The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.
The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed this in a statement issued on Wednesday in Abuja.
According to Bamigboye, the investigation followed public complaints alleging that the personal data of some students were used to open bank accounts without a lawful basis.
He said the National Commissioner of the NDPC, Vincent Olatunji, had directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, processing, use and disclosure of the affected students’ personal information.
The probe will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged processing of the students’ data.
Bamigboye said the investigation would assess the level of compliance of the three institutions with their obligations under the Nigeria Data Protection Act, 2023.
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” he said.
He added that the investigation would examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policies, as well as the technical and organisational safeguards put in place to protect data subjects’ rights.
The commission will also assess potential risks posed to the rights and freedoms of the affected students.
Bamigboye stressed that institutions entrusted with the personal data of students, staff and other members of their communities have a responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.
He further warned educational institutions that have yet to comply with the NDPC’s existing data protection directives to take immediate steps towards compliance.
According to him, adherence to data protection regulations is essential to safeguarding the rights and freedoms of data subjects and promoting responsible data governance within Nigeria’s education sector.
The investigation is expected to establish how the students’ personal information was obtained and processed, whether appropriate consent or another lawful basis existed, and whether the institutions involved complied with the requirements of the Nigeria Data Protection Act.
