NDPC: NIMC Restricts Third-party Access to Database

The National Identity Management Commission (NIMC) has restricted third-party agents access to the National Identification Number (NIN) database.

This follows the reported incident of unauthorised National Identification Number (NIN) verification by expressverify.com, which an investigation revealed may have been authorised to provide verification services from a third party.

This was disclosed in a statement signed and released by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations, Nigeria Data Protection Commission (NDPC).

The statement reads in part:

“Following the reported incident of unauthorized NIN verification by expressverify.com, investigation reveals that a third-party who, among others, was originally authorized to provide verification services to citizens and genuine businesses might have allowed expressverify.com to use its NIN verification credentials to conduct verification.”

“The circumstances surrounding this permission is still under investigation.
to remedy this incident, National Identity Management Commission (NIMC), in line with established remediation protocols, barred all forms of access to its database.”

“Though necessary, barring all forms of access affected all genuine and crucial verification requests. After a painstaking review, limited access has been granted to few establishments that are providing pivotal public services such as education and security.”

“Ongoing investigation – by relevant agencies – seeks to establish the medium through which expressverify.com obtained the credentials of bona fide third parties and to determine the liability of persons involved in line with extant laws.”

“Furthermore , series of intensive trainings will be conducted in order to ensure that personnel and licensees are abreast of the duty of care and the standard of care mandated by the Nigeria Data Protection Act, NIMC’s Privacy Policy and other relevant regulatory protocols.”

“In the meantime, NDPC calls on members of the public to see NIN as an essential data for sustainable development.”

Earlier in March, the Foundation for Investigative Journalism reported that it uncovered illegal access to NIN’s database by XpressVerify.com. The report revealed that the private website had unrestricted access to every registered Nigerian’s NIN and personal details and had monetised the recovery of NINs and personal information.

The time, NIMC and NDPC announced an investigation into this claim. The NDPC said it “will work with relevant agencies to audit the trails of the alleged unauthorised data processing and monetization of same, and those who are found culpable for violating the Nigeria Data Protection Act, 2023 will be brought to justice.”