NDPC Probes UNILAG, Lotus Bank, Hackerbella Over Alleged Student Data Misuse
By Stella Enenche, Abuja
The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws involving students’ personal information.
NDPC’s Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed this on Tuesday in a statement.
TheFact Daily gathered that the investigation followed public complaints alleging that students’ personal data were used to open bank accounts without a lawful basis or adequate authorisation.
Consequently, the National Commissioner of the NDPC, Dr Vincent Olatunji, has directed the investigation team to conduct a comprehensive assessment of how the affected students’ personal data were collected, processed, used and disclosed, as well as the roles played by the three organisations.
The Commission said the investigation would also determine whether the parties complied with their obligations under the Nigeria Data Protection Act, 2023, and assess potential risks to the rights and freedoms of the affected students.
According to the NDPC, the probe will cover issues including Data Protection Impact Assessments, the lawfulness and transparency of credit scoring and profiling activities, automated decision-making systems, privacy notices and data-sharing arrangements.
It will also examine the lawful basis for processing the data, data minimisation and purpose limitation principles, retention policies, as well as the adequacy of technical and organisational safeguards put in place to protect data subjects.
The Commission said the investigation was aimed at establishing the facts surrounding the alleged processing of the students’ personal information and determining whether any provisions of the data protection law had been breached.
Olatunji stressed the importance of accountability by institutions that handle the personal information of students and other members of the public.
The NDPC warned that educational institutions entrusted with students’ and staff members’ personal data must ensure that such information is handled in accordance with the law.
The Commission said, “Institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely.”
It further warned educational institutions that had yet to comply with its existing data protection compliance directives to take immediate steps to regularise their compliance status.
The Commission said the warning was necessary to ensure that educational institutions did not expose students, staff and other data subjects to unnecessary risks through unlawful or insecure processing of personal information.
The NDPC maintained that compliance with the Nigeria Data Protection Act was not optional for institutions and organisations processing personal data, stressing the need for appropriate safeguards to protect individuals’ rights.
