Get Guardian on GoogleSocio-Economic Rights and Accountability Project (SERAP) has urged President Bola Tinubu to direct the Nigeria Data Protection Commission (NDPC) to investigate allegations of AI-generated photographs and manipulation of personal data in the preliminary Register of Voters published by the Independent National Electoral Commission (INEC).
SERAP called on Tinubu to direct the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, to conduct a prompt, thorough and independent investigation into the reported irregularities ahead of the 2027 General Elections.
The organisation also urged the commission to establish the nature and extent of the irregularities, determine whether they constitute a breach of the Nigeria Data Protection Act 2023, identify those responsible and ensure affected Nigerians can verify and correct their records without being unfairly excluded from the electoral process.
In a letter at the weekend, signed by its Deputy Director, Kolawole Oluwadare, SERAP said the reported irregularities raised serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voters’ register.
The organisation’s demand follows INEC’s publication of the preliminary Register of Voters and its acknowledgement of suspected AI-generated photographs and questionable registration records identified during the nationwide display of the register from October 9 to 15, 2026.
According to SERAP, INEC, in a statement issued on October 27, acknowledged public concerns over suspected AI-generated photographs appearing in the preliminary register published on its website.
The electoral commission reportedly said that several questionable registration records were identified and flagged for further examination during the physical display of the register nationwide.
INEC also stated that it had commenced a review and was taking appropriate corrective action, while examining the circumstances surrounding the suspicious photographs, including possible technical or procedural lapses.
SERAP, however, maintained that an internal review by INEC could not replace an independent investigation by the NDPC, given the commission’s statutory responsibility for data protection.
It urged the NDPC to conduct an independent forensic examination of the affected database and systems to determine whether personal data were unlawfully accessed or altered and whether INEC complied with the provisions of the Nigeria Data Protection Act 2023.
The organisation further called on the data protection commission to determine whether the incidents constituted a personal data breach under Section 65 of the Act and whether INEC fulfilled its applicable notification and record-keeping obligations.
Citing Sections 24 and 39 of the Act, SERAP said personal data must be processed accurately and securely and protected against unlawful alteration, loss or unauthorised access.
It also referred to Section 40, which requires data controllers to notify the NDPC of a breach likely to pose risks to individuals’ rights and freedoms within 72 hours of becoming aware of it.
