Data Breach: Paradigm Initiative uncovers website selling personal data of Nigerians

A website selling the personal data of Nigerians illegally online has been uncovered by Paradigm Initiative

In a publication titled, “Major Data Breach: Sensitive Government Data of Nigerian Citizens Available Online for Just 100 Naira,” on Thursday, the Paradigm Initiative said the disturbing incident was a major breach of fundamental rights to privacy.

According to the digital hub, AnyVerify.com.ng distributes personal and private data of Nigerians under the guise of providing verification services.

It stressed that a breach of data privacy rights posed risks to individuals and the economy.

According to Paradigm Initiative, the website claims to verify data such as National Identity Number (NIN), Bank Verification Number (BVN), Driving Licence, International Passport, Tax Identification Number (TIN), Permanent Voter’s Card (PVC), and phone numbers, among others.

However, “all these are sold by this website to any interested party for the sum of N100.00 for each data request,” the report stated.

“Due to the severe implication for millions of Nigerians, we have through our legal partners, Vindich Legal, served a pre-action notice to the following government agencies: National Identity Management Commission (NIMC), Nigeria Data Protection Commission (NDPC), Nigeria Immigration Service (NIS), Federal Inland Revenue Service (FIRS), Central Bank of Nigeria (CBN), Independent National Electoral Commission (INEC), Federal Road Safety Corps (FRSC) and the office of the Attorney General of the Federation (AGF),” the report added.

This is not the first time a private website will be linked to the illicit sale of data of Nigerians. In March this year, an online media outlet, the Foundation for Investigative Journalism published an investigative story detailing how XpressVerify, a private website, accesses data of Nigerians for personal gain.

FIJ found that the website had access to the National Identification Number (NIN) and personal details of every registered Nigerian, and for as little as N200, anyone could access details such as phone numbers, NIN, address and even photographs.

Breach of Data Laws

The 1999 Constitution (as amended) recognises privacy as a fundamental human right and guarantees the protection of citizens, their homes, correspondence, telephone conversations and telegraphic communications. This birthed the enactment of the Nigerian Data Protection Act 2023 and establishment of the Nigeria Data Protection Commission.

Among other things, the commission is responsible for regulating the deployment of technology and organisational measures to facilitate data protection.

ALSO READ: EFCC, ICPC warn Nigerians to guard data against cybercrimes

The Act provides guidelines on the management of personal data to institutions and agencies of government such as the National Identity Management Commission, which handles the national database of Nigerians.

Section 26 (1) of the National Identity Management Commission Act 2007 makes it unlawful for the commission to give out information of Nigerians contained in the database, except for reasons bothering on national security.

“No person or body corporate shall have access to the data or information contained in the Database with respect to a registered individual entry except with the authorisation of the Commission and only if: (a) an application for the provision of the information to that person is made by or with the authority of that individual; or (b) that individual otherwise consents to the provision of that information to that person,” the Act stated.

“When these regulations are flouted, citizens’ privacy, economic stability, personal safety and financial security are compromised, a cyber security expert,” Adedeji Adedoyin explained.

“As more people depend on online services for their daily activities, they do it in trust that the managers behind these online services will do everything to protect their personal information from illegal exposure and personal risk. But as we have seen over time, enough is not done by these businesses and government agencies to put measures in place to prevent the exposure and sales of private data, which unfortunately has led to personal and financial losses,” he added.

Paradigm Initiative is a social enterprise that builds information and communications technology (ICT)-enabled support systems and advocates digital rights in order to improve livelihoods for underserved youths.