2.9 ADVANCEMENT OF RIGHT TO PRIVACY
Notwithstanding anything to the contrary in this Regulation, the privacy right of a Data
Subject shall be interpreted for the purpose of advancing and never for the purpose of
restricting the safeguards the Data Subject is entitled to under any data protection
instrument made in furtherance of fundamental rights and the Nigerian laws.
2.10 PENALTY FOR DEFAULT
Any person subject to this Regulation who is found to be in breach of the data
privacy rights of any Data Subject shall be liable in addition to any other criminal
liability, the following:
a) in the case of a Data Controller dealing with more than 10,000 Data Subjects,
payment of the fine of 2% of Annual Gross Revenue of the preceding year or
payment of the sum of 10 million naira whichever is greater;
b) in the case of a Data Controller dealing with less than 10,000 Data Subjects,
payment of the fine of 1% of the Annual Gross Revenue of the preceding year or
payment of the sum of 2 million naira whichever is greater.
2.11 TRANSFER TO A FOREIGN COUNTRY
Any transfer of personal data which are undergoing processing or are intended for
processing after transfer to a foreign country or to an international organisation shall
take place subject to the other provisions of this Regulation and the supervision of
the Honourable Attorney General of the Federation (HAGF). Accordingly:
a) a transfer of personal data to a foreign country or an international
organisation may take place where the Agency has decided that the
foreign country, territory or one or more specified sectors within that
foreign country, or the international organisation in question ensures an
adequate level of protection;
b) the HAGF shall take into consideration the legal system of the foreign
country particularly in the areas of rule of law, respect for human rights
and fundamental freedom, relevant legislation, both general and sectoral,
11