Data Protection Commission Fines Multichoice For Data Breaches

This enforcement action follows a comprehensive investigation initiated in the second quarter of 2024. The probe was launched in response to complaints and indications of privacy rights violations involving Multichoice subscribers and the unlawful cross-border transfer of personal data belonging to Nigerian citizens.

Findings from the investigation revealed that Multichoice violated key provisions of the NDP Act by:

•Illegally processing personal data belonging to both its subscribers and individuals who are not registered customers;

•Engaging in unauthorized cross-border transfers of personal data of Nigerian data subjects;

•Conducting data processing practices deemed excessive, intrusive, unfair, and disproportionate to purpose—constituting a serious breach of privacy rights as protected under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria.

The Commission emphasized that Nigeria, in line with both international obligations and domestic law, is duty-bound to uphold data sovereignty and ensure the protection of citizens’ personal data—an essential component of national security, rule of law, and economic stability.

As part of its standard compliance procedures, the NDPC initially directed Multichoice to implement corrective measures. However, the company’s response was found to be inadequate and non-compliant with regulatory expectations. Consequently, the Commission has ordered Multichoice Nigeria to pay the stated fine in accordance with the Nigeria Data Protection Act.

In addition, the National Commissioner of NDPC, Vincent Olatunji, has directed that all platforms and outlets used by Multichoice for the collection and processing of Nigerians’ personal data be thoroughly investigated. Any entity found to be in violation of the NDP Act will face appropriate sanctions under the law.