Paradigm Initiative (PIN) says it is holding the National Identity Management Commission (NIMC), and other government institutions accountable for the alleged mishandling of the personal data of Nigerians in their custody.
Gbenga Sesan, Executive Director of Paradigm Initiative (PIN), says the commission, which serves as the custodian of the private data of Nigerians, has allegedly mishandled sensitive personal data.
Speaking at PIN’s year-end media briefing in Ikeja, Lagos, on Wednesday, Sesan says that NIMC has been both a “partner and a target” in PIN’s strategic litigation efforts aimed at securing justice for Nigerians affected by these data leaks.
Sesan’s comments were made in reference to PIN’s lawsuit filed against NIMC and other government agencies over the alleged sale of Nigerians’ personal information via the AnyVerify portal. This portal, uncovered by PIN, reportedly sold National Identification Numbers (NINs) and other private data without the consent of the individuals involved.
PIN: NIMC failed to safeguard sensitive data of Nigerians
Sesan’s comments were made in reference to PIN’s lawsuit filed against NIMC and other government agencies over the alleged sale of Nigerians’ personal information via the AnyVerify portal. This portal, uncovered by PIN, reportedly sold National Identification Numbers (NINs) and other private data without the consent of the individuals involved.
Sesan accused NIMC of failing to safeguard citizens’ data, saying that their claims of a data fix in April were false. “In July, we did our internal research and we found out that what NIMC said had been fixed in April was not fixed. In fact there was a new platform that had started,” Sesan explains. “So initially, it had various names but now we found one called Any Verify.com.ng … we had reported these issues multiple times without action, we decided to do what will get the attention of the government.” Sesan says.
In response, PIN escalated the matter, purchasing the personal data of key government officials to draw attention to the case. “We bought the data of the Minister for Communications and Digital Economy, the Director General of the National Data Protection Commission, and even executives in the judiciary and legislature,” he explains, saying that “we decided to try if they will care if the data of senior Nigerians is being sold.”
In response, PIN escalated the matter, purchasing the personal data of key government officials to draw attention to the case. “We bought the data of the Minister for Communications and Digital Economy, the Director General of the National Data Protection Commission, and even executives in the judiciary and legislature,” he explains, saying that “we decided to try if they will care if the data of senior Nigerians is being sold.”
Sesan states that the next hearing for the case is set for January 22, 2025, at the High Court in Abuja. For PIN, the case centers on three key objectives: first, “to establish that this happened. Second is to make sure that we invoke the powers of the NDPC (Nigeria Data Protection Commission) and the third, which is the most important, is that anybody who is responsible should be punished,” the PIN Executive Director says.
The Data Protection Act, which came into effect in 2023, was designed to regulate the collection, storage, and use of personal data in Nigeria. It includes provisions for individuals to seek redress if their data is improperly used. Sesan notes that the Act grants Nigerians legal recourse in cases where their personal data is sold or exposed, offering a new avenue for individuals to protect their privacy.
NIMC, as the body responsible for managing Nigeria’s national identity system, has faced criticism for its inadequate data protection measures. In 2021, concerns were raised when the commission’s servers were reportedly vulnerable to attacks, risking the exposure of citizens’ personal information. These issues were compounded by the AnyVerify scandal in June, which PIN claims resulted in widespread data exploitation.
Sesan also stressed that the litigation is part of PIN’s broader mission to improve digital rights in Nigeria and enforce stronger data protection laws.
In addition to NIMC, PIN has included several other agencies in the lawsuit, including the Central Bank of Nigeria (CBN) over the Bank Verification Number (BVN) database, the Nigerian Interbank Settlement Systems (NIBSS), Nigeria Immigration Service, among others.
Sesan also expressed concerns over the handling of personal data on passports, saying that it was a violation of privacy to include National Identification Numbers (NINs) on public documents. He argues that the NIN is like a social security number, and it should not be on any public document.
Home