By Chris Nwokocha
ABUJA, Nigeria — The Nigeria Data Protection Commission has initiated a full-scale forensic probe into the University of Lagos, Lotus Bank, and IT vendor Hackerbella Limited over allegations of serious data privacy breaches.
The investigation stems from public complaints and investigative reports detailing how sensitive personal information belonging to students and staff was allegedly processed and shared without clear consent.
At the center of the dispute is the university’s Smart ID Card project, during which collected personal details, including National Identification Numbers, dates of birth, and home addresses, were allegedly routed to third parties.
Students reported that bank accounts were subsequently created in their names at Lotus Bank without their explicit permission or prior knowledge.
Many affected students claimed they were later told that activating these unrequested bank accounts was mandatory before they could receive their official university identification cards.
Dr. Vincent Olatunji, Chief Executive Officer of the NDPC, directed a specialized enforcement team to determine the distinct roles and regulatory liabilities of all three institutions.
The commission said the probe will scrutinize whether Data Protection Impact Assessments were conducted and assess the legal basis, transparency, and security measures applied under the Nigeria Data Protection Act, 2023.
“Institutions entrusted with the personal data of students, staff and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently and securely,” the NDPC said in a official statement signed by legal head Babatunde Bamigboye.
University of Lagos authorities have maintained an elusive stance regarding the ongoing probe. Requests for comment directed to UNILAG’s communication officials went unanswered at press time, with media inquiries left without official response.
If found culpable under the NDPA 2023, the involved entities face steep regulatory penalties, including monetary fines reaching up to 10 million naira or 2% of their annual gross revenue, alongside mandatory remedial orders, potential criminal prosecution for executives, and severe reputational damage.
