The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations that students’ personal data were used to open bank accounts without a lawful basis.
The Commission said the investigation followed complaints concerning the collection, use and disclosure of students’ personal information. It said the probe would establish the respective roles and responsibilities of the institutions involved in the alleged processing of the data.
The NDPC said its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, directed the investigative team to conduct a comprehensive assessment of the circumstances surrounding the alleged processing of the students’ personal information.
According to the Commission, the investigation will determine whether the parties complied with their obligations under the Nigeria Data Protection Act, 2023, while also assessing the potential risks the alleged activities may have posed to the rights and freedoms of the affected students.
Among the issues to be examined are whether appropriate Data Protection Impact Assessments were carried out, the lawfulness and transparency of any credit-scoring or profiling activities, the use of automated decision-making systems and the adequacy of privacy notices provided to students.
Investigators will also scrutinise data-sharing arrangements between the parties, the lawful bases relied upon for processing students’ information, compliance with the principles of data minimisation and purpose limitation, data-retention policies, and the technical and organisational safeguards deployed to protect the information.
The NDPC said the investigation would go beyond determining how the students’ personal data were obtained and used. It would also establish which of the parties exercised control over the processing and whether appropriate consent or other lawful grounds existed for the activities.
The Commission stressed that educational institutions and other organisations entrusted with sensitive personal information have a heightened responsibility to ensure that such data are processed lawfully, fairly, transparently and securely.
It consequently urged educational institutions that have yet to comply with existing data protection directives to do so immediately.
The NDPC reiterated that the Nigeria Data Protection Act places obligations on institutions handling personal information to protect data subjects against unlawful processing, excessive collection, unauthorised disclosure and other practices capable of undermining their privacy rights.
The Commission said it remained committed to enforcing the provisions of the Act and ensuring that the rights of students, staff and other data subjects are adequately protected.
The investigation is expected to determine whether any violations occurred and, if breaches are established, the appropriate regulatory measures to be taken against those responsible.