The Nigeria Data Protection Commission (NDPC), has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations of unlawful use of students’ personal data to open bank accounts.
The investigation followed public complaints alleging that students’ personal information was used to create bank accounts without a lawful basis or adequate consent.
The National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, has directed the investigation team to conduct a comprehensive assessment of how the affected students’ personal data was collected, processed and disclosed, as well as the roles and responsibilities of the institutions and company involved.
The Commission said the investigation would also determine the extent to which the parties complied with their obligations under the Nigeria Data Protection Act, 2023 (NDP Act), and assess potential risks to the rights and freedoms of the affected data subjects.
According to the NDPC, the forensic probe will cover several areas, including Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of credit scoring or profiling activities, and the use of automated decision-making systems.
It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation and purpose limitation principles, retention policies, as well as the technical and organisational measures put in place to safeguard data subjects’ rights.
The Commission stressed that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.
The NDPC therefore warned educational institutions that have yet to comply with its existing data protection compliance directives to take immediate steps to achieve compliance.
The Commission said the warning was necessary to ensure that educational institutions adequately protect the personal information in their custody and prevent practices that could expose students and other data subjects to privacy risks.
