Data protection commission probes UNILAG, Lotus Bank for data violations

Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged data protection violations.

NDPC disclosed this in a statement on Wednesday, saying the investigation followed public complaints alleging that students’ personal data were used to open bank accounts without lawful basis.

Its national commissioner, Vincent Olatunji, directed the investigation team to assess the circumstances surrounding the collection, use and disclosure of the affected students’ personal data. The team will also determine the roles and responsibilities of each party involved in the alleged data processing.

The investigation is expected to assess the parties’ general data protection compliance obligations in line with the Nigeria Data Protection Act, 2023 (NDP Act) and examine potential risks to the rights and freedoms of the affected data subjects.

”The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.

”It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy and appropriate technical and organisational safeguards for data subjects’ rights,” the NDPC statement said.

It reiterated that institutions entrusted with students’, staff and other members’ personal data had the responsibility to ensure that such data were processed lawfully, fairly, transparently and securely and warned educational institutions yet to comply with its existing data protection compliance directives to do so.

NDPC restated that compliance with data protection regulations was essential to safeguarding the rights and freedoms of data subjects and promoting responsible data governance within the education sector. NAN