LOTUS Bank is facing a forensic investigation by the Nigeria Data Protection Commission (NDPC) over allegations that students’ personal data were unlawfully used to open bank accounts without a lawful basis.
News Point Nigeria reports that the NDPC has also commenced an investigation into the University of Lagos (UNILAG) and Hackerbella Ltd over their alleged roles and responsibilities in the collection, use, disclosure and processing of the affected students’ personal data.
Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the commission, disclosed this in a statement issued on Wednesday in Abuja, saying the investigation followed public complaints over the alleged use of students’ personal data to open bank accounts without lawful basis.
According to Bamigboye, Vincent Olatunji, the National Commissioner of the NDPC, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
He said the probe would also determine the roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged processing of the data.
Bamigboye explained that the investigation would assess the parties’ compliance with their obligations under the Nigeria Data Protection Act, 2023.
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” he said.
“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights.”
The NDPC official said the investigation would further examine potential risks posed to the rights and freedoms of the affected students.
He stressed that institutions entrusted with the personal data of students, staff and other members of their communities had a responsibility to ensure that such information was processed lawfully, fairly, transparently and securely.
Bamigboye also warned educational institutions that had yet to comply with the commission’s existing data protection directives to do so.
He said compliance with data protection regulations remained essential to protecting the rights and freedoms of data subjects and promoting responsible data governance in the education sector.
