The Nigeria Data Protection Commission (NDPC) said it has launched an investigation into an alleged privacy breach on the data of Nigerians through the National Identification Number (NIN) database managed by the National Identity Management Commission (NIMC).
According to a statement signed by the Head of Legal, Enforcement, and Regulations, at the NDPC, Babatunde Bamigboye, the National Commissioner of the Commission, Dr. Vincent Olatunji, ordered a full-scale investigation in the wake of public concerns over reports of illegal access to personal data of enrollees by a shadowy entity called XpressVerify.com.
Internal investigation
While noting that NIMC has also launched an investigation internally to unravel the allegations, the NDPC vowed to bring anyone found culpable to book.
- “We note that NIMC has initiated internal investigation, and it has immediately given full assurances of cooperation with NDPC to get to the root of the allegation and to review existing mediums through which any entity may lawfully verify the identity of enrollees on its platform.
- “Furthermore, NDPC will work with relevant agencies to audit the trails of the alleged unauthorized data processing and monetization of same, and those who are found culpable for violating the Nigeria Data Protection Act, 2023 will be brought to justice,” the NDPC stated.
According to the statement, the National Commissioner has further directed that preliminary findings of the investigation should be made public within seven days.
Recommended reading: Why banks are asking customers to renew BVN and NIN linkage
The allegations
The FIJ in a report published days ago had alleged that XpressVerify.com, a private website, has unrestricted access to the National Identification Numbers (NINs) and personal details of every registered Nigerian.
It added that the website has monetised the recovery of NINs and personal information on the Nigerian identification database.
- “FIJ has found that XpressVerify, a standalone website, has been managing and using information from the National Identity Database.
- “Anybody can retrieve details such as phone numbers, full names, NIN, address and photographs of any Nigerian whose data is on the National Identity Database with as low as N200.
- “The website does not confirm what type of person can check what type of information. There were no restrictions to the number of NIN-related data that could be fetched when FIJ checked.
- “Vendors across different Nigerian cities have been checking the NINs and phone numbers of citizens from the same database NIMC ought to maintain and keep secure,” FIJ alleged in the report.
Section 14 of the NIMC Act 2007 mandates NIMC to be the body that creates, manages, maintains and operates the National Identity Database.