Photo caption: University of Lagos entrance. Photo: UNILAG
The Nigeria Data Protection Commission has commenced a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.
The commission disclosed this in a statement signed on Tuesday by Babatunde Bamigboye, its Head of Legal, Enforcement and Regulations, and posted on its X handle on Wednesday.
The statement read, “The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd following public complaints alleging the use of students’ personal data to open bank accounts without a lawful basis.”
The National Commissioner and Chief Executive Officer of the commission, Dr Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
The team will also examine the roles and responsibilities of the parties involved, as well as their compliance with the Nigeria Data Protection Act, 2023.
The commission said, “The investigation will, among others, cover Data Protection Impact Assessments (DPIAs); the lawfulness and transparency of any credit scoring or profiling activities; the use of automated decision-making systems; the adequacy of privacy notices; data-sharing arrangements; lawful bases for processing; data minimisation; purpose limitation; retention policy; and appropriate technical and organisational safeguards for data subjects’ rights.”
It added that investigation would also assess the potential risks posed to the rights and freedoms of the affected students.
The NDPC reiterated that institutions entrusted with students’, staff members’ and other members of their communities’ personal data have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely.
“Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the commission said.
The commission said the investigation was ongoing.
