By Three prominent organisation are under the searchlight of the Nigeria Data Protection Commission (NDPC) following public complaints alleging the use of students’ personal data to open bank accounts without a lawful basis.
A statement from the NDPC issued by the Head, Legal, Enforcement and Regulations of the Commission, Mr Babatunde Bamigboye, gave the name of the organsations as: the University of Lagos (UNILAG), Lotus Bank and Hackerbella Limited, saying that the NDPC has commenced a forensic investigation into their activities.
Meanwhile, the National Commissioner and Chief Executive Officer of the Commission, Dr Vincent Olatunji, has directed the investigation team to undertake a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data, including the roles and responsibilities of each of the parties involved.
He also directed the investigation team to assess the general data protection compliance obligations of the parties in line with the provisions of the Nigeria Data Protection Act, 2023 (NDP Act), and the potential risks posed to the rights and freedoms of the affected data subjects.
The investigation will, among others, cover Data Protection Impact Assessments (DPIAs); the lawfulness and transparency of any credit scoring or profiling activities; the use of automated decision-making systems; the adequacy of privacy notices; data-sharing arrangements; lawful bases for processing; data minimisation; purpose limitation; retention policy; and appropriate technical and organisational safeguards for data subjects’ rights.
The NDPC reiterates that institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely.
Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately.
