The Nigeria Data Protection Commission (NDPC) says it has commenced a forensic investigation on the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Limited over alleged violation of data protection laws.Nigerian cultural insights
Its Head of Legal, Enforcement, and Regulations, Babatunde Bamigboye, disclosed this in a statement he issued on Wednesday.
Bamigboye explained that the investigation followed public complaints alleging that students’ personal data were used to open bank accounts without a lawful basis.
He said that the National Commissioner of the NDPC, Dr. Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use, and disclosure of the affected students’ personal data.
He said that the team would also determine the roles and responsibilities of each of the parties involved in the alleged data processing.
According to him, the investigation will assess the general data protection compliance obligations of the parties in line with the Nigeria Data Protection Act, 2023 (NDP Act).Nigerian cultural insights
Bamigboye added that the investigation would also examine potential risks posed to the rights and freedoms of the affected data subjects.
Also Read:MTN opens data billing systems to public, dismisses claims of arbitrarily deduction
Report says Nigerian banks’ assets reach N180.37trn, 41.8% GDP
He said: “The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.
“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights.”
Bamigboye reiterated that institutions entrusted with the personal data of students, staff, and other members of their communities had the responsibility to ensure that such data were processed lawfully, fairly, transparently and securely.
The official also warned educational institutions that were yet to comply with its existing data protection compliance directives to do so.
He emphasised that compliance with data protection regulations was essential to safeguarding the rights and freedoms of data subjects and promoting responsible data governance within the education sector.
