The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and technology company Hackerbella Ltd over allegations that students’ personal information was used to open bank accounts without their knowledge or legal consent.
The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed this on Wednesday in Abuja.
According to Bamigboye, the National Commissioner of the NDPC, Dr Vincent Olatunji, ordered a comprehensive investigation into how the affected students’ personal data was collected, processed and shared.
The investigation followed complaints from members of the public and will seek to determine the roles played by each organisation involved, as well as whether they complied with the Nigeria Data Protection Act 2023.
WHAT THE NDPC IS INVESTIGATING
The commission said its investigation will examine several aspects of data protection, including whether proper Data Protection Impact Assessments were conducted and whether students were adequately informed about how their information would be used.
It will also look into the legality and transparency of any credit scoring or profiling carried out using the students’ information, as well as the use of automated decision-making systems.
Other areas of concern include privacy notices, data-sharing arrangements, the legal basis for processing personal information, data minimisation, purpose limitation, data retention and the security measures put in place to protect students’ information.
Bamigboye stressed that organisations entrusted with personal data have a responsibility to ensure that such information is handled lawfully, fairly, transparently and securely.
He added that the UNILAG case forms part of the commission’s wider efforts to address data protection concerns within Nigeria’s education sector.
The NDPC also warned educational institutions that have yet to comply with existing data protection requirements to take the matter seriously, noting that compliance is essential to protecting the privacy and rights of students.
BROADER DATA PROTECTION EFFORTS
The investigation comes as the NDPC intensifies efforts to strengthen privacy protection in Nigeria amid the rapid growth of digital technology.
In March, the commission warned content creators against recording or photographing people without their knowledge or consent and publishing the material on social media.
In May, the NDPC also partnered with private-sector ICT companies to explore regulatory sandboxes for artificial intelligence and data protection.
By June, the commission had announced plans to review the Nigeria Data Protection Act 2023 to better address emerging technologies such as artificial intelligence, big data and robotics.
The latest investigation is another indication of the commission’s growing focus on how organisations collect, process and use Nigerians’ personal information.
The NDPC had earlier launched an investigation into an alleged data breach involving the Corporate Affairs Commission, further highlighting its increased enforcement of Nigeria’s data protection laws.
