The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbell Ltd over allegations that students’ personal data were used to open bank accounts without a lawful basis.
The investigation follows public complaints concerning the alleged collection and use of students’ personal information in connection with the opening of bank accounts.
The NDPC said its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed an investigation team to establish the circumstances surrounding the collection, processing and disclosure of the affected students’ personal data.
The investigation will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbell a Ltd in the alleged data processing.
Scope of Probe
According to the Commission, investigators will assess the three organisations’ compliance obligations under the Nigeria Data Protection Act, 2023, as well as the potential risks the alleged processing may have created for the rights and freedoms of the affected students.
The probe will cover a range of data protection issues, including whether appropriate Data Protection Impact Assessments were conducted and whether there was a lawful basis for processing the students’ information.
The NDPC said it would also examine the lawfulness and transparency of any credit-scoring or profiling activities, the use of automated decision-making systems, the adequacy of privacy notices and the arrangements governing the sharing of personal data.
Other areas of scrutiny include compliance with the principles of data minimisation and purpose limitation, retention policies and the technical and organisational safeguards put in place to protect data subjects’ rights.
The investigation could have wider implications for universities, banks and technology companies involved in processing students’ personal information, particularly where such information is subsequently used for financial services, profiling or other purposes beyond the original reason for which it was collected.
The Commission stressed that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.
The NDPC consequently warned educational institutions that have yet to comply with its existing data protection compliance directives to take immediate steps to achieve compliance.
