The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations that students’ personal data were used to open bank accounts without a lawful basis.
The investigation followed public complaints alleging the unauthorised collection and use of students’ personal information in connection with the opening of bank accounts.
In a statement signed by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, the Commission said its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, had directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, processing and disclosure of the affected students’ personal data.
The investigation will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged processing of the data.
Olatunji further directed the team to assess the parties’ broader data protection compliance obligations under the Nigeria Data Protection Act, 2023 (NDP Act), as well as the potential risks the alleged processing may pose to the rights and freedoms of the affected data subjects.
According to the Commission, the investigation will examine several aspects of the data processing activities, including Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of credit scoring and profiling, the use of automated decision-making systems, the adequacy of privacy notices and data-sharing arrangements.
The probe will also assess the lawful bases for processing, compliance with the principles of data minimisation and purpose limitation, data retention policies, and the adequacy of technical and organisational measures put in place to safeguard data subjects’ rights.
The NDPC stressed that institutions entrusted with the personal data of students, staff and other members of their communities bear a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.
The Commission consequently warned educational institutions that have yet to comply with its existing data protection compliance directives to take immediate steps to achieve compliance.
The investigation underscores the NDPC’s increasing scrutiny of how institutions and private-sector organisations collect, share and use personal data, particularly where such practices may affect the privacy rights and freedoms of individuals.