NDPC probes UNILAG, Lotus Bank, Hackerbella over alleged student data misuse
Nigeria Data Protection Commission NDPC
Abdullateef Fowewe
The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and technology firm Hackerbella Ltd following public complaints that students’ personal data were used to open bank accounts without a lawful basis.
The probe, directed by NDPC National Commissioner and Chief Executive Officer Dr Vincent Olatunji, will according to the statement obtained from the commission on Wednesday undertake a “comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data, including the roles and responsibilities of each of the parties involved.”
According to the commission’s statement, the investigation will assess compliance obligations under the Nigeria Data Protection Act, 2023, and evaluate “potential risks posed to the rights and freedoms of the affected data subjects.”
Key areas under review include, Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, the use of automated decision-making systems, adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights.
The commission said the exercise is aimed at establishing the facts around the alleged processing of the students’ information and determining whether any provisions of the data protection law were breached.
In its warning to the education sector, the NDPC reiterated that institutions “entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely.”
The regulator cautioned that “educational institutions that are yet to comply with its existing data protection compliance directives” must do so immediately, underscoring intensified oversight of how student and community data are handled.
The investigation is ongoing, and the commission has not yet established wrongdoing by UNILAG, Lotus Bank, or Hackerbella.
