Economic and Financial Crimes Commission (EFCC) does not currently maintain a public privacy policy on www.efcc.gov.ng, its official website.
This is despite partnering with the Nigeria Data Protection Commission (NDPC) to ensure data compliance according to findings by Foundation for Investigative Journalism (FIJ)
As a law enforcement agency, the EFCC handles highly sensitive personal data and financial records, but its main web portal does not currently provide a formal, publicly available privacy policy detailing how user data is collected, stored, or processed.
According to the National Information Technology Development Agency (NITDA), all government websites are mandated to have privacy policies.
Section 10.4 (i, ii) of the NITDA Privacy Policy mandates all government websites to exercise diligence when collecting personal details or information about visitors to their websites.
It equally requires all government websites to incorporate prominently displayed privacy statements clearly stating the purpose for which information is being collected where the government institution seeks to or collects personal information from visitors through its website.
In addition, the Nigeria Data Protection Act (NDPA) 2023 requires every data controller to make a privacy notice available to citizens before or at the point of collecting their personal data.
That notice must state the specific lawful basis of processing, the purposes of the processing, the categories of recipients of the personal data, the existence of data subject rights, and the right to lodge a complaint with the Commission.
The law further states that such information must be contained in a privacy policy and expressed in a clear, concise, transparent, intelligible and easily accessible format, taking into consideration the class of data subjects targeted by the data processing.
However, on Monday, FIJ checked the anti-graft agency’s website and found that it had no privacy policy or privacy notice informing users how their personal data is collected, processed, stored or shared.
FIJ found that Nigerians can submit petitions to the EFCC on the website.
During this process, the website compulsorily collects personal data such as names, National Identification Numbers (NIN), email addresses, local government areas (LGAs), phone numbers and residential addresses.
Also, organizations and financial institutions (such as commercial banks) are legally mandated to share customer information and suspicious transactions with the EFCC to prevent financial crimes.
However, the website collects this information without specifically informing users what happens to the data they provide.
Ironically, in September 2024, the EFCC and the Nigeria Data Protection Commission (NDPC) agreed to forge a partnership and collaboration towards strengthening cyber data protection in the country.
The agreement was reached in Abuja on September 18, 2024, when Vincent Olatunji, national commissioner and chief executive officer of the NDPC, led a delegation of management staff on a courtesy visit to Ola Olukoyede, EFCC chairman, at the commission’s corporate headquarters.
Despite partnering with Nigeria’s data protection regulator, the EFCC still has no privacy policy on its website.
At press time, the EFCC met none of the privacy policy requirements stipulated by both NITDA guidelines and the NDPA 2023.
