NDPC Launches Probe into Alleged Data Breaches at UNILAG, Lotus Bank, Hackerbella

The Nigeria Data Protection Commission (NDPC) has initiated a thorough investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd, following allegations of unauthorized use of students' personal data. According to a statement released by the commission on Wednesday, signed by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations, the investigation was prompted by public complaints regarding the alleged use of students' personal data to open bank accounts without a lawful basis. The National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, has directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use, and disclosure of the affected students' personal data. The team will examine the roles and responsibilities of the parties involved, as well as their compliance with the Nigeria Data Protection Act, 2023. The investigation will cover various aspects, including Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the adequacy of privacy notices. The NDPC emphasized that institutions entrusted with personal data have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently, and securely. The commission warned educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately, as the investigation is ongoing.