NIMC restricts licensed agents’ access to NIN database

Data breach: NIMC restricts licensed agents’ access to NIN database.

The National Identity Management Commission (NIMC), has restricted its licensed agents’ access to the National Identification Number (NIN) database following an ongoing investigation of an incidence of unauthorized access by expressverify.com

What happened?

A statement was released on Friday by the Nigeria Data Protection Commission (NDPC), which is investigating the incidence of data breaches at NIMC.

According to NDPC, the ongoing investigation has revealed that a third party which, among others, was originally authorized to provide verification services to citizens and genuine businesses might have allowed expressverify.com to use its NIN verification credentials to conduct verification.

While noting that the circumstances surrounding this permission are still under investigation, the Commission, in a statement by Head of Legal, Enforcement, and Regulations, Babatunde Bamigboye, said:

“To remedy this incident, the National Identity Management Commission (NIMC), in line with established remediation protocols, barred all forms of access to its database.

“Though necessary, barring all forms of access affected all genuine and crucial verification requests.

“After a painstaking review, limited access has been granted to a few establishments that are providing pivotal public services such as education and security.”

Must read also: Internet Disruption In Ghana and Parts Of Africa

The NDPC added that the ongoing investigation by relevant agencies seeks to establish the medium through which expressverify.com obtained the credentials of bona fide third parties and to determine the liability of persons involved in line with existing laws.

“At the moment, data processing by licensees is generally to be scrutinized, and only those that are cleared based on credible evidence of regulatory compliance will be permitted to carry out NIN verification going forward.”

“Furthermore, a series of intensive trainings will be conducted to ensure that personnel and licensees are abreast of the duty of care and the standard of care mandated by the Nigeria Data Protection Act, NIMC’s Privacy Policy, and other relevant regulatory protocols,” it said.

The NDPC calls on members of the public to see NIN as essential data for sustainable development. According to the Commission, while existing technical and organizational measures are being strengthened to ensure the protection of this data, citizens need to ensure that they are not left unidentified in various frameworks for development.

The back story

The National Commissioner of the Commission of the NDPC, Dr. Vincent Olatunji, had earlier this month ordered a full-scale investigation in the wake of public concerns over reports of illegal access to personal data of enrollees by a shadowy entity called XpressVerify.com.

The Commission added that NIMC had also initiated an internal investigation and gave full assurances of cooperation with NDPC to get to the root of the allegation and to review existing mediums through which any entity may lawfully verify the identity of enrollees on its platform.

The NDPC said it would work with relevant agencies to audit the trails of the alleged unauthorized data processing and monetization of same, and those who are found culpable for violating the Nigeria Data Protection Act, 2023, would be brought to justice.

Earlier, an FIJ in a report had alleged that expressverify.com, a private website, has unrestricted access to the National Identification Numbers (NINs) and personal details of every registered Nigerian. It added that the website has monetized the recovery of NINs and personal information on the Nigerian identification database.