NDPC Launches Forensic Investigation into UNILAG, Lotus Bank, and Hackerbella Over Alleged Student Data Privacy Violations
LAGOS, NIGERIA — The Nigeria Data Protection Commission has launched a comprehensive forensic investigation into the University of Lagos, Lotus Bank, and technology firm Hackerbella Limited. The probe follows a wave of public complaints alleging that students highly sensitive personal information was weaponised to open commercial bank accounts without their explicit knowledge or a lawful basis.
The regulatory crackdown was officially confirmed in a statement signed by Babatunde Bamigboye Esq., the Nigeria Data Protection Commission’s Head of Legal, Enforcement, and Regulations. According to the commission, National Commissioner Dr. Vincent Olatunji has ordered an immediate, exhaustive assessment of how the affected data was collected, shared, and managed.
The Catalyst: The Smart ID Card Project
The controversy traces back to a joint initiative launched in March 2026 called the Smart ID Card project. The scheme aimed to merge standard University of Lagos student identity cards with functional Lotus Bank debit cards.
However, an investigative report exposed severe gaps in data governance during the card registration process. While registering for the identity cards, University of Lagos allegedly collected extensive personal data from staff and students, including:
- National Identification Numbers
- Dates of birth
- Residential addresses
- Telephone numbers
The investigation revealed that this data was systematically offloaded to third-party partners Lotus Bank and Hackerbella Limited. Students later complained that bank accounts had been opened in their names without their consent. Furthermore, multiple students reported being forced to activate these pre-created Lotus Bank accounts as a mandatory prerequisite to collecting their physical identity cards, completely contradicting the university’s prior claims that the financial feature was strictly optional.
Scope of the Forensic Probe
The commission’s investigation will deeply scrutinize the institutional mechanics behind the project to determine compliance metrics mandated by the Nigeria Data Protection Act 2023. Regulatory investigators will review:
- Data Protection Impact Assessments: Evaluating whether the organizations legally evaluated privacy risks before linking academic data to banking systems.
- Profiling and Credit Scoring: Analyzing the transparency and lawfulness of any automated student data profiling or credit assessments.
- Consent and Privacy Notices: Examining the adequacy of disclosure notices and whether informed consent was genuinely obtained from students.
- Data Minimization and Safeguards: Checking if the entities strictly limited data collection to what was necessary and deployed sufficient technical infrastructure to shield the data from unauthorized exploitation.
The investigation will also track the exact flow of data packets between the university’s internal servers and the external infrastructure managed by Hackerbella Limited and Lotus Bank. Investigators aim to determine whether any data was exposed to unauthorized intermediaries during transit. They will also look into whether the data processing agreements signed between these entities met the strict criteria set by Nigerian law.
A Warning Shot to Higher Education
In its statement, the Nigeria Data Protection Commission reminded academic bodies that they carry a heightened responsibility to protect communities that trust them with personal information. Institutions must ensure all data processes are handled lawfully, fairly, and transparently.
The regulatory body also issued an ultimatum to all other Nigerian universities, polytechnics, and colleges that have neglected current compliance frameworks, instructing them to implement immediate data protection directives or face similar enforcement procedures.
While the commission clarified that the launch of this probe does not equate to an automatic finding of institutional guilt, it intends to uncover the exact role each party played. Given the commission’s track record, including a historic five hundred and fifty-five point eight million Naira fine levied against another financial institution for non-compliance, the stakes remain incredibly high for the University of Lagos, Lotus Bank, and Hackerbella.
