Data Protection Commission Launches Probe into Alleged Privacy Breach at NIMC

The Nigeria Data Protection Commission (NDPC) has initiated a comprehensive investigation into reports of unauthorized access to the National Identity Management Commission (NIMC) database. Vincent Olatunji, the national commissioner of NDPC, announced this in a statement on Sunday, signed by Babatunde Bamigboye, head of legal, enforcement, and regulations at the commission.

The probe follows public outcry over allegations of illicit access to enrollees’ personal data by an entity known as XpressVerify.com. NDPC revealed its collaboration with NIMC on enhancing data protection, including a training session conducted for NIMC officers in February.

“We note that NIMC has initiated an internal investigation and has assured full cooperation with NDPC to address the allegation,” the statement reads, emphasizing the government’s commitment to data privacy and protection.

The NDPC pledged to work with relevant agencies to audit the trails of unauthorized data processing and monetization, promising to hold those accountable under the Nigeria Data Protection Act, 2023.

Preliminary findings of the investigation are expected to be made public within seven days, according to NDPC directives.

A recent report by the Foundation for Investigative Journalism (FIJ) uncovered that XpressVerify allegedly had unrestricted access to the national identification numbers (NINs) and personal details of Nigerian citizens registered in NIMC’s database. The platform purportedly monetized access to this information.

In response, NIMC, through its director-general and CEO, Abisoye Coker-Odusote, denied any association with XpressVerify, clarifying that the commission only provides NIN verification and other services through licensed partners.