NDPC Probes Lotus Bank, UNILAG, Hackerbella for Students’ Data Breach

By Adedapo Adesanya

The Nigeria Data Protection Commission (NDPC) is investigating the University of Lagos, Lotus Bank, and Hackerbella Limited over alleged violations of data protection laws.

The probe followed public complaints alleging that students’ personal data was used to open bank accounts without a lawful basis.

The NDPC disclosed this in a statement signed by its Head of Legal, Enforcement and Regulations, Mr Babatunde Bamigboye, on behalf of the commission.

According to the commission, its chief executive, Mr Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.

The investigation will also determine the roles and responsibilities of the university, the bank, and the information technology solutions firm in the alleged data processing activities.

The NDPC said the probe would assess the compliance obligations of the three organisations under the Nigeria Data Protection Act, 2023, as well as the potential risks posed to the rights and freedoms of the affected students.

The commission said the investigation would cover several areas, including Data Protection Impact Assessments, the lawfulness and transparency of credit scoring or profiling activities, automated decision-making systems, privacy notices and data-sharing arrangements.

It will also examine the lawful bases for processing the students’ information, data minimisation, purpose limitation, retention policies and the adequacy of technical and organisational safeguards for protecting data subjects’ rights.

The commission stressed that institutions handling the personal information of students, staff and other members of their communities have a greater responsibility to ensure such data is properly protected.

“Institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely,” the NDPC said.

The commission also warned educational institutions that have yet to comply with its existing data protection directives to take immediate steps to meet the required standards.

“Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the statement added.