NDPC Probes UNILAG, Lotus Bank, Hackerbella Over Data Breaches

• The Nigeria Data Protection Commission (NDPC) has launched an investigation into the University of Lagos, Lotus Bank, and Hackerbella Ltd over alleged data protection breaches.
• The probe follows public complaints that students' personal data was used to open bank accounts without lawful basis.
• The NDPC's investigation will examine various aspects of data protection, including DPIAs, credit scoring or profiling activities, and technical and organisational safeguards for data subjects' rights.

The NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately.

The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos, Lotus Bank, and Hackerbella Ltd over alleged data protection breaches. The probe follows public complaints that students' personal data was used to open bank accounts without lawful basis. The NDPC's investigation team will examine the collection, use, and disclosure of affected students' personal data, as well as the roles and responsibilities of the parties involved. The commission has directed the team to conduct a comprehensive assessment of the circumstances surrounding the alleged breaches.

The investigation will also cover various aspects of data protection, including Data Protection Impact Assessments (DPIAs), credit scoring or profiling activities, automated decision-making systems, privacy notices, data-sharing arrangements, and technical and organisational safeguards for data subjects' rights. The NDPC has warned educational institutions to comply with its existing data protection compliance directives immediately.

The investigation is ongoing, and the commission has reiterated that institutions entrusted with personal data have a heightened responsibility to ensure lawful, fair, transparent, and secure processing of such data.

The NDPC's investigation highlights the importance of complying with Nigeria's Data Protection Act, 2023. The law requires institutions to process personal data lawfully, fairly, transparently, and securely. Educational institutions and businesses must ensure they are complying with the Act, particularly in regards to data collection, use, and disclosure. Lawyers should be aware of this development and advise clients on their obligations under the law.

The NDPC has been proactive in enforcing data protection laws in Nigeria. In 2023, it established a comprehensive framework for data protection, which includes guidelines for institutions to follow when processing personal data. The commission's efforts aim to protect individuals' rights and freedoms in the digital age.

The NDPC's investigation into the University of Lagos, Lotus Bank, and Hackerbella Ltd has significant implications for educational institutions and businesses in Nigeria. The probe highlights the importance of data protection compliance and the need for institutions to ensure they are processing personal data lawfully and securely.

If found guilty, the affected parties may face severe penalties under the Data Protection Act, 2023. This could lead to reputational damage, financial losses, and legal consequences. The NDPC's efforts aim to promote a culture of data protection in Nigeria, protecting individuals' rights and freedoms in the digital age.

The NDPC's investigation highlights the importance for educational institutions and businesses to ensure they are complying with Nigeria's Data Protection Act, 2023, particularly in regards to data collection, use, and disclosure. Lawyers should be aware of this development and advise clients on their obligations under the law.

Source: Original reporting via Punch Newspapers