NDPC Launches Investigation into UNILAG, Lotus Bank, Hackerbella for Misuse of Student Data

The Nigeria Data Protection Commission (NDPC) has started an investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd. This follows complaints from the public about the alleged use of students’ personal data to open bank accounts without proper permission.

The NDPC announced this investigation in a statement signed by Babatunde Bamigboye, the Head of Legal, Enforcement and Regulations, on Wednesday.

Vincent Olatunji, the National Commissioner and Chief Executive Officer of the NDPC, has instructed the investigation team to thoroughly check how the affected students’ data was collected, used, and shared.

The investigation will also look into the roles and responsibilities of each party involved, as stated by the NDPC. It is important to find out who did what in this issue.

Mr. Olatunji also told the team to check if the involved parties are following the data protection rules set out in the Nigeria Data Protection Act, 2023 (NDP Act). They need to see what risks this situation brings to the rights of the affected students.

Among other things, the investigation will look at Data Protection Impact Assessments (DPIAs). It will check if any credit-scoring or profiling activities are lawful and transparent. The use of automated decision-making systems and the adequacy of privacy notices will also be reviewed.

The assessment will cover data-sharing agreements. It will check if there are lawful reasons for processing data, if data minimization is being followed, and if there are clear policies on how long data is kept. Most importantly, it will look at whether there are proper measures to protect the rights of those whose data is involved.

“The NDPC reiterates that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely,” the statement said.

NDPC has also warned Nigerian universities and other educational institutions that have not complied with its existing data protection guidelines to do so immediately.