NDPC Launches Forensic Probe into UNILAG, Lotus Bank Over Alleged Student Data Misuse
The Nigeria Data Protection Commission (NDPC) has initiated a comprehensive forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd, citing allegations of significant data protection law violations. This action stems from public complaints asserting that students’ personal data was allegedly used to open bank accounts without the requisite lawful basis.
The investigation, directed by the National Commissioner of NDPC, Dr. Vincent Olatunji, aims to meticulously examine the circumstances surrounding the collection, utilisation, and disclosure of the affected students’ personal data. A dedicated investigation team has been tasked with determining the precise roles and responsibilities of each involved party in the alleged data processing activities.
According to a statement released by Mr. Babatunde Bamigboye, the Commission’s Head of Legal, Enforcement, and Regulations, the probe will rigorously assess the parties’ adherence to their general data protection compliance obligations as stipulated by the Nigeria Data Protection Act, 2023 (NDP Act). A key focus will be on evaluating the potential risks posed to the fundamental rights and freedoms of the data subjects.
The scope of the investigation is extensive, encompassing critical areas such as Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities undertaken, and the deployment of automated decision-making systems. Furthermore, the NDPC will scrutinise the adequacy of privacy notices, data-sharing agreements, the establishment of lawful bases for data processing, principles of data minimisation and purpose limitation, data retention policies, and the implementation of appropriate technical and organisational safeguards to protect data subjects’ rights.
Bamigboye underscored the profound responsibility incumbent upon institutions entrusted with the personal data of students, staff, and their wider communities. He emphasised that such entities must ensure data processing is conducted lawfully, fairly, transparently, and securely. The Commission also issued a stern warning to educational institutions that have yet to comply with existing data protection compliance directives, urging immediate adherence. The statement highlighted that robust compliance with data protection regulations is paramount for safeguarding individual rights and fostering responsible data governance, particularly within the education sector.
