NDPC probes UNILAG, Lotus Bank, Hackerbella over alleged data breach

By Imisioluwa Afunmiso

The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations of unauthorised use of students’ personal data to open bank accounts.

The Commission disclosed this in a statement issued on Tuesday and signed by its Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, Esq.

The investigation followed public complaints alleging that the three institutions collaborated in the collection, use and disclosure of students’ personal information without a lawful basis for the purpose of facilitating bank account openings.

The National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, has directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the alleged processing of the students’ data.

The team is also expected to establish the specific roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the matter and determine their compliance with obligations under the Nigeria Data Protection Act, 2023.

According to the Commission, the investigation will also assess the potential risks posed to the rights and freedoms of the affected students.

The scope of the probe includes examination of Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of credit scoring or profiling activities, automated decision-making systems, privacy notices and data-sharing arrangements.

Other areas to be examined are the lawful bases for processing, data minimisation, purpose limitation, data retention policies and the adequacy of technical and organisational measures put in place to safeguard data subjects’ rights.

The NDPC also warned educational institutions across the country against unlawful handling of students’ and staff members’ personal information.

The Commission stressed that institutions entrusted with personal data have a heightened responsibility to ensure that such information is processed lawfully, fairly, transparently and securely.

“Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the Commission said.

The regulator did not disclose when the investigation would be concluded.

As of the time of filing this report, UNILAG, Lotus Bank and Hackerbella Ltd had not publicly responded to the allegations.