The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd following public complaints alleging the use of students’ personal data to open bank accounts without a lawful basis.
Investigation Triggered by Public Complaints
The investigation was disclosed in a statement signed by the commission’s Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, on Wednesday. According to the statement, Vincent Olatunji, the National Commissioner and Chief Executive Officer of the Commission, directed the investigation team to undertake a comprehensive assessment of the circumstances surrounding the collection, use, and disclosure of the affected students’ personal data.
Scope of the Forensic Investigation
The investigation also aims to assess the roles and responsibilities of each party involved, according to NDPC. Mr Olatunji also directed the investigation team to assess the general data protection compliance obligations of the parties in line with the provisions of the Nigeria Data Protection Act, 2023 (NDP Act), and the potential risks posed to the rights and freedoms of the affected data subjects.
The investigation will, among other things, cover Data Protection Impact Assessments (DPIAs); the lawfulness and transparency of any credit-scoring or profiling activities; the use of automated decision-making systems; and the adequacy of privacy notices. It will also cover the assessment of data-sharing arrangements; lawful bases for processing; data minimisation; purpose limitation; retention policy; and appropriate technical and organisational safeguards for data subjects’ rights.
NDPC’s Warning to Educational Institutions
“The NDPC reiterates that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely,” the statement read. NDPC further warned Nigerian tertiary schools and other educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately.
The commission’s action underscores its commitment to enforcing the NDP Act and protecting the rights of data subjects in Nigeria. The outcome of the investigation could lead to sanctions or corrective measures against the parties involved if violations are found.
