The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd following public outcry over the alleged unauthorised use of students’ personal data to open bank accounts.
According to a statement issued on Tuesday by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations, and published on X on Wednesday, the probe follows formal complaints regarding potential breaches of data privacy laws.
The National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, has ordered investigators to thoroughly evaluate how the affected students’ information was gathered, processed, and shared. The inquiry will scrutinise each entity’s role and measure their compliance with the Nigeria Data Protection Act 2023.
Investigators will examine several key areas, including Data Protection Impact Assessments (DPIAs), privacy notices, data-sharing protocols, retention schedules, automated decision-making, and credit profiling transparency. The commission will also evaluate data minimisation practices and technical safeguards put in place to protect the rights and freedoms of data subjects.
The regulator issued a strict warning: “Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately.” The commission confirmed that the investigation remains ongoing.