By Opeyemi Adelakun
The Nigeria Data Protection Commission has commenced a forensic investigation into the University of Lagos, Lotus Bank Limited and Hackerbella Ltd over alleged breaches of data protection regulations involving students’ personal information.
The commission disclosed the investigation on Wednesday through its Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, in a statement issued in Abuja.
According to Bamigboye, the probe followed complaints alleging that the personal data of some students were used to open bank accounts without a lawful basis.
He said the investigation team had been directed by the NDPC National Commissioner, Vincent Olatunji, to conduct a comprehensive assessment of how the affected students’ information was collected, processed and disclosed.
The commission will also determine the respective roles and responsibilities of the institutions and company allegedly involved in the processing of the students’ data.
Bamigboye said the investigation would assess the compliance obligations of the parties under the Nigeria Data Protection Act, 2023, while examining possible risks to the rights and freedoms of the affected students.
The probe will cover several areas of data protection compliance, including Data Protection Impact Assessments, the legality and transparency of credit scoring or profiling activities, and the use of automated decision-making systems.
The commission will also scrutinise privacy notices, data-sharing arrangements, lawful bases for processing personal information, data minimisation, purpose limitation, retention policies and the technical and organisational safeguards put in place to protect data subjects.
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” Bamigboye said.
He added that the investigation would also determine whether the parties involved complied with relevant requirements governing the handling of personal data.
The NDPC further reminded educational institutions and other organisations entrusted with the personal information of students, staff and members of their communities that such data must be processed lawfully, fairly, transparently and securely.
Bamigboye urged institutions that were yet to comply with the commission’s existing data protection directives to take immediate steps to address their compliance gaps.
He stressed that adherence to data protection regulations was essential to safeguarding the rights and freedoms of individuals and promoting responsible data governance, particularly within the education sector.
The commission said the forensic investigation would establish the circumstances surrounding the alleged processing of the students’ personal information and determine whether any provisions of the Nigeria Data Protection Act were violated.
Leave a Reply