The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and technology company Hackerbella Ltd over allegations that students’ personal data were used to open bank accounts without their knowledge or a lawful basis.
The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed this on Wednesday in Abuja.
Bamigboye said the investigation was ordered by the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, following public complaints concerning the alleged misuse of students’ personal information.
According to him, the probe will establish the roles and responsibilities of the three organisations in the collection, processing and disclosure of the affected students’ data, as well as determine whether they complied with obligations under the Nigeria Data Protection Act 2023.
He said the investigation would also assess the wider data governance implications of the case and the potential risks posed to the affected students.
“The investigation will, among others, cover Data Protection Impact Assessments, the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” Bamigboye said.
He added that the commission would examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policies and the technical and organisational safeguards put in place to protect data subjects’ rights.
Bamigboye stressed that organisations entrusted with personal information have a responsibility to ensure that such data are processed lawfully, fairly, transparently and securely.
The NDPC official said the UNILAG case forms part of a broader effort by the commission to address data protection compliance gaps within Nigeria’s education sector.
He warned educational institutions that have yet to comply with existing NDPC directives to take their obligations seriously, noting that data protection compliance is essential to safeguarding the rights and freedoms of students and other data subjects.
The investigation will specifically determine whether students’ personal information was used to open bank accounts without a valid legal basis and whether the parties involved complied with requirements relating to consent, transparency and purpose limitation under the Nigeria Data Protection Act.
The commission’s probe is expected to establish whether any violations occurred and determine the appropriate regulatory response based on its findings.
