Key Points
- NDPC begins forensic investigation into UNILAG, Lotus Bank and Hackerbella Ltd.
- Probe follows complaints over alleged unauthorised use of students’ personal data.
- Commission will examine data processing, profiling, privacy notices and safeguards.
- NDPC warns educational institutions to comply with data protection requirements.
Main Story
The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd. over alleged breaches of Nigeria’s data protection laws.
The commission’s Head of Legal, Enforcement and Regulations, Mr Babatunde Bamigboye, disclosed this in a statement on Wednesday in Abuja.
He said the investigation was triggered by complaints alleging that students’ personal information was used to open bank accounts without a lawful basis.
According to Bamigboye, NDPC National Commissioner, Dr Vincent Olatunji, directed investigators to establish how the students’ information was collected, processed and disclosed, as well as determine the responsibilities of the organisations involved.
He said the investigation would assess the compliance of the parties with the Nigeria Data Protection Act, 2023, while also examining possible risks to the rights and freedoms of the affected students.
Bamigboye said investigators would review several aspects of the alleged data processing, including the use of personal information for credit scoring or profiling and any automated decision-making involved.
The probe will also examine whether the organisations provided adequate privacy notices, had valid grounds for sharing and processing personal information, observed data minimisation and purpose limitation requirements, and maintained appropriate retention policies and security measures.
He stressed that institutions handling the personal information of students, employees and other members of their communities were required to process such data lawfully, transparently and securely.
Bamigboye also urged educational institutions that had not complied with existing NDPC data protection directives to take the necessary steps to meet their obligations.
He said effective compliance was necessary to protect data subjects and promote responsible handling of personal information across the education sector.
The Issues
The investigation centres on allegations that students’ personal information may have been used to open bank accounts without a lawful basis. The outcome of the probe is expected to establish how the data were obtained and processed, the responsibilities of the parties involved and whether applicable data protection requirements were followed.
What’s Being Said
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.” – Babatunde Bamigboye, Head, Legal, Enforcement and Regulations, NDPC
“Institutions entrusted with the personal data of students, staff and other members of their communities” have a responsibility to ensure the information is processed lawfully, fairly, transparently and securely. – Babatunde Bamigboye, NDPC
What’s Next
The NDPC will continue its forensic assessment of the three organisations, including their data-processing practices and compliance with the Nigeria Data Protection Act. Educational institutions yet to meet existing data protection directives are also expected to take corrective steps.
Bottom Line
The NDPC investigation will determine whether students’ personal data were unlawfully processed or shared and whether UNILAG, Lotus Bank and Hackerbella Ltd. complied with Nigeria’s data protection requirements.
 has launched a forensic investigation into the University of Lagos (UNILAG), ...){kind=link}