Lagos, Nigeria – Just three months after the exposure of XpressVerify, another private website, AnyVerify, has been discovered trading sensitive Nigerian identification data, including Bank Verification Numbers (BVNs). This alarming development has prompted Paradigm Initiative (PIN), an ICT for Development and Digital Rights group, to seek legal redress for the breach of data privacy rights on behalf of Nigerian citizens.
In response to the breach, PIN’s legal partners, Vindich Legal, have issued a pre-action notice to several key government agencies, including the National Identity Management Commission (NIMC), the Nigeria Data Protection Commission (NDPC), the Nigeria Immigration Service (NIS), the Federal Inland Revenue Service (FIRS), the Central Bank of Nigeria (CBN), the Independent National Electoral Commission (INEC), the Federal Road Safety Corps (FRSC), and the Office of the Attorney General of the Federation (AGF).
Legal Demands
Vindich Legal is demanding the following actions from Nigeria’s federal government:
- Declaration of Violation: Recognition that AnyVerify’s unauthorized access and commercialization of Nigerian citizens’ data breaches Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (CFRN).
- Enforcement of Data Protection Measures: Enforcement of Sections 30 and 39 of the Nigeria Data Protection Act (NDPA) 2023, obligating government agencies to implement robust technical and organizational measures to secure citizens’ data.
- Full Investigation and Reporting: A comprehensive investigation into the data leak involving AnyVerify.com.ng, with the findings published publicly.
- Transparency: Public disclosure of the activities of agents and sub-licensees of involved government agencies.
- Compensation: Provision of restitution to individuals affected by the data leak.
Background and Current Situation
PIN revealed that AnyVerify.com.ng has been operating in Nigeria’s digital space since November 2023. The website offers a range of personal data services, including National Identity Number (NIN), BVN, virtual NIN, driving license, international passport details, company information, Tax Identification Number (TIN), Permanent Voter’s Card (PVC), and phone numbers, all for a nominal fee of N100 per data request.
Website Traffic and Reach
The site has seen substantial traffic, with 567,990 visits in February 2024 and 188,360 visits in April 2024. It ranked among the top 3400 websites in Nigeria, receiving at least 68,000 visits in May.
Official Responses and Actions
Following FIJ’s earlier exposé on XpressVerify in March, the NIMC clarified that XpressVerify was not a licensed partner. Similarly, AnyVerify is not listed as a licensed partner on the NIMC’s website. Despite efforts to contact the NDPC and NIMC for comments, phone calls, texts, and emails from FIJ reporters have gone unanswered.
NIMC has yet to release a list of its licensed partners, and FIJ continues to request this information to clarify the status of entities like AnyVerify.
Next Steps
As the situation unfolds, PIN and its legal partners are pressing for immediate government action to safeguard the personal data of Nigerian citizens and to hold those responsible for breaches accountable. The establishment of stringent data protection measures and transparent operations within government agencies are critical to preventing further data privacy violations.