NDPC investigates Lotus Bank, UNILAG, Hackerbella over alleged data breaches

The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank Limited and Hackerbella Ltd over alleged violations of data protection laws.

Babatunde Bamigboye, the commission’s Head of Legal, Enforcement and Regulations, disclosed this in a statement issued on Wednesday in Abuja.

According to Bamigboye, the investigation followed complaints alleging that the personal data of some students were used to open bank accounts without a lawful basis.

He said the National Commissioner of the NDPC, Vincent Olatunji, had directed the investigation team to conduct a comprehensive assessment of how the affected students’ personal data were collected, processed and disclosed.

The team will also establish the roles and responsibilities of the various parties involved in the alleged processing of the data.

Bamigboye said the investigation would assess the data protection compliance obligations of the parties under the Nigeria Data Protection Act, 2023.

He added that the inquiry would examine potential risks posed to the rights and freedoms of the affected students.

“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.

“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights,” he said.

Bamigboye reminded institutions entrusted with the personal information of students, staff and other members of their communities of their obligation to ensure that such data are processed lawfully, fairly, transparently and securely.

He also urged educational institutions that had yet to comply with the commission’s existing data protection directives to take immediate steps to do so.

The official stressed that adherence to data protection regulations was crucial to protecting the rights and freedoms of data subjects and promoting responsible data governance across the education sector.

The commission said the investigation would determine the circumstances surrounding the alleged data processing and establish whether any violations of the Nigeria Data Protection Act occurred.