Data integrity

The National Identity Management Commission (NIMC) and Nigeria Data Protection Commission (NDPC) are investigating a report of unauthorised…

The National Identity Management Commission (NIMC) and Nigeria Data Protection Commission (NDPC) are investigating a report of unauthorised access to the National Identification Number (NIN) database. This follows a Foundation for Investigative Journalism report that XpressVerify.com has unrestricted access to every registered Nigerian’s National Identification Numbers (NIN) and personal details and has monetised the recovery of NINs and personal information. In a statement on Sunday, NIMC stated that XpressVerify is not one of its verified partners, adding that it has ordered a comprehensive investigation to determine whether any of the commission’s tokenisation verification agents has breached the licensing agreement.

Data security in the country is an afterthought, and despite efforts tailored toward awareness, the actions to reduce theft are abysmal. Sadly, the breach usually comes from entities who should know better. Nigeria’s National Identity Management Commission (NIMC) is facing a perfect storm of public outrage. A recent data breach has exposed serious issues with the agency’s efficiency and data security. Millions of Nigerians are waiting far too long for their National ID cards, with some facing delays of up to six years. This isn’t just an inconvenience; it hinders their access to essential services. The frustration is compounded by the fact that Nigerian banks can provide internationally recognised debit cards within 40 minutes. Making matters worse, a media report revealed unauthorised access to the National Identification Number (NIN) database by XpressVerify.com, a private company. This private website reportedly offered access to Nigerians’ personal details and NINs for a fee. The potential consequences are frightening — identity theft, financial fraud and other criminal activities. Nigerians entrusted the NIMC with their sensitive information, and this breach represents a significant failing. A data breach of this kind puts the government in a needless tight spot, especially because it is less than a year since President Bola Tinubu signed the Nigeria Data Protection Bill into law. This embarrassment could have been avoided with basic transparency initiatives such as publishing the list of the licensed partners the NIMC does business with. These unauthorised data breaches happen partly because of the absence of class action suits by victims of such infractions. The regulatory agencies regularly fine organisations for poor data security, of which the financial technological company Flutterwave was one. However, the state usually pays these fines (when negotiated). Access to justice in Nigeria is one of the lowest in the world, and the slow-grinding nature of the judicial process makes aggrieved individual citizens desensitised to seeking regress. An important way for these issues of poor data management to be curbed is to create special courts for consumer protection rights whose mandates will cover potentially harmful indiscretions. The ecosystem that NIMC aimed to nurture has slipped out of its grasp. Many ecosystem partners have struggled to create profitable ventures using NIMC’s verification services, whether due to intentional actions, incompetence, or a misalignment of interests. Instead of solely focusing on potential data breaches, it is crucial to thoroughly evaluate the entire NIMC framework and how it delivers services through its licensees. This review should also consider the licensees’ operations and potential instances where NIMC may have bypassed its licensees by directly engaging with their key clients. The NIMC must act swiftly to regain public trust or allow banks to handle the process under the oversight and supervision of the government since they have shown the required competence. A thorough investigation into the data breach and strong repercussions for anyone involved is essential. More importantly, the agency needs to streamline its processes to ensure the timely issuance of ID cards. Nigerians deserve a functional and secure National ID system.