The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.
The commission’s Head of Legal, Enforcement and Regulations, Mr Babatunde Bamigboye, disclosed this in a statement on Wednesday in Abuja.
Bamigboye said the investigation followed public complaints alleging that students’ personal data were used to open bank accounts without lawful basis.
He said the National Commissioner of NDPC, Dr Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
He added that the team would determine the roles and responsibilities of each party involved in the alleged data processing and assess their compliance obligations under the Nigeria Data Protection Act, 2023.
According to him, the investigation would also examine potential risks posed to the rights and freedoms of the affected data subjects.
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.
“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights,” he said.
Bamigboye reiterated that institutions entrusted with the personal data of students, staff and other members of their communities had a responsibility to ensure that such data were processed lawfully, fairly, transparently and securely.
He also warned educational institutions that were yet to comply with existing data protection directives to do so.
He emphasised that compliance with data protection regulations was essential to safeguarding the rights and freedoms of data subjects and promoting responsible data governance within the education sector.
