The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd, following public complaints allegin
The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd, following public complaints alleging that students’ personal data was used to open bank accounts without a lawful basis.
In a press release dated 11 August and signed by Babatunde Bamigboye, the commission’s Head of Legal, Enforcement and Regulations, the NDPC said National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, had directed the investigation team to undertake a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
The commission said the probe will examine the roles and responsibilities of each of the three parties involved, alongside their general compliance obligations under the Nigeria Data Protection Act, 2023. Specific areas under review include Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.
The investigation will also assess the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and the technical and organisational safeguards in place for data subjects’ rights, the NDPC said. It added that the probe would evaluate the potential risks posed to the rights and freedoms of the affected students.
The commission said institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure such data is processed lawfully, fairly, transparently and securely.
Read also: NDPC and Meta launch major data protection program to strengthen privacy in Nigeria
“Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the commission said in the statement.
UNILAG, Lotus Bank and Hackerbella Ltd have not issued public responses to the allegations.
