NDPC begins forensic probe of UNILAG, Lotus Bank, Hackerbella over alleged unlawful use of students’ data

The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd following public complaints alleging the use of students’ personal data to open bank accounts without a lawful basis.

The investigation was disclosed in a statement signed by the commission’s Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, on Wednesday.

According to the statement, Vincent Olatunji, the National Commissioner and Chief Executive Officer of the Commission, directed the investigation team to undertake a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.

The investigation also aims to assess the roles and responsibilities of each party involved, according to NDPC.

Mr Olatunji also directed the investigation team to assess the general data protection compliance obligations of the parties in line with the provisions of the Nigeria Data Protection Act, 2023 (NDP Act), and the potential risks posed to the rights and freedoms of the affected data subjects.

The investigation will, among other things, cover Data Protection Impact Assessments (DPIAs); the lawfulness and transparency of any credit-scoring or profiling activities; the use of automated decision-making systems; and the adequacy of privacy notices.

READ ALSO: NDPC, Meta launch initiative to strengthen data protection in Nigeria

It will also cover the assessment of data-sharing arrangements; lawful bases for processing; data minimisation; purpose limitation; retention policy; and appropriate technical and organisational safeguards for data subjects’ rights.

“The NDPC reiterates that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely,” the statement read.

NDPC further warned Nigerian tertiary schools and other educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately.