The social media giant has been given a $220m fine by the Nigerian government after findings of “multiple and repeated” violations of data protection and consumer rights laws relating to Facebook and WhatsApp.

The alleged abuse came into light in May 2021, after an investigation into WhatsApp’s updated privacy policy.

“WhatsApp violated the rights of its users by introducing its Updated Privacy Policy, in a manner that is a clear departure from regulatory provisions governing consent freely obtained, and consent withdrawal,” the Federal Competition and Consumer Protection Commission (FCCPC) said.

The investigation, which was a joint collaboration with the Nigeria Data Protection Commission, also showed that Nigerian users were discriminated against by having their data illegally transferred outside the country without the requisite permit.

Multiple violations

According to FCCPC, Meta was found demonstrating abusive, and “unscrupulous business practices” against Nigerian users when Meta:

• denied Nigerians the right to self-determine use of data;
• shared data outside the country without authorization;
• showcased discriminatory practices or disparate treatment against Nigerian users;
• abused dominant market position “by forcing unscrupulous, exploitative, and non-compliant privacy policies”; and
• implemented its practices around tying and bundling.

The repeated violations allegedly contravened sections 17, 18, 32, 70, 71, 72, 108, 112, 119, 124, 127, and 155 of the Federal Competition and Consumer Protection Act 2018 (FCCPA) and regulations 1.2, 1.3, 2.1, 2.11, 2.2, 2.3, 2.5, and 3.1 of the Nigeria Data Protection Regulation 2019 (NDPR).

Stop orders on Meta

During the investigation, the FCCPC noted that “WhatsApp was prepared to cooperate with the Commission to “identify and implement practical solutions to address the concerns.”

However, the FCCPC didn’t find Meta’s proposed remedy package satisfied all its concerns, and therefore imposed the $220m fine.

“The Final Order of the Commission mandates steps and actions Meta Parties must take to comply with prevailing law and cease the exploitation of Nigerian consumers and their market abuse.”

Dr. Adamu Abdullahi, Ag. Executive Vice Chairman/Chief Executive Officer, FCCPC

Besides the fine, the Final Order also ordered Meta to immediately:

• reinstate the rights of Nigerian users to self-determine the control and usage of data without losing functionality or deleting the application;
• set its Privacy Policy to comply with data protection laws in Nigeria;
• stop sharing WhatsApp user’s information with other Facebook companies and third parties (until users have actively and voluntarily consented to such);
• revert to the data sharing practices adopted in 2016, including establishing an opt-in screen to allow users to consent to or withhold consent for sharing additional personal data with third parties affiliated with WhatsApp; and
• cease the tying and transfer of data from its WhatsApp market to its Facebook market, and other third parties’ services without consent.

Meta was also required to provide satisfactory Written Assurances to refrain from continuing violating the FCCPA, and ordered to reimburse the FCCPC $35,000 for the cost of the investigation.

“The Final Order of the Commission mandates steps and actions Meta Parties must take to comply with prevailing law and cease the exploitation of Nigerian consumers and their market abuse, as well as desist from future similar or other conduct/practices that do not meet nationally applicable standards and undermine the rights of consumers,” said Dr Adamu Abdullahi, Ag. Executive Vice Chairman/Chief Executive Officer, FCCPC.