The National Identity Management Commission (NIMC), has restricted its licensed agents’ access to the National Identification Number (NIN) database following an ongoing investigation of an incidence of unauthorized access by expressverify.com
This was disclosed in a statement released on Friday by the Nigeria Data Protection Commission (NDPC) which is investigating the incidence of data breach at NIMC.
According to NDPC, the ongoing investigation has revealed that a third party which, among others, was originally authorized to provide verification services to citizens and genuine businesses might have allowed expressverify.com to use its NIN verification credentials to conduct verification.
While noting that the circumstances surrounding this permission are still under investigation, the Commission in a statement Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, said:
The NDPC added that the ongoing investigation by relevant agencies seeks to establish the medium through which expressverify.com obtained the credentials of bona fide third parties and to determine the liability of persons involved in line with extant laws.
The NDPC calls on members of the public to see NIN as essential data for sustainable development. According to the Commission, while existing technical and organizational measures are being strengthened to ensure the protection of this data, citizens need to ensure that they are not left unidentified in various frameworks for development.
The National Commissioner of the Commission of the NDPC, Dr. Vincent Olatunji, had earlier this month ordered a full-scale investigation in the wake of public concerns over reports of illegal access to personal data of enrollees by a shadowy entity called XpressVerify.com.
The Commission added that NIMC had also initiated an internal investigation and gave full assurances of cooperation with NDPC to get to the root of the allegation and to review existing mediums through which any entity may lawfully verify the identity of enrollees on its platform.
The NDPC said it would work with relevant agencies to audit the trails of the alleged unauthorized data processing and monetization of same, and those who are found culpable for violating the Nigeria Data Protection Act, 2023 would be brought to justice.
Earlier, an FIJ in a report had alleged that expressverify.com, a private website, has unrestricted access to the National Identification Numbers (NINs) and personal details of every registered Nigerian. It added that the website has monetized the recovery of NINs and personal information on the Nigerian identification database.
