data protection standards.