ABUJA — The Nigeria Data Protection Commission (NDPC) has opened a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd following allegations that students’ personal information was used to create bank accounts without proper legal authorisation.
The commission said the investigation was launched after receiving complaints concerning the alleged collection and use of students’ personal data.
The NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed the development in a statement issued on Wednesday in Abuja.
He said National Commissioner Vincent Olatunji had directed investigators to establish how the students’ information was collected, processed and shared, as well as determine the responsibilities of each organisation involved.
Investigation to examine data practices
According to Bamigboye, the investigation will assess whether the organisations complied with their obligations under the Nigeria Data Protection Act 2023.
Investigators will examine the legal basis for processing the students’ information and whether affected individuals were adequately informed about how their data would be used.
The probe will also cover possible Data Protection Impact Assessments, credit scoring and profiling activities, automated decision-making systems and the adequacy of privacy notices.
Other areas under review include data-sharing arrangements, data minimisation, purpose limitation, retention periods and the technical and organisational safeguards put in place to protect personal information.
The commission said the investigation would also consider whether the alleged processing created risks to the rights and freedoms of the affected students.
NDPC warns educational institutions
Bamigboye stressed that institutions handling personal information belonging to students, employees and other members of their communities have a responsibility to protect such data.
He said personal information must be processed lawfully, fairly and transparently, while adequate security measures should be maintained to prevent misuse or unauthorised disclosure.
The NDPC also warned educational institutions that have yet to comply with existing data protection directives to take the necessary steps to meet their obligations.
The commission said stronger compliance within the education sector was necessary to protect individuals’ privacy rights and promote responsible handling of personal information.
The investigation into UNILAG, Lotus Bank and Hackerbella Ltd is expected to establish the circumstances surrounding the alleged opening of accounts and whether the parties involved breached provisions of Nigeria’s data protection law.
