NDPC Probes UNILAG, Lotus Bank Over Alleged Data Protection Violations

The Commission disclosed this in a statement on Wednesday, stating that the probe followed public complaints alleging that students’ personal information was used to open bank accounts without a lawful basis.

The NDPC National Commissioner, Vincent Olatunji, directed the investigation team to establish the circumstances surrounding the collection, processing and disclosure of the affected students’ personal data.

The team is also expected to determine the roles and responsibilities of each of the parties involved in the alleged processing of the data.

According to the commission, the investigation will examine the compliance obligations of the three organisations under the Nigeria Data Protection Act, 2023, as well as assess potential risks posed to the rights and freedoms of the affected data subjects.

”The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.

”It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy and appropriate technical and organisational safeguards for data subjects’ rights,” the NDPC statement said.

The Commission stressed that institutions entrusted with the personal information of students, staff and other individuals have a duty to ensure that such data are handled lawfully, fairly, transparently and securely.

It also urged educational institutions that have yet to comply with its existing data protection directives to take the necessary steps to meet their obligations.

The NDPC reiterated that adherence to data protection regulations remains critical to protecting the rights and freedoms of data subjects and strengthening responsible data governance across the education sector.