The Nigeria Data Protection Commission has commenced a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.

The investigation followed public complaints alleging that students’ personal data were used to open bank accounts without a lawful basis, the commission said in a statement signed by its Head of Legal, Enforcement and Regulations, Babatunde Bamigboye.

The National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, directed the investigation team to examine how the affected students’ personal data were collected, used and disclosed.

The team will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged data-processing activities and assess their compliance with the Nigeria Data Protection Act, 2023.

The commission said the probe would examine Data Protection Impact Assessments, the lawfulness and transparency of credit scoring or profiling activities, automated decision-making systems and the adequacy of privacy notices.

It will also assess data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policies and the technical and organisational measures used to protect students’ rights.

The NDPC said the investigation would further assess the potential risks posed to the rights and freedoms of the affected students.

The commission stressed that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.

It therefore warned educational institutions that had yet to comply with its existing data protection directives to do so immediately.

The NDPC said the investigation was ongoing.