A coalition of seven civic-technology and civil society organisations has called on the Independent National Electoral Commission (INEC) to take stronger and more transparent action following the unauthorised disclosure of a registered voter’s personal data by a senior government official.
The joint statement, signed by groups including BudgIT, Enough is Enough Nigeria, and the Centre for Journalism Innovation and Development (CJID), responds to an incident in which Lere Olayinka, Senior Special Assistant to FCT Minister Nyesom Wike, publicly disclosed the personal data of actor Emeka Ike, who is a registered voter.
INEC confirmed in an earlier press release that the data was accessed using valid staff credentials during the ongoing Continuous Voter Registration (CVR) exercise and subsequently released without authorisation.
The commission described it as a case of misuse of authorised access, rather than an external hack. It said only a single voter record was involved, with no broader compromise of the database of over 90 million registered voters.
The organisations acknowledged INEC’s response as timely but said it fell “short of the transparency, urgency, and systemic reforms required.”
The statement highlights that voter records contain sensitive personal information — including photographs, Voter Identification Numbers, registration details, and transfer histories and that their exposure “can enable harassment, voter intimidation, or manipulation, particularly in a politically charged environment.”
The groups noted that the data was disclosed not by a random individual, but by a political appointee connected to the ruling establishment, a fact they described as “a source of great concern to Nigerians.”
They also warned of the chilling effect such incidents could have on civic participation, arguing that citizens must be assured that registering to vote will not expose them to political surveillance, profiling, or retaliation.
The coalition pointed to several legal obligations INEC must fulfil. Under the Nigeria Data Protection Act (NDPA) 2023, INEC, as a data controller, is required to notify the Nigeria Data Protection Commission (NDPC) within 72 hours of a breach that poses a risk to data subjects’ rights, and to inform affected individuals where the breach is likely to cause high risk.
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, the organisations noted, criminalises the misuse of access credentials to obtain and disclose restricted information, even where the initial access was authorised and carries penalties including fines and imprisonment. The Electoral Act separately prohibits actions that undermine the integrity of the voter register.
The organisations issued a list of specific demands to INEC, including: A detailed public timeline of the breach, covering when it was discovered, the exact data exposed, and the steps taken to protect the affected individual, Published outcomes of the internal audit and disciplinary actions against implicated staff, Strengthened access controls for the CVR system, including multi-factor authentication and regular independent security audits, Full engagement with the NDPC and compliance with breach notification requirements and Collaboration with law enforcement to arrest and prosecute both perpetrators and enablers.
The groups also directed a message at those responsible for the leak: “Weaponising citizens’ personal data for political scoring is unacceptable and unethical in a democratic environment.”
With preparations for the 2027 general elections intensifying, the organisations stressed that public confidence in the voter register is “a cornerstone of electoral legitimacy” and that any perception of partisan misuse of voter data poses a direct threat to that confidence.
“Our democracy depends on a trusted electoral management body and an umpire that safeguards both the integrity of elections and the privacy of voters,” the statement read.
The coalition stated that it would continue to monitor developments and stands ready to collaborate with INEC, the NDPC, and security agencies to enhance Nigeria’s electoral data infrastructure.
Signatories: Policy Shapers, Accountability Lab Nigeria, BudgIT, PROMAD, Brain Builders Youth Development Initiative, Centre for Journalism Innovation and Development (CJID), Enough is Enough (EiE) Nigeria
