Follow Us on Google Discover
The Nigeria Data Protection Commission has commenced a forensic investigation into the University of Lagos, Lotus Bank, and technology company Hackerbella Ltd over allegations that students’ personal data were used to open bank accounts without their knowledge or lawful basis.
The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed the investigation on Wednesday in Abuja.
Bamigboye said National Commissioner Dr. Vincent Olatunji had directed a comprehensive assessment of the circumstances surrounding the collection, use, and disclosure of the affected students’ personal data.
The investigation was triggered by public complaints and will determine the roles and responsibilities of each party involved in the alleged data processing, while assessing their compliance obligations under the Nigeria Data Protection Act 2023.
Also Read
What the NDPC is saying
Bamigboye said the investigation will cover a broad range of data governance issues to determine the full extent of any violations and the risks posed to affected students.
- “The investigation will, among others, cover Data Protection Impact Assessments, the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” he said.
- “It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights,” he added.
- He reiterated that institutions entrusted with personal data “had the responsibility to ensure that such data were processed lawfully, fairly, transparently and securely,” framing the UNILAG case as part of a broader pattern of non-compliance in the education sector that the commission intends to address.
Bamigboye also issued a warning to educational institutions yet to comply with existing NDPC data protection directives, emphasising that compliance was essential to safeguarding the rights and freedoms of data subjects and promoting responsible data governance across the sector.
The investigation will specifically examine whether the bank accounts were opened using students’ data without a lawful basis, which is a potential violation of the NDP Act’s requirements for consent, transparency, and purpose limitation in data processing.
Get up to speed
The investigation comes as the NDPC has stepped up efforts to strengthen data protection and preserve Nigerians’ privacy rights amid the rapid expansion of digital technologies.
- In March, the commission cautioned content creators against filming or photographing unsuspecting members of the public and sharing such content on social media without their consent. The NDPC said such practices could violate citizens’ rights to privacy and data protection under Nigerian law.
- Months later, in May, the commission partnered with private-sector ICT firms to explore adaptive regulatory sandboxes for artificial intelligence and data protection.
- The initiative sought to create controlled environments for testing AI technologies while supporting data-driven innovation and cross-border development.
- In June, the NDPC also announced plans to review the Nigeria Data Protection Act 2023 to account more explicitly for emerging technologies, including artificial intelligence, big data and robotics.
The moves point to the commission’s broader focus on ensuring that Nigeria’s data protection framework keeps pace with how personal data is collected, processed and used as digital technologies become more widespread.
What you should know
The NDPC probe follows an investigation launched in April into a reported data breach at the Corporate Affairs Commission.
The commission disclosed the CAC investigation in a statement signed by Bamigboye, citing provisions of the Nigeria Data Protection Act 2023.
The NDPC said the move was aimed at safeguarding trust in Nigeria’s digital and economic systems amid growing concerns over data security.
