The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd following allegations of data protection violations.
The probe was triggered by public complaints alleging that UNILAG students’ personal data was used to open bank accounts without a lawful basis.
In response, NDPC National Commissioner Dr. Vincent Olatunji ordered a comprehensive assessment to determine how the students’ information was collected, used, and shared, as well as to clarify the specific roles played by each entity.
Key Focus Areas of the Investigation
According to Babatunde Bamigboye, the NDPC’s Head of Legal, Enforcement, and Regulations, the investigation will evaluate the parties’ overall compliance under the Nigeria Data Protection Act, 2023 (NDP Act).
The commission’s review will specifically cover:
Lawfulness and Transparency: Verifying the lawful bases for processing, privacy notice adequacy, and data-sharing agreements.
Profiling and Automation: Assessing any credit scoring, profiling activities, or automated decision-making systems used.
Risk and Safeguards: Reviewing Data Protection Impact Assessments (DPIAs), technical and organizational safeguards, data minimization, purpose limitation, and retention policies.
“Institutions entrusted with the personal data of students, staff, and community members must ensure that such data is processed lawfully, fairly, transparently, and securely, “Babatunde Bamigboye, Head of Legal, Enforcement, and Regulations, said.
Warning to Educational Institutions
The NDPC issued a stern warning to educational institutions that have yet to comply with existing data protection directives, urging them to do so immediately.
The regulator emphasised that strict adherence to data protection laws is essential for protecting individuals’ rights and fostering responsible data governance across Nigeria’s education sector.
