NDPC probes UNILAG, Lotus Bank data breach

The Ghana — Data Protection Commission (Ghana) (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and Hackerbella Ltd over alleged violations of students' personal data. The probe follows public complaints that students' personal data were used to open bank accounts without a lawful basis. NDPC National Commissioner Vincent Olatunji directed the investigation team to conduct a comprehensive assessment of the collection, use, and disclosure of the affected students' data, and to determine the roles and responsibilities of each party. The investigation will cover compliance with the Nigeria Data Protection Act, 2023, including Data Protection Impact Assessments, lawfulness of credit scoring or profiling, use of automated decision-making, adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policies, and technical and organisational safeguards. The NDPC also warned educational institutions to comply with existing data protection directives. The investigation is ongoing, and the affected parties have not yet publicly responded.