LAGOS, Nigeria — The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and technology vendor Heckerbella Limited (also referenced as Hackerbella Ltd) following public complaints over the alleged unauthorized creation of commercial bank accounts using students' personal data.
The regulatory probe stems from allegations that personal information collected from students for university administration purposes—specifically a mandatory "Smart ID Card" initiative—was funneled to Lotus Bank without explicit consent, resulting in unauthorized account openings.
Scope of the Investigation
Dr. Vincent Olatunji, National Commissioner and Chief Executive Officer of the NDPC, directed the commission’s enforcement unit to conduct a comprehensive assessment of the data collection, transfer, and processing pipeline.
The investigation will evaluate compliance under the Nigeria Data Protection Act (NDPA) 2023, focusing on key areas:
- Lawful Basis & Consent: Assessing whether explicit, informed, and uncoerced consent was obtained from students prior to transmitting sensitive credentials—including National Identification Numbers (NIN), home addresses, and phone numbers—to a third-party commercial bank.
- Vendor Operations: Examining the role of Heckerbella Limited, the IT vendor that hosted the registration platform and managed data capture operations.
- Data Protection Impact Assessment (DPIA): Verifying if mandatory impact assessments and risk analyses were conducted prior to executing data-sharing agreements between the institution, the vendor, and the financial institution.
- Automated Decision-Making & Profiling: Investigating automated profiling and credit scoring arrangements linked to the student data pipeline.
Statutory Penalties and Regulatory Warnings
Under the NDPA 2023, data controllers and processors designated as entities of major importance face severe regulatory actions if found liable, including mandatory corrective orders, financial compensation to affected data subjects, and administrative fines of up to ₦10 million or 2% of annual gross revenue.
In a official directive, the NDPC emphasized that higher institutions carry a heightened duty of care when handling student records.