UNILAG Accused of Violating Students’ Data Rights in Smart ID Card Project

FIJ’s investigation alleges that UNILAG, in partnership with Lotus Bank and Heckerbella, violated multiple Nigerian data protection laws by collecting students’ and staff members’ personal data to issue Smart ID cards and open bank accounts without adequate consent, transparency, or privacy safeguards.

An investigation by the Foundation for Investigative Journalism (FIJ) has alleged that the University of Lagos violated Nigerian data protection laws while implementing its Smart ID Card project in partnership with Lotus Bank and Heckerbella Limited.

The Smart ID Card initiative, introduced during the 2025/2026 academic session, required students and staff to submit personal information such as their National Identification Number (NIN), residential address, phone number, and date of birth. The cards were designed to serve as identification, campus access cards, and digital payment tools linked to Lotus Bank accounts.

According to FIJ, the consent form used during registration failed to meet several requirements of Nigeria’s data protection laws. The investigation found that users were not properly informed of their right to withdraw consent, their rights over personal data, how long their data would be stored, or how to file complaints with regulators. It also allegedly failed to clearly disclose that personal information would be shared with Lotus Bank and processed through Heckerbella’s platform.

Data protection lawyer Habeeb Eyinade told FIJ that while UNILAG may have a legitimate interest in issuing identification cards, opening bank accounts for students and staff requires informed consent and full disclosure. He also stated that the university should have conducted a Data Protection Impact Assessment before launching the project.

Several students interviewed by FIJ said they did not want the Lotus Bank accounts opened in their names. Some claimed they were unaware their information would be used for that purpose, while others said they were instructed to activate the accounts and, in some cases, deposit money before collecting their Smart ID cards, despite assurances that account activation was optional.

One student reported being unable to withdraw money deposited into the account due to additional requirements. Others described the accounts as unnecessary, particularly final-year students who already had existing bank accounts.

FIJ also noted that neither the registration portal nor UNILAG’s website provided an accessible privacy policy, which it argued is required under the Nigeria Data Protection Act (NDPA).

In response, UNILAG denied misusing personal data and maintained that the project complies with Nigerian privacy laws. The university stated that all information collected was used only for legitimate purposes related to identity verification and card administration. However, it acknowledged reports that students were being required to activate Lotus Bank accounts before receiving their cards and said card distribution had been temporarily suspended while the process was reviewed.

Lotus Bank acknowledged receiving FIJ’s enquiries and said the matter had been escalated for review. Heckerbella declined detailed comments, citing a non-disclosure agreement with the university.

The investigation also revealed that Lotus Bank has launched similar Smart ID partnerships with institutions such as Lagos State University, University of Ilorin, and Yaba College of Technology.

FIJ concluded that, while UNILAG presented the project as part of its digital transformation agenda, the process of collecting and using students’ personal data appeared to fall short of Nigeria’s privacy and data protection standards.

REAS ALSO: Trouble as Mother Calls JAMB Out Over Breach of Privacy

SOURCES: ALLSCHOOL, FIJ