The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations that students’ personal data were collected, processed and disclosed to facilitate the opening of bank accounts without a lawful basis.

The investigation follows public complaints alleging that personal information belonging to affected students was used for financial purposes without an appropriate legal basis or sufficient transparency to the data subjects, according to a statement issued by NDPC seen by Technology Times.

The probe brings the handling of students’ personal information by an educational institution, a financial institution and a technology company under heightened regulatory scrutiny, with the NDPC set to examine how the data were collected, shared, processed and potentially used for profiling or automated decision-making.

The NDPC will further scrutinise data-sharing arrangements, the lawful bases relied upon for processing, data minimisation, purpose limitation, retention policies and the technical and organisational measures deployed to safeguard the rights of data subjects.

UNILAG: NDPC orders comprehensive investigation

Vincent Olatunji, National Commissioner and Chief Executive Officer of the NDPC, has directed the Commission’s investigation team to conduct a comprehensive assessment of the circumstances surrounding the alleged collection, use and disclosure of the affected students’ personal data.

The investigation will determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the processing of the students’ information and assess whether their activities complied with obligations imposed by the Nigeria Data Protection Act, 2023.

The Commission will also examine whether the alleged processing created risks to the rights and freedoms of the affected students.

Among the areas under investigation are the parties’ Data Protection Impact Assessments, the lawfulness and transparency of any credit scoring or profiling activities, the use of automated decision-making systems and the adequacy of privacy notices provided to affected individuals.

The NDPC will further scrutinise data-sharing arrangements, the lawful bases relied upon for processing, data minimisation, purpose limitation, retention policies and the technical and organisational measures deployed to safeguard the rights of data subjects.

Credit scoring, profiling face regulatory scrutiny

The investigation could have wider significance for Nigeria’s increasingly interconnected education, financial services and technology sectors because of the NDPC’s focus on credit scoring, profiling and automated decision-making.

The Commission is expected to determine whether any profiling of the affected students occurred and, if so, whether it was carried out lawfully and transparently.

It will also examine whether automated systems were used in making decisions concerning the students and whether the organisations involved provided sufficient information about such processing.

The focus on these areas highlights a growing regulatory concern around the use of personal data in systems that can potentially influence an individual’s access to financial services or other services with significant consequences.

The investigation will also seek to establish how students’ information moved between UNILAG, Lotus Bank and Hackerbella, what purposes the data were originally collected for, and whether subsequent sharing or processing remained within those purposes.

NDPC warns educational institutions

Beyond the specific investigation, the NDPC has issued a broader warning to educational institutions that collect and process the personal information of students, staff and other members of their communities.

The Commission said institutions entrusted with such information have a heightened responsibility to ensure that personal data are processed lawfully, fairly, transparently and securely.

The NDPC consequently warned educational institutions that have yet to comply with its existing data protection compliance directives to do so immediately.

The warning places additional pressure on universities and other educational institutions to strengthen their data governance frameworks, particularly where students’ personal information is shared with banks, fintech companies, technology providers, vendors and other third parties.

Student data handling under spotlight

The investigation also draws attention to the data governance responsibilities of organisations operating across institutional boundaries.

Where universities share student information with external service providers, financial institutions or technology companies, questions around purpose limitation, transparency, security and lawful processing become particularly important.

For students, the case underscores the importance of understanding how personal information collected in an academic environment may subsequently be used, disclosed or processed for purposes beyond education and administration.

The NDPC’s investigation will therefore examine not only the alleged opening of bank accounts but also the broader data-processing chain involving the organisations named in the complaints.

Potential implications for universities, banks and technology companies

The outcome of the investigation could have implications beyond the three organisations named by the NDPC.

A finding of non-compliance could reinforce the need for educational institutions to review how student information is transferred to third parties and the controls governing such transfers.

Financial institutions and technology companies working with universities could also face increased scrutiny over the legal basis for accessing student information, the purposes for which such information is processed, and the safeguards applied when personal data are used in financial or technology-enabled services.

The NDPC’s emphasis on Data Protection Impact Assessments, privacy notices, profiling, automated decision-making, data minimisation and purpose limitation also signals the breadth of the regulatory examination.

However, the investigation itself does not establish that UNILAG, Lotus Bank or Hackerbella breached the Nigeria Data Protection Act. The purpose of the forensic probe is to establish the facts, determine the respective responsibilities of the parties and assess compliance with applicable data protection requirements.

As digital services become increasingly embedded in Nigeria’s education and financial sectors, the case could become an important test of how institutions obtain, share and repurpose personal information belonging to students.

The eventual findings of the NDPC are therefore likely to be closely watched by universities, banks, fintechs, technology providers and students concerned about the lawful use and protection of personal data.