MTN Eswatini
Enforcement notice issued; warning imposed. EDPA, June 2024.
The facts
MTN Eswatini reported a personal data breach to the Eswatini Data Protection Authority on 27 February 2024: a customer, a dressmaker in Manzini, had complained on 5 February 2024 that her Mobile Money statement was shared with a third party without her consent through the company's outsourced call centre. The third party used the statement in a debt matter that saw the customer summoned to a police station. The EDPA found the organisation had failed to secure the integrity and confidentiality of personal information and to take reasonable measures to identify risks and maintain, verify and update safeguards.
Orders and outcome
The EDPA imposed a warning on MTN and issued an enforcement notice valid for one year, conditional on MTN not committing the same or a similar breach in that period. MTN was directed to conduct a data protection impact assessment for the call centre, password-protect personal data shared via WhatsApp, document its processes and call-centre scripts, train call centre agents regularly with attendance registers kept as evidence, introduce an agent onboarding programme, and update its communication policy on third-party requests. Dated June 2024.
Cite this decision
Track Eswatini enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.