The Nigeria Data Protection Commission has opened a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Ltd over allegations of unlawful handling of students’ personal information.
Sponsored Ads
The commission said the investigation followed complaints that personal details belonging to students were allegedly used to create bank accounts without obtaining a proper legal basis for processing the information.
Sponsored Ads
The Head of Legal, Enforcement and Regulations at the NDPC, Babatunde Bamigboye, disclosed this in a statement issued on Wednesday in Abuja.
According to Bamigboye, NDPC National Commissioner Vincent Olatunji directed the investigation team to establish how the students’ information was collected, processed and shared and to determine the responsibilities of each organisation involved.
The investigation will assess whether the parties complied with requirements under the Nigeria Data Protection Act 2023 and other applicable data protection rules.
The commission said it would also examine whether the alleged processing exposed the affected students to risks involving their privacy and other fundamental rights.
RELATED STORIES
Related Posts
Among the areas being investigated are the use of Data Protection Impact Assessments, the legality and transparency of credit scoring and profiling, and whether automated systems were used to make decisions concerning the affected individuals.
NDPC officials will also review the privacy notices provided to students, data-sharing arrangements, the legal grounds relied upon for processing the information, data minimisation practices and whether the information was used only for its stated purpose.
The investigation will further consider how long the data were retained and whether adequate technical and organisational safeguards were put in place to protect the information from misuse or unauthorised access.
Bamigboye said organisations entrusted with the personal information of students, employees and members of their communities have a duty to handle such data lawfully, fairly, transparently and securely.
He also urged educational institutions that had yet to meet existing NDPC compliance requirements to take steps to do so.
The commission said proper compliance with data protection regulations was necessary to protect individuals’ rights and promote responsible handling of personal information across Nigeria’s education sector.
The investigation is expected to establish whether any breaches occurred and determine the roles played by the organisations named in the complaints.
Comments are closed.