NDPC Probes Lotus Bank, UNILAG Over Alleged Illegal Use of Students’ Data

The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into Lotus Bank Limited, the University of Lagos (UNILAG) and Hackerbella Ltd over allegations bordering on the unlawful use of students’ personal data.

The probe followed complaints alleging that the personal information of some UNILAG students was allegedly used to open bank accounts without their lawful consent or an established legal basis.

The development has placed Lotus Bank and the other parties under regulatory scrutiny as the NDPC moves to determine how students’ sensitive personal information was obtained, processed, shared and allegedly used for banking purposes.

The commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, disclosed the investigation in a statement issued on Wednesday in Abuja.

According to him, NDPC National Commissioner, Vincent Olatunji, has directed investigators to conduct a comprehensive examination of the circumstances surrounding the alleged processing of the students’ data and establish the specific roles played by UNILAG, Lotus Bank and Hackerbella.

The investigation will specifically examine whether there was a lawful basis for the alleged opening of bank accounts and whether the affected students were adequately informed about how their personal information would be used.

The NDPC will also scrutinise the parties’ compliance with the Nigeria Data Protection Act, 2023, including their data-sharing arrangements, privacy notices, data-minimisation practices, purpose limitation, retention policies and safeguards for protecting students’ information.

The commission said the probe would further examine whether any credit scoring, profiling or automated decision-making systems were involved in the alleged processing.

For Lotus Bank, the investigation could raise serious questions about its data-handling practices if the allegations are substantiated, particularly regarding how prospective customers’ information is sourced and whether accounts can be created without customers’ clear knowledge or lawful authorisation.

Bamigboye said the investigation would assess the potential risks posed to the rights and freedoms of the affected students.

He warned institutions entrusted with the personal information of students, staff and members of their communities that such data must be handled lawfully, fairly, transparently and securely.

The NDPC also directed educational institutions yet to comply with its existing data protection directives to take immediate steps to achieve compliance.

The commission stressed that the investigation would determine the facts surrounding the alleged data processing and establish whether Lotus Bank, UNILAG, Hackerbella or any other party breached provisions of the Nigeria Data Protection Act.

The probe is therefore expected to provide answers to a critical question: **How did students’ personal information allegedly end up being used to open bank accounts, and who authorised it?**

Until the investigation is concluded, the allegations remain unproven.