The Nigeria Data Protection Commission (NDPC) has officially launched a comprehensive forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and technology firm Hackerbella Ltd over allegations of data privacy breaches. This regulatory action follows formal complaints accusing the institutions of utilizing students’ private information without authorization. The commission is looking into how the confidential data of numerous students was accessed and processed by third parties without fulfilling the necessary legal requirements for data handling.

According to an official statement released by the data privacy regulator, the investigation was triggered by specific petitions alleging that students’ personal details were actively harvested to open unauthorized commercial bank accounts. The complaints indicate that the affected students never gave valid consent, nor was there any lawful basis established by the university or its partners to share their identities for banking purposes. This suspected non-compliance has raised severe concerns regarding systemic vulnerabilities in institutional data-sharing protocols between academic bodies and corporate entities.

In response to the development, the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, has directed a specialized enforcement team to carry out a rigorous assessment of the entire incident. The forensic team is mandated to thoroughly scrutinize the circumstances surrounding the collection, storage, use, and subsequent disclosure of the students’ personal records. Dr Olatunji emphasized that the commission will ensure full accountability and apply appropriate statutory sanctions if any of the investigated organizations are found guilty of violating the Nigeria Data Protection Act.

The specialized enforcement team is tasked with establishing the precise roles, liabilities, and data processing responsibilities of the University of Lagos, Lotus Bank, and Hackerbella Ltd in this alleged breach. Operating under the statutory framework of the Nigeria Data Protection Act (NDPA), 2023, the forensic probe will meticulously evaluate how each entity handled its compliance obligations. Crucially, investigators will measure the potential risks and long-term vulnerabilities this unauthorized data exposure poses to the fundamental rights, privacy, and digital freedoms of the affected students.

To ensure a thorough review, the scope of the investigation will scrutinize whether the institutions conducted mandatory Data Protection Impact Assessments (DPIAs) before sharing student information. Regulators will also dissect the lawfulness and transparency of any underlying credit scoring, student profiling, or automated decision-making systems tied to the account creation. Furthermore, the NDPC will audit the adequacy of the university’s privacy notices to determine if students were intentionally misled or left entirely unaware of how their personal records were being commercialised.

The forensic probe will deeply examine the formal data-sharing agreements, retention policies, and specific lawful bases used by the institutions to justify processing student records. Investigators are auditing whether the organizations adhered to the core principles of data minimization and purpose limitation, ensuring they did not collect or hold more information than necessary. Furthermore, the commission is evaluating the strength of the technical and organizational security measures implemented by the university and its partners to safeguard data subjects against unauthorized access and systemic leaks.

The NDPC emphasized that academic institutions and corporate partners hold a heightened responsibility to ensure that the personal data of students and staff is processed lawfully, fairly, transparently, and securely. Consequently, the regulatory body issued a stern warning to all educational institutions across Nigeria that are still lagging in data protection compliance. The commission ordered these organizations to immediately align their data infrastructure with existing directives or face severe statutory penalties and public enforcement actions.

The commission reiterated its commitment to enforcing the provisions of the Nigeria Data Protection Act and ensuring that the rights of data subjects are adequately protected.

“The NDPC reiterates that institutions entrusted with the personal data of students, staff, and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently, and securely. Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately,” the document added.