The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG) and Lotus Bank over alleged misuse of students’ personal data to open bank accounts without a lawful basis.
The investigation also involves Hackerbella Ltd and is aimed at determining the circumstances surrounding the collection, use and disclosure of the affected students’ personal data, as well as the roles and responsibilities of each of the parties involved.
In a statement issued on Wednesday, the Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, said the National Commissioner and Chief Executive Officer of the Commission, Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the alleged data processing activities.
He said the probe would establish whether the parties complied with the requirements of the Nigeria Data Protection Act, 2023, particularly in relation to the lawful collection, processing and disclosure of the students’ personal information.
Bamigboye noted that the investigation would also assess the potential risks posed to the rights and freedoms of the affected students, who are regarded as data subjects under the law.
According to the Commission, the investigation will cover the conduct of Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, as well as the use of automated decision-making systems.
The probe will examine the adequacy of privacy notices provided to the affected students, data-sharing arrangements among the parties, the lawful basis for processing the information, data minimisation and purpose limitation.
It will also assess the parties’ data retention policies and the adequacy of the technical and organisational safeguards put in place to protect the students’ personal information and uphold their data protection rights.
The Commission stressed that educational institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.
The NDPC therefore warned educational institutions that are yet to comply with its existing data protection compliance directives to take immediate steps to regularise their practices and ensure full compliance with the Nigeria Data Protection Act, 2023.
