Data protection commission to probe alleged privacy breach at NIMC

The Nigeria Data Protection Commission (NDPC) has “ordered a full-scale investigation” into the alleged unauthorised access to the database of the National Identity Management Commission (NIMC).

Vincent Olatunji, the national commissioner of NDPC, disclosed this in a statement on Sunday, signed by Babatunde Bamigboye, head of legal, enforcement and regulations at the commission.

The investigation, the NDPC said, is a further regulatory measure to be taken in the wake of public concerns over reports of illegal access to the personal data of enrollees by “a shadowy entity called XpressVerify.com”.

The agency said it has been working with the NIMC on fostering adequacy of data protection, noting that a training session, (in line with the goal) was conducted for relevant officers of NIMC in February.

This, the commission said, is one in a continuum of measures being put in place by the federal government to ensure data privacy and protection.

“We note that NIMC has initiated internal investigation and it has immediately given full assurances of cooperation with NDPC to get to the root of the allegation and to review existing mediums through which any entity may lawfully verify the identity of enrollees on its platform,” the statement reads.

The NDPC promised to collaborate with appropriate agencies to audit the trails of the alleged unauthorised processing and monetisation of data.

“And those who are found culpable for violating the Nigeria Data Protection Act, 2023 will be brought to justice,” the commission said.

The agency further directed that preliminary findings of the investigation should be made public within seven days.

On March 16, a report by the Foundation for Investigative Journalism (FIJ) said XpressVerify has unrestricted access to the national identification numbers (NINs) and personal details of every Nigerian registered in the nation’s identity database managed by NIMC.

The platform is said to have monetised access to NINs and the personal information of citizens on the database.

But the NIMC, in a statement on Sunday, denied having any connection with XpressVerify.

Abisoye Coker-Odusote, the director-general and chief executive officer (CEO) of NIMC, said the commission only offers NIN verification and other services through licensed partners.