NDPC begins forensic probe of UNILAG, Lotus Bank, Hackerbella over alleged unlawful use of students’ data
The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd after receiving public complaints about the unauthorized use of students' personal data to open bank accounts. The investigation, led by NDPC's Head of Legal, Enforcement, and Regulations, Babatunde Bamigboye, aims to evaluate how these entities collected, used, and shared student data, ensuring compliance with the Nigeria Data Protection Act, 2023. It will examine legal bases for data processing, data minimization practices, and security measures. The NDPC emphasized that educational institutions have a heightened duty to protect personal data and urged non-compliant schools to adhere to regulations promptly.
The Nigeria Data Protection Commission (NDPC) has initiated a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd over allegations of unlawful use of students' personal data to open bank accounts without a lawful basis. The probe follows public complaints and was announced in a statement issued by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, on Tuesday. According to the statement, the investigation was directed by Vincent Olatunji, the National Commissioner and Chief Executive Officer of the commission, who ordered a comprehensive assessment of how the students’ data was collected, used, and shared. The NDPC's statement outlined that the investigation will scrutinize the roles and responsibilities of all three entities, UNILAG, Lotus Bank, and Hackerbella Ltd, in the alleged misuse of student data. It emphasized that the probe will evaluate whether these organizations complied with the requirements of the Nigeria Data Protection Act, 2023. This includes examining Data Protection Impact Assessments (DPIAs), the legality and transparency of credit-scoring or profiling activities, and the use of automated decision-making systems. The investigation will also review the adequacy of privacy notices, data-sharing agreements, and adherence to principles such as data minimization, purpose limitation, and proper retention policies. In addition, the NDPC highlighted the importance of safeguarding the rights and freedoms of data subjects, particularly students, by ensuring that their personal information is handled lawfully, fairly, and securely. The commission reiterated that educational institutions and other bodies entrusted with personal data must uphold strict standards of data governance. Institutions that have not yet aligned with the NDPC’s existing data protection directives were specifically warned to take immediate action. Efforts to obtain statements from key individuals involved in the case revealed limited responses. Alhaja Ajoke Ibrahim Alaga, the Head of Communication Unit at UNILAG, initially requested a text message before declining to respond further. Similarly, representatives from Lotus Bank and Hackerbella Ltd could not be reached for comment at press time. Despite this, the NDPC maintained that the investigation is ongoing and that the findings will be made public once completed. The allegations center around the unauthorized use of student data to facilitate bank account openings. Public complaints suggest that students’ personal information was accessed or shared without their consent, violating fundamental data protection principles. While the exact mechanisms of data collection and dissemination remain unclear, the NDPC has confirmed that the investigation will trace the entire chain of data handling, including any third-party involvement. The probe underscores growing concerns about data security and privacy in academic and financial sectors. With increasing reliance on digital platforms for administrative and banking services, the risk of data breaches and improper usage has become a pressing issue. The NDPC’s intervention signals a broader effort to enforce stricter compliance with data protection laws, especially within educational institutions and associated service providers. The investigation is expected to uncover whether the implicated parties adhered to legal frameworks governing data processing. If found non-compliant, the NDPC may impose penalties or recommend corrective measures. The outcome of this probe could set a precedent for future data protection enforcement actions, reinforcing accountability among organizations handling sensitive personal information. As the investigation unfolds, stakeholders await clarity on the extent of the breach and the steps required to rectify the situation.
★
Keep the news honest.
ObjectiveNews is reader-funded and ad-free — we show you the bias instead of hiding it. Support independent journalism for €4/month.
Become a Supporter
NG
