NDPC probes UNILAG, Lotus Bank, Hackerbella over data breaches

The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd. The probe follows public complaints about the unauthorized use of students' personal data to open bank accounts without a lawful basis. Dr. Vincent Olatunji, the National Commissioner and CEO of the NDPC, ordered the team to conduct a comprehensive examination of the data collection, use, and disclosure practices.

They will scrutinize the roles of the parties involved and their adherence to the Nigeria Data Protection Act, 2023. The investigation will include Data Protection Impact Assessments (DPIAs), assessing the lawfulness and transparency of credit scoring and profiling activities, automated decision-making systems, privacy notices, data-sharing arrangements, lawful bases for processing, data minimization, retention policies, and appropriate technical and organizational safeguards for data subjects' rights.

The NDPC emphasizes that organizations handling personal data must process it lawfully, fairly, transparently, and securely, warning educational institutions to comply with existing data protection compliance directives immediately. The investigation is currently underway.