The Nigeria Data Protection Commission has launched a forensic investigation into the University of Lagos, Lotus Bank and technology firm Hackerbella Ltd over allegations that students’ personal data were used to open bank accounts without their knowledge or a lawful basis.
The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed this on Wednesday in Abuja.
Bamigboye said the National Commissioner, Dr Vincent Olatunji, had ordered a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
He said the investigation followed public complaints and would establish the roles and responsibilities of all parties involved in the alleged processing of the data, while determining their compliance with the Nigeria Data Protection Act 2023.
Bamigboye said the investigation would examine a wide range of data governance issues to establish the extent of any violations and assess the risks posed to the affected students.
“The investigation will, among others, cover Data Protection Impact Assessments, the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” he said.
“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights.”
Bamigboye reiterated that institutions entrusted with personal data have a duty to ensure such information is processed lawfully, fairly, transparently and securely.
He said the UNILAG case was part of a wider pattern of non-compliance within the education sector that the commission was determined to address.
He also warned educational institutions that had yet to comply with existing NDPC data protection directives, stressing that compliance was necessary to protect the rights and freedoms of data subjects and promote responsible data governance across the sector.
The investigation will determine whether the bank accounts were opened using students’ personal data without a lawful basis, potentially violating the NDP Act’s requirements on consent, transparency and purpose limitation in data processing.
The probe comes as the NDPC intensifies efforts to strengthen data protection and safeguard Nigerians’ privacy rights amid the rapid expansion of digital technologies.
In March, the commission warned content creators against recording or photographing unsuspecting members of the public and sharing such content on social media without their consent.
The NDPC said such practices could breach citizens’ rights to privacy and data protection under Nigerian law.
