Agents of the National Identity Management Commission (NIMC) in Lagos have been selling individuals’ personal information to others for a fee, in violation of Nigerian data laws.
FIJ confirmed this after a source revealed that it was common practice for NIMC agents to release people’s details if given only the phone number of the person whose information is sought.
To verify the claim, FIJ visited Ikeja, the capital of Lagos State, on Friday, where several NIMC agents operate booths outside.
The first man I approached asked if the NIMC details being requested were for someone else or for me. When I told him they were for someone else, he politely refused.
READ ALSO: REPORT: NIMC Is Slow but Its Mobile App Goes Slower
“I don’t do such,” the man said.
The second man I spoke to asked a few questions. I explained that I wanted the details of a man suspected to be a criminal. The agent, apparently not hearing the full explanation, beckoned me closer.
“What do you want?” he asked.
I told him I needed the man’s details, specifically his address.
“That will cost you N1,000,” the agent said.
READ ALSO: Nigerians Bribe Officials to Modify Data Following NIMC Website Frustrations
I agreed and gave him the phone number of a person who had agreed to participate in the story. Within a minute, he displayed the person’s personal information on his tablet, including their residential address, after I read aloud the phone number linked to their National Identification Number (NIN).
I thanked the man, took a photograph of the details on the tablet screen and left.
Next, I approached a female NIMC agent. She asked what details I needed about the person I was looking for, and I repeated the same story I had told the first agent.
“It will cost you N1,000,” the NIMC agent said, muttering to herself. “Do you know his NIN?”
READ ALSO: Nigerians Find Strange, Unregistered Phone Numbers Linked to Their NINs
I explained that I had only the person’s phone number and wanted their address. She said she was unsure if she could retrieve it but would try. After entering the phone number into her tablet, she reported there was no record.
“Let me retry,” she said, tapping a green icon on her screen. “No record found again. I have tried, but it’s not working. I’ll refer you to someone inside the 3C Hub at Computer Village. I don’t know if he will do it because this is illegal, but you can try him.”
Since she could not obtain the details, she asked for N500 instead of the N1,000 we had originally agreed upon. I paid her N500 and left.
READ ALSO: NINCard Illegally Provided ID Services. NIMC Knew 13 Months Ago but Didn’t Shut It Down
When contacted, Kayode Adegoke, head of corporate communications at NIMC, said the commission has never authorised any agent to release personal data or collect anyone’s NIN unlawfully.
“The law is clear: the giver and the receiver are guilty,” he said.
WHAT THE LAW SAYS
Section 26 of the National Identity Management Commission (NIMC) Act, 2007 states that no person or corporate body shall have access to data or information in the National Identity Database about a registered individual except with authorisation by the commission and only if the individual consents or it is necessary for national security, prevention or detection of crime, or other public interest purposes approved by the commission.
For the sake of this report, the individual gave their consent. But the NIMC agent, without authorisation by the commission, released the details of a registered individual without authorisation by the commission.
READ ALSO: EXPOSED: How NIMC Leaked Nigerians’ Data to Fraudulent Verification Agents
Section 28 of this act says that unauthorised access or disclosure of data without lawful authorisation is a criminal offence punishable by imprisonment of not less than 10 years without option of fine. Other offences under this section attract fines of at least N250,000 or imprisonment of not less than three years, or both.
IS FIJ WRONG FOR REQUESTING SOMEONE’S DATA?
Section 25 of the Nigeria Data Protection Act, 2023, (NDPA) states:
(1) Without prejudice to the principles set out in this Act, data processing shall be lawful, where
(a) the data subject has given and not withdrawn consent for the specific purpose or purposes for which personal data is to be processed; or
(b) the processing is necessary-
(i) for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract,
READ ALSO: After FIJ’s Story, Namecheap Suspends Private Website Selling Nigerians’ NIN, Other Data
(ii)for compliance with a legal obligation to which the data controller or data processor is subject,
(iii) to protect the vital interest of the data subject or another person,
(iv) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or data processor, or
(v) for the purposes of the legitimate interests pursued by the data controller or data processor, or by a third party to whom the data is disclosed.
The post DATA FOR CASH: For N1,000 or Less, NIMC Agents Can Give Your Data to Strangers appeared first on Foundation For Investigative Journalism.