The Nigeria Data Protection Commission (NDPC) said it has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd over alleged violations of students’ personal data.
The probe, according to a statement from the commission, followed complaints alleging that the personal data of students were used to open bank accounts without a lawful basis.
The statement said the National Commissioner and Chief Executive Officer of NDPC, Dr Vincent Olatunji, had directed the investigation team to carry out a comprehensive assessment of the circumstances surrounding the collection, use, and disclosure of the affected students’ personal data.
The team is also expected to establish the roles and responsibilities of the parties involved in the alleged data processing.
According to the commission, the investigation will assess the data protection compliance obligations of the parties under the Nigeria Data Protection Act, 2023, as well as the potential risks posed to the rights and freedoms of the affected students.
The investigation will cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of credit scoring or profiling activities, the use of automated decision-making systems and the adequacy of privacy notices.
It will also examine data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policies, and the technical and organisational measures put in place to safeguard the rights of data subjects.
The commission said institutions entrusted with the personal data of students, staff, and other members of their communities have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently, and securely.
NDPC therefore warned educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately.
The commission reiterated its commitment to enforcing the provisions of the Nigeria Data Protection Act and ensuring that the rights of data subjects are adequately protected.
“The NDPC reiterates that institutions entrusted with the personal data of students, staff, and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently, and securely. Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the document added.
(The Sun)