We say no to collection of social media handles of customers by banks – CITAD

The Centre for Information Technology and Development (CITAD) has disapproved of the Central Bank of Nigeria’s directive to banks and other financial institutions mandating them to collect the social media profiles of their customers.

CITAD in a statement signed by its Executive Director, Y. Z. Ya’u recalled that only last two weeks, President Bola Ahmed Tinubu accented to the Data Protection Law, adding g that the intention of the Act was to protect privacy and personal data of the citizens.

Ya’u added that among the mechanisms put are to minimize the extraction of personal data from people, to provide a limit to how long it can be stored before destruction and provide for the consent of data subjects in agreeing to part with data about themselves.

He explained that the consent clause requires that data collectors must explain the purpose for which they are collecting the data, how they intend to store and with who it may be shared and for how long it will be held.

He pointed out that the law in spite of some of its shortcomings, is consistent with global best practices in protecting data and privacy in the context of massive extraction of data from the citizens.

He however, stressed that the directive issued by the Central Bank of Nigeria (CBN) to banks and other financial institutions mandating them to collect the social media profiles of their customers was in contravention of the objectives of the Data Protection Act.

He said,”In a move contrary to the spirits and letters and indeed, in contravention of the objectives of the Data Protection Act, the Central Bank of Nigeria (CBN) last week gave a directive to banks and other financial institutions mandating them to collect the social media profiles of their customers.

“It is not clear what value social media handles will add to the customer portfolio which currently has such unique identifiers as NIM, biometric details, emails, phone number, etc. Collecting social media handles is therefore in the class of over specification, requiring data more than that is needed for the banks to handle their relationship with their customers.”

Ya’u added,”Secondly, by mandating banks and other financial institutions to collect social media handles, this will make banks to demand that all account operators must have social media handles. This amounts to compelling citizens to open social media accounts even when they do not see its use. Given the multiplicity of social media platforms, this will place unnecessary burden to many people.

“Why should people, against their wishes be forced to register on social media accounts? Is the CBN acting on behalf of platform providers who make money out of accounts that citizens operate on their platforms? Who bears the costs of these handles when, as Twitter for example is contemplating to start charging for accounts?

“In fact, this will farther increase the number of people who are financially excluded, a number that is ridiculously large even as people who have no social media accounts will then not be allowed to operate bank accounts. Rather than the CBN to focus its attention on how it will promote the financial inclusion of those who are identity excluded (due to lack of digital infrastructure to capture these in the national identity management number registration), the CBN is looking for easy way to join the bandwagon of government agencies that want to penalize free expression in the social media platforms.

“This directive usurped the powers of the Nigeria Data Protection Commission which has the powers as provided in the Article that give the Commission the powers to by “regulation prescribe types of personal data and processing to be exempted from application” of the Act.

“Since the Act came into effect, social media handles have not been classified as a data that can be exempted from the application of the Act and if the CBN feels that should be done, it should submit a request and following a public debate on the request, the Nigeria Data Protection Commission can then make a ruling on it. But until that is done, the CBN directive is illegal, and in contravention of the Data Protection Act.”

Ya’u further stressed that even more worrisome is the fact that such information that is not useful to the banks could be misused by other parties.

“Again, contrary to the provisions of the data Protection Act, CBN does not make it clear with who the banks are to share this data, and for how long the data will be held. Could it be a backdoor attempt for banks to collect data about citizens and pass it to security agencies in the form of outsourcing serving in a new mega electronic surveillance by the security agencies? Such a move is contrary to the extant laws for the protection of the privacy of individuals and for the protection of data in the country.

“Article 21 of the Act provides among other things that a data controller such as the bank, intending to collect personal data from data subjects (the customers), it must inform them of the specific lawful basis for the collection of the personal data, indicate the recipients or categories of recipients of the personal data, the retention period for the personal data. Neither the bank nor CBN has cared to think about these provisions.

“If the CBN is forgetting, it needs to be told in clear terms that we are not in a jungle or under military rule in which one opinion of the leader supersede all our laws,” he asked.

Ya’u further asked,”Lastly, how are we sure that such information cannot fall into the hands of other third-party actors who could use it (for example politicians who find certain social media handles too disagreeable to their personal agenda) to connive with banks to punish owner of such handles.

“This is not farfetched as we have only to recall the experience of some participants in the EndSars protest. We know that during the Endsars protests government directed banks to block the bank accounts of certain activists, merely on the basis of profiling their social media handles and the banks obliged to the government’s directive, barring the accounts of these activists.

“This move of linking social media handles to bank accounts it seems to provide easy means for government not only to police what citizens do on the social media but also to punish people with citizens view about government and its policies that government does not find palatable.

This is a fundamental breach of our digital rights and privacy. We condemn the directive as suspect and as anti-democratic and seems to continue with anti-people policy of the bank that only recently saw millions of jobs wipe out due its poor currency redesign.

“We call on the CBN to immediately withdraw this directive. We call on all well-meaning Nigerians, civil society organizations, and digital rights activists to not only condemn this move but also demand for its withdrawal.

“We also call on President Bola Ahmed Tinubu to add his voice and provide a moral leadership against this evil policy, by demanding that the CBN should not be allowed to abuse our right to privacy and derogate our digital rights and freedoms.”