Legal Angle with AMOFIN SOLICITORS
Do Financial Institutions owe their customers the duty of Privacy and Confidentiality over their Personal Information?
By
Kazeem A. Oyinwola Esq.
Introduction
|
T |
he Central Bank of Nigeria (CBN), on 7th November 2016, issued the Consumer Protection Framework. The Framework was, presumably, issued to guide the effective regulation of consumer protection practices of Financial Institutions (FIs) in Nigeria under the regulatory purview of the CBN. The Framework aims at ensuring consumers of financial services are adequately protected and treated fairly. It details the roles and responsibilities of the regulator, the FIs and the consumers. The Framework requires that its provisions be read in conjunction with the provisions of the CBN Act, the BOFIA and subsidiary regulations made under those Acts.
How Does the Framework Apply to You?
The Consumer Protection Framework is an important industry-specific regulation/framework which spells out the obligations of Financial Institutions (FIs) in relation to the protection of consumers. Today, almost every individual and business has one form of relationship with one FI or the other; either we individually transact or maintain account(s) with FIs or we have our business accounts domicile with them. Gone are the days when FIs could treat customer’s data as exclusively theirs and use the data as they please. Thus, it is important that the consumers/customers as well as the FIs key-players are aware of their respective rights and obligations. In this edition, we examine the rights and obligations of consumers and FIs as to privacy and confidentiality.
What are Financial Institutions?
According to paragraph 1.3 of the Framework, FIs refers specifically to financial institutions including and together with their staff, agents or representatives regulated by the Central Bank of Nigeria. These are Commercial or Merchant Banks, Specialized Banks, Micro-finance Banks (MFBs), Discount Houses (DHs), Development Finance Institutions (DFIs), Finance Houses (FHs), Bureaux-de-Change (BDCs), Primary Mortgage Banks (PMBs), Credit Bureaux, Mobile Payment Companies, Mobile Money Operators or any other institution as may be licensed by the CBN from time to time in line with the relevant provisions of Bank and Other Financial Institutions Act.
Obligation as to Confidentiality
The
paragraph 2.6.2 of the
framework requires FIs to keep in confidence
all
personal information of customers including even those with closed accounts.
The provisions of paragraph 2.6.2(1) impose a duty of care on FIs and mandate
them to safeguard the privacy of their customers’ information. Under this framework, financial
institutions can only reveal consumers/customers information to a third party;
(a) When the customer gives express permission,
(b) When required by the CBN and other regulatory bodies;
(c) When there is a court order requiring such disclosure; and
(d) In pursuance of public duty or interest.
What Personal Information are Protected?
Paragraph 2.6 of
the Framework requires FIs to ensure protection of consumer assets and privacy
by requiring that appropriate measures shall be established to
guarantee protection of consumer assets and privacy.
Thus, consumer’s
financial and personal information shall be protected by FIs at all times and shall not be released to a third party
without the consent of the consumer, except as required by law. What then are
those information protected under the framework? The information includes contact details, account
number and balance, statement of accounts and any other information known to
the FIs. Under this, the
Banks have obligations to establish guidelines to safeguard consumer assets and
privacy against unauthorized access. In this regards, the primary areas to be
covered are: Fraud and Data protection. There is therefore the obligation on
banks to provide adequate controls to be put in place to prevent incidences of
fraud and to also prevent unauthorized access to consumers’ confidential
information.
Protection of Data of Consumers of FIs
The
FIs is required under the framework to ensure appropriate data protection
measures and staff training programs to be put in place to prevent unauthorized
access, alteration, disclosure, accidental loss or destruction of customers’
data. The framework makes it mandatory that the consent of consumers shall be
obtained in writing before the customers’ data is shared with third parties and
for this purpose, a third party includes a subsidiary or an associated company.
Requirement of Consent is Critical
According to paragraph 2.6.2 (5) of the framework, the requirement of consent is critical in that it consent must be obtained in writing even before using the consumer’s information for future promotional offers via e-mail, SMS, phone calls and other channels. As an extension of this requirement, consumers partaking in sales promotions are required to be informed if their informational would be required for any publicity or advertisement by the financial institution.
Is there any remedy in the event of any breach?
Under paragraph 2.7, the Framework provides complaints handling and redress in the event of any breach of the consumers’ right provided in the framework. An aggrieved consumer is expected to lay a complaint over the alleged breach before the FIs first and in the event of unsatisfactory resolution of such complaints, paragraphs 2.7.1 and 2.7.2 gives the aggrieved customer the liberty to further escalate the complaint to any recognized Alternative Dispute Resolution institutions involved in complaints of such nature.
About the author
Kazeem A. Oyinwola is legal practitioner
and partner at Amofin Solicitors, Nigeria. He is a graduate of University of Ilorin,
Nigeria and specializes in Communications & Information Technology Law. Kazeem
is an advocate and writer. He consults for gov’t agencies, private individuals
as well as corporate clients in areas relating to Fintech, Intellectual
Property, Media Law, Telecommunication, Energy and Environmental Law, ADR, Banking
and Commercial Law, Oil and Gas and Islamic Finance.