NDPC probes UNILAG, Lotus Bank, Hackerbella over data breaches

n n

The Nigeria Data Protection Commission has commenced a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.

n

The commission disclosed this in a statement signed on Tuesday by Babatunde Bamigboye, its Head of Legal, Enforcement and Regulations, and posted on its X handle on Wednesday.

n

The statement read, “The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd following public complaints alleging the use of students’ personal data to open bank accounts without a lawful basis.”

n

The National Commissioner and Chief Executive Officer of the commission, Dr Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.

n

The team will also examine the roles and responsibilities of the parties involved, as well as their compliance with the Nigeria Data Protection Act, 2023.

n

The commission said, “The investigation will, among others, cover Data Protection Impact Assessments (DPIAs); the lawfulness and transparency of any credit scoring or profiling activities; the use of automated decision-making systems; the adequacy of privacy notices; data-sharing arrangements; lawful bases for processing; data minimisation; purpose limitation; retention policy; and appropriate technical and organisational safeguards for data subjects’ rights.”

n

It added that investigation would also assess the potential risks posed to the rights and freedoms of the affected students.

n

The NDPC reiterated that institutions entrusted with students’, staff members’ and other members of their communities’ personal data have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely.

n

“Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the commission said.

n

The commission said the investigation was ongoing.

n n