The Nigeria Data Protection Commission has commenced a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Limited over alleged violations of data protection laws.

The investigation followed public complaints alleging that the personal data of some UNILAG students were used to open bank accounts without a lawful basis, according to the NDPC.

The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, said the investigation was ordered by the National Commissioner, Vincent Olatunji, to establish how the students’ personal information was collected, used and disclosed.

The probe will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in processing the affected students’ data.

According to the NDPC, investigators will examine whether the parties complied with the Nigeria Data Protection Act, 2023, including requirements relating to data protection impact assessments, privacy notices, lawful bases for processing, data sharing, data minimisation, purpose limitation and data retention.

The commission will also investigate whether credit scoring, profiling or automated decision-making systems were involved in the alleged processing of the students’ information.

Bamigboye said the investigation would assess the potential risks posed to the rights and freedoms of the affected students and determine whether adequate technical and organisational safeguards were in place.

UNILAG, Lotus Bank and Hackerbella had not responded to requests for comments at the time of publication.

The NDPC also warned educational institutions that they must ensure students’, staff members’ and other members of their communities’ personal information is processed lawfully, fairly, transparently and securely.