NDPC Probes Lotus Bank, UNILAG Over ‘Unlawful’ Use of Students’ Data to Open Accounts

The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.

The commission said the investigation followed public complaints alleging that students’ personal data were used to open bank accounts without a lawful basis.

Babatunde Bamigboye, head of legal, enforcement and regulations at the NDPC, disclosed this in a statement issued on Wednesday in Abuja.

According to Bamigboye, NDPC National Commissioner Vincent Olatunji directed the investigation team to conduct a comprehensive assessment of how the affected students’ personal data were collected, used and disclosed.

The probe will also determine the roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged processing of the students’ information.

Bamigboye said the investigation would assess whether the organisations complied with their obligations under the Nigeria Data Protection Act, 2023.

The commission will examine issues including Data Protection Impact Assessments, the lawfulness and transparency of credit scoring or profiling activities, and the use of automated decision-making systems.

It will also review privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, data retention policies and the technical and organisational safeguards put in place to protect data subjects.

The NDPC said the investigation would further assess potential risks posed to the rights and freedoms of the affected students.

Bamigboye stressed that institutions entrusted with the personal information of students, staff and other members of their communities have a responsibility to process such data lawfully, fairly, transparently and securely.

He also urged educational institutions that had yet to comply with existing NDPC data protection directives to do so.

The commission said compliance with data protection regulations was essential to protecting the rights and freedoms of data subjects and promoting responsible data governance across Nigeria’s education sector.