The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.
Babatunde Bamigboye, the commission’s head of legal, enforcement and regulations, disclosed this in a statement on Wednesday in Abuja.
Bamigboye said the investigation followed public complaints alleging that students’ personal data were used to open bank accounts without a lawful basis.
He said Vincent Olatunji, the National Commissioner of the NDPC, had directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
The probe will also determine the roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged processing of the data and assess their compliance with the Nigeria Data Protection Act, 2023.
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” Bamigboye said.
“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights.”
Bamigboye said the investigation would further examine potential risks posed to the rights and freedoms of the affected students.
He stressed that institutions entrusted with students’ and staff members’ personal data have a responsibility to ensure such information is processed lawfully, fairly, transparently and securely.
The NDPC official also urged educational institutions that had yet to comply with the commission’s existing data protection directives to do so.
He said compliance with data protection regulations was essential to protecting data subjects’ rights and freedoms and promoting responsible data governance in the education sector.
