CBN directive to scrutinise bank customers’ social media presence illegal – Data Protection Council

The Central Bank of Nigeria’s directive requiring financial institutions to obtain customers’ social media handles is against the law, the Nigeria Data Protection Commission has said.

The CBN, in its recently released Customer Due Diligence Regulations, 2023, directed all money deposit banks to obtain comprehensive information about their customers, including their social media handles.

The regulation, it claimed, contained measures that “are designed to improve the ability of financial institutions to identify and monitor potential risks linked to customer activities.”

However, the National Commissioner of the NDPC, Vincent Olatunji, said the CBN’s directive is illegal and against the Nigerian Data Protection Act (NDPA) signed by President Bola Tinubu on 12 June.

In a statement issued by NDPC’s spokesperson, Itunu Dosekun, the commission said it is already engaging the CBN on the issue

“There are provisions in the law to go against any data controller be it private or government office, NGOs, hotels, because we are pro-citizens.

“The whole idea of this law is to protect the rights, the interests of Nigerians who are data subjects.

“We are already engaging with the CBN to let them know that what they have done is against the law because there are basic principles you must meet when you want to collect citizens’ data.

“There is data minimisation, meaning you don’t collect data beyond the purpose for which it was intended, purpose limitation, what purpose is it for,” Mr Olafunji was quoted as saying.

Opposition

The Socio-Economic Rights and Accountability Project (SERAP)- a non-governmental organisation, had earlier described the directive as unlawful and a violation of “Nigerians’ rights to freedom of expression and privacy.”

In its press statement issued on 25 June, SERAP called on the CBN Acting Governor, Folashodun Shonubi, to remove the controversial provisions in the regulations, even as it gave a three-day ultimatum.

SERAP’s statement, signed by its Deputy Director, Kolawole Oluwadare, reads in part, “We would be grateful if the recommended measures are taken within three days of the receipt and publication of this letter. If we have not heard from you by then, SERAP shall take all appropriate legal actions to compel you and the CBN to comply with our request in the public interest.

READ ALSO: CBN mandates banks to scrutinise customers social media presence as SERAP kicks

“The mandatory requirement of social media handles or addresses of customers does not serve any legitimate aim. Such information may be used to unjustifiably or arbitrarily restrict the rights to freedom of expression and privacy”

It argued that the CBN has failed to demonstrate how collecting social media handles would enhance banks’ ability to implement customer due diligence regulations effectively.