By Ayo Kehinde The University of Lagos UNILAG, is in the center of a major data privacy breach after the Nigeria Data Protection Commission (NDPC) announced a forensic investigation into the institution, Lotus Bank and Hackerbella Ltd over allegations that students’ personal information was used to open bank accounts without their lawful consent.
The commission disclosed on Wednesday that the investigation was triggered by public complaints alleging that sensitive personal data belonging to students were processed without a lawful basis, raising concerns over possible violations of the Nigeria Data Protection Act (NDPA), 2023.
Announcing the development in Abuja, the NDPC’s Head of Legal, Enforcement and Regulations, Mr Babatunde Bamigboye, said the National Commissioner and Chief Executive Officer of the commission, Vincent Olatunji, had constituted an investigation team to conduct a comprehensive forensic assessment of the allegations.
According to Bamigboye, the exercise will establish the circumstances surrounding the collection, processing, use and disclosure of the affected students’ personal information, while determining the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged data processing activities.
He explained that investigators would also evaluate whether the organisations complied with their obligations under the Nigeria Data Protection Act, particularly regarding the lawful handling of personal information entrusted to them.
“The investigation will assess the general data protection compliance obligations of the parties in line with the Nigeria Data Protection Act, 2023, and examine any potential risks posed to the rights and freedoms of the affected data subjects”, Bamigboye said.
The commission stated that the probe would extend beyond the immediate allegations to examine whether mandatory Data Protection Impact Assessments (DPIAs) were conducted before the processing activities commenced.
It added that investigators would scrutinise the lawfulness and transparency of any credit scoring or profiling activities, as well as the deployment of automated decision-making systems that may have been used during the processing of students’ personal information.
The NDPC further disclosed that the investigation would review the adequacy of privacy notices issued to students, the existence and legality of data-sharing arrangements among the parties, the lawful basis relied upon for processing personal data, compliance with the principles of data minimisation and purpose limitation, retention policies and the technical and organisational measures put in place to protect the rights of data subjects.
The commission noted that the findings would help determine whether the processing activities exposed affected students to privacy risks or infringed on their legally protected rights under Nigeria’s data protection framework.
Reiterating the obligations of educational institutions, Bamigboye stressed that universities and other schools entrusted with the personal information of students, staff and members of their communities must ensure such data are processed lawfully, fairly, transparently and securely.
He warned institutions that have yet to comply with existing NDPC data protection directives to do so without delay, emphasising that compliance with the law is critical to safeguarding individual privacy rights and promoting responsible data governance within Nigeria’s education sector.
The Nigeria Data Protection Act, 2023 established the Nigeria Data Protection Commission as the country’s primary regulator responsible for protecting the privacy rights of individuals and enforcing compliance with data protection obligations across public and private institutions. The law requires organisations to process personal information only on recognised lawful grounds, implement adequate security safeguards, maintain transparency and ensure that personal data are collected only for legitimate purposes.
