The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged violations of data protection laws.

The investigation follows complaints that students’ personal information was allegedly used to open bank accounts without a lawful basis.

According to Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, National Commissioner Vincent Olatunji directed the probe to determine how the affected students’ data were collected, processed and disclosed.

The investigation will also establish the roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged processing of the students’ personal data.

The NDPC said the probe would assess compliance with the Nigeria Data Protection Act, 2023, including the conduct of Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of credit scoring or profiling, and the use of automated decision-making systems.

It will further examine privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, data retention policies and the technical and organisational safeguards put in place to protect students’ rights.

Bamigboye said the commission would also assess potential risks the alleged data processing may have posed to the rights and freedoms of the affected students.

He reminded educational institutions that they have a responsibility to ensure that students’ and staff members’ personal data are processed lawfully, fairly, transparently and securely.

The NDPC also urged educational institutions that have yet to comply with its existing data protection directives to do so, stressing that compliance is essential to protecting data subjects and promoting responsible data governance in the education sector.