Reported by: Oahimire Omone Precious | Edited by: Oravbiere Osayomore Promise.
The Nigeria Data Protection Commission has launched a full-scale forensic investigation into the University of Lagos, Lotus Bank, and Hackerbella Ltd following public complaints that the personal data of students were used to open bank accounts without a lawful basis, in a case that has exposed the dark underbelly of the university's Smart ID Card project and raised urgent questions about the safety of student information in Nigeria's tertiary institutions.
The investigation, announced on Tuesday, August 11, 2026, marks one of the most significant enforcement actions taken by the NDPC since the enactment of the Nigeria Data Protection Act 2023, and it sends a clear warning to educational institutions and their private-sector partners that the era of impunity in data handling is over.
According to a statement from the commission, the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use, and disclosure of the affected students' personal data, as well as the roles and responsibilities of each of the parties involved.
The probe was triggered by public complaints alleging that students' personal information was collected, processed, and used by the three organisations to open bank accounts without proper authorisation or a lawful basis. The commission said the investigation would assess the data protection compliance obligations of UNILAG, Lotus Bank, and Hackerbella under the Nigeria Data Protection Act, 2023, as well as the potential risks posed to the rights and freedoms of the affected students.
The investigation will cover a wide range of issues, including Data Protection Impact Assessments, the lawfulness and transparency of any credit scoring or profiling activities, the use of automated decision-making systems, the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policies, and the technical and organisational measures put in place to safeguard the rights of data subjects.
The case has its roots in UNILAG's Smart ID Card project, which was run in partnership with Lotus Bank. A separate investigation by the Foundation for Investigative Journalism earlier this year found that the project opened bank accounts for tens of thousands of students and staff through a process that violated data privacy regulations. The FIJ report, published in July 2026, noted that UNILAG appeared on the NDPC's register of organisations that had breached data protection laws, raising concerns about the university's compliance with its obligations under the Nigeria Data Protection Act.
The NDPC's decision to launch a forensic investigation signals a significant escalation in its enforcement efforts. The commission has warned educational institutions that are yet to comply with its existing data protection compliance directives to take immediate steps to regularise their compliance status. "Institutions entrusted with the personal data of students, staff, and other members of their communities have a heightened responsibility to ensure that such data is processed lawfully, fairly, transparently, and securely," the commission said in its statement. "Accordingly, the NDPC warns educational institutions that are yet to comply with its existing data protection compliance directives to do so immediately."
The investigation has sent shockwaves through Nigeria's higher education sector, where the collection and processing of student data for administrative purposes has become increasingly common, often without adequate safeguards or transparency. The UNILAG Smart ID Card project, which was intended to streamline identification and access to university services, has become a cautionary tale of how well-intentioned initiatives can go wrong when data protection principles are ignored.
Hackerbella Ltd, a technology company that was reportedly involved in the implementation of the Smart ID Card project, is also under scrutiny. The company's role in the alleged data processing activities will be examined as part of the investigation, which aims to establish the full facts surrounding the case and determine whether any provisions of the Nigeria Data Protection Act have been breached.
The NDPC has stressed that the investigation is not just about punishing wrongdoing but also about protecting the rights of data subjects and ensuring that institutions entrusted with personal information take their responsibilities seriously. The commission has made it clear that compliance with the Nigeria Data Protection Act is not optional for institutions and organisations processing personal data, and that appropriate safeguards must be put in place to protect individuals' rights.
The investigation is ongoing, and the NDPC has not yet announced any findings or sanctions. However, the commission has warned that non-compliance with the Nigeria Data Protection Act carries serious consequences, and that it will continue to exercise its regulatory mandate to protect the privacy rights of Nigerians.
For the thousands of UNILAG students whose personal data were allegedly used without their consent, the investigation offers a glimmer of hope that justice may finally be served. But it also serves as a stark reminder of the vulnerability of personal information in an age of digital transformation, and the urgent need for stronger enforcement of data protection laws across all sectors of Nigerian society.
As the NDPC continues its forensic investigation, the eyes of the nation will be on UNILAG, Lotus Bank, and Hackerbella to see whether they can account for their actions and demonstrate that they have learned the lessons of this troubling case. The outcome of the investigation could set a precedent for how data protection violations are handled in Nigeria's educational institutions and beyond, and it could mark a turning point in the country's journey towards a more robust culture of data privacy and accountability.
📩 Stone Reporters News | 🌍 stonereportersnews.com
✉️ info@stonereportersnews.com | 📘 Facebook: Stone Reporters News | 🐦 X (Twitter): @StoneReportNew | 📸 Instagram: @stonereportersnews
Add comment
Comments