NDPC Probes UNILAG, Lotus Bank, Hackerbella Over Alleged Students’ Data Misuse
The Nigeria Data Protection Commission, NDPC, has commenced a forensic investigation into the University of Lagos, UNILAG, Lotus Bank and technology firm Hackerbella Limited over allegations surrounding the unlawful use of students’ personal data.
The investigation follows public complaints alleging that the personal information of some students was used to open bank accounts without a lawful basis or proper authorisation.
According to the NDPC, the probe was ordered by its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, with the investigation team directed to establish exactly how the students’ information was collected, processed, shared and allegedly used.
The Commission said the investigation will also determine the specific roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged data processing and assess whether their actions complied with the Nigeria Data Protection Act, 2023.
WHAT THE INVESTIGATION WILL EXAMINE
The NDPC said its forensic investigation will cover several critical areas, including whether proper Data Protection Impact Assessments were carried out and whether students were adequately informed about how their personal information would be used.
The Commission will also examine the legality and transparency of any credit scoring or profiling activities, the use of automated decision-making systems, privacy notices, data-sharing arrangements and the legal basis for processing the students’ information.
Other areas include data minimisation, purpose limitation, retention policies and the technical and organisational measures put in place to protect the rights of the affected students.
WHY THE CASE MATTERS
The development has raised fresh concerns about the protection of students’ personal information, particularly as universities and financial institutions increasingly rely on digital systems to collect and process sensitive data.
Personal information such as names, identification details, contact information and other student records can expose individuals to financial fraud, identity theft and other risks when handled improperly.
The NDPC stressed that institutions entrusted with the personal information of students, staff and members of their communities have a heightened responsibility to ensure that such information is handled lawfully, fairly, transparently and securely.
The Commission has consequently warned educational institutions that have not complied with its existing data-protection directives to take immediate steps toward compliance.
For now, the NDPC says the investigation is ongoing, meaning the allegations have not yet been finally determined. The outcome of the forensic probe is expected to clarify what happened to the students’ data, who was responsible for each stage of its processing, and whether any provisions of Nigeria’s data-protection law were violated.