NDPC investigates varsity, bank over data violations

The Nigeria Data Protection Commission (NDPC) has launched an investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd for allegedly using students' personal data to open bank accounts without their consent. This follows public complaints alleging the unauthorized use of students' personal data. Dr. Vincent Olatunji, the National Commissioner and Chief Executive Officer of the NDPC, has instructed the investigation team to conduct a thorough examination of the data handling practices of the involved parties.

The team will assess compliance with the Nigeria Data Protection Act, 2023, and evaluate potential risks to the rights and freedoms of the affected individuals. The investigation will also cover Data Protection Impact Assessments, lawfulness of credit scoring or profiling activities, automated decision-making systems, privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, retention policies, and technical and organisational safeguards for data subjects' rights.

The NDPC emphasized that institutions handling students' personal data must process it lawfully, fairly, transparently, and securely. They have warned educational institutions still non-compliant with existing data protection directives to adhere to these guidelines immediately.