The National Identity Management Commission (NIMC), has restricted its licensed agents’ access to the National Identification Number (NIN) database following an ongoing investigation of an incidence of unauthorized access by expressverify.com
This was disclosed in a statement released on Friday by the Nigeria Data Protection Commission (NDPC) which is investigating the incidence of data breach at NIMC.
According to NDPC, the ongoing investigation has revealed that a third party which, among others, was originally authorized to provide verification services to citizens and genuine businesses might have allowed expressverify.com to use its NIN verification credentials to conduct verification.
Limited access for education, security purposes
While noting that the circumstances surrounding this permission are still under investigation, the Commission in a statement Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, said:
- “To remedy this incident, the National Identity Management Commission (NIMC), in line with established remediation protocols, barred all forms of access to its database.
- “Though necessary, barring all forms of access affected all genuine and crucial verification requests.
- “After a painstaking review, limited access has been granted to a few establishments that are providing pivotal public services such as education and security.”
The investigation
The NDPC added that the ongoing investigation by relevant agencies seeks to establish the medium through which expressverify.com obtained the credentials of bona fide third parties and to determine the liability of persons involved in line with extant laws.
- “At the moment, data processing by licensees generally are to be scrutinized and only those that are cleared based on credible evidence of regulatory compliance will be permitted to carry out NIN verification going forward.”
- “Furthermore, a series of intensive training will be conducted to ensure that personnel and licensees are abreast of the duty of care and the standard of care mandated by the Nigeria Data Protection Act, NIMC’s Privacy Policy, and other relevant regulatory protocols,” it said.
The NDPC calls on members of the public to see NIN as essential data for sustainable development. According to the Commission, while existing technical and organizational measures are being strengthened to ensure the protection of this data, citizens need to ensure that they are not left unidentified in various frameworks for development.
The back story
The National Commissioner of the Commission of the NDPC, Dr. Vincent Olatunji, had earlier this month ordered a full-scale investigation in the wake of public concerns over reports of illegal access to personal data of enrollees by a shadowy entity called XpressVerify.com.
The Commission added that NIMC had also initiated an internal investigation and gave full assurances of cooperation with NDPC to get to the root of the allegation and to review existing mediums through which any entity may lawfully verify the identity of enrollees on its platform.
The NDPC said it would work with relevant agencies to audit the trails of the alleged unauthorized data processing and monetization of same, and those who are found culpable for violating the Nigeria Data Protection Act, 2023 would be brought to justice.
Earlier, an FIJ in a report had alleged that expressverify.com, a private website, has unrestricted access to the National Identification Numbers (NINs) and personal details of every registered Nigerian. It added that the website has monetized the recovery of NINs and personal information on the Nigerian identification database.
