Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

NITDA sanctioned Soko Lending Company Limited by fining it N10million for unauthorized disclosures, failure to protect customers' personal data, defamation of character as well as failure to carry out the necessary due diligence as enshrined in the Nigeria Data Protection Regulation (NDPR).

Facts

Soko Lending Company Limited offers its customers uncollateralized loans, requiring them to download a mobile application and activate a direct debit in the company’s favor. The app gains access to the customer’s phone contacts.

One complainant reported that when he missed a repayment due to insufficient funds, the company sent intrusive messages to his contacts without his consent.

Investigations revealed that the complainant's contacts, who were not involved in the loan transaction and had not consented to their data being processed, confirmed receiving these messages. Despite efforts by the agency to stop this unethical practice, Soko Loans continued. The agency secured a lien on one of the company’s accounts to push for privacy improvements, but Soko Loans rebranded and redirected payments to its other accounts.

Further investigation by NITDA found that Soko Loans embedded trackers in its mobile app that shared data with third parties without informing users or using a lawful basis.

NITDA determined that Soko Loans and its entities violated several legal provisions:

1. Use of a non-conforming privacy notice, contrary to Articles 2.5 and 3.1(7) of the NDPR.
2. Insufficient lawful basis for processing personal data, contrary to Articles 2.2 and 2.3 of the NDPR.
3. Illegal data sharing without appropriate lawful basis, contrary to Article 2.2 of the NDPR.
4. Unwillingness to cooperate with the Data Protection Authority, contrary to Article 3.1(1) of the Data Protection Implementation Framework.
5. Failure to file NDPR Audit reports through a licensed Data Protection Compliance Organisation (DPCO), contrary to Article 4.1(7) of the NDPR.

Holding