The Socio-Economic Rights and Accountability Project (SERAP) has urged President Bola Tinubu “to direct Dr Vincent Olatunji, National Commissioner/Chief Executive Officer of the Nigeria Data Protection Commission (NDPC) to promptly, thoroughly, independently and effectively investigate the reported introduction of suspected artificial intelligence (AI)-generated photographs, alleged alterations to personal data and other questionable records in the preliminary Register of Voters published by the Independent National Electoral Commission (INEC).”
According to SERAP, the call follows INEC’s acknowledgement that suspected AI-generated photographs and questionable registration records were identified during the nationwide display of the register from 9 to 15 October 2026.
In view of that, SERAP urged the President “to ensure that the NDPC establishes the nature and extent of the reported irregularities, determines whether any personal data breach has occurred under the Nigeria Data Protection Act 2023, identifies those responsible, and ensures that affected Nigerians can verify and correct their records without being unfairly excluded from the electoral process.”
In the letter dated 31 October 2026 and signed by SERAP deputy director Kolawole Oluwadare, the organisation said: “The reported irregularities raise serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voter register ahead of the 2027 general elections.”
SERAP said: “The security and accuracy of the voter register are fundamental to the protection of Nigerians’ personal data and their right to participate in public affairs. Nigerians should not have to worry that their personal information could be altered, manipulated or accessed without proper safeguards.”
The letter, read in part: “INEC’s acknowledgement of questionable records and suspected AI-generated photographs makes an independent investigation particularly important. The public needs to know what happened, whether the law was breached and what measures are being taken to prevent a recurrence.”
“The NDPC should exercise its statutory powers independently and without delay. Any investigation must establish the facts, protect affected voters and ensure that those responsible for any unlawful conduct are held accountable.”
“We would be grateful if the requested measures are taken within seven days of the receipt and/or publication of this letter. If we have not heard from you by then, SERAP shall consider appropriate legal actions and other lawful measures to compel your government, the NDPC, INEC and other relevant authorities to comply with our requests in the public interest.”
“The proposed investigation should establish the nature and extent of the reported irregularities, including the number and geographical distribution of affected records, when and how they were created or altered, and the persons or institutions responsible.”
“The introduction of questionable records, including photographs suspected to have been artificially generated, raises legitimate concerns about the accuracy and reliability of the register and the safeguards protecting its integrity.”
“SERAP is concerned that the reported irregularities may involve the unlawful alteration or processing of personal data, possible misuse of authorised access credentials and failures to ensure the accuracy, integrity and security of personal data held and processed by INEC.”
“SERAP urges you to ensure that the NDPC conducts an independent forensic examination of the affected database and systems to determine whether personal data were unlawfully accessed or altered and whether INEC complied with the Nigeria Data Protection Act 2023.”
“SERAP further urges you to ensure that the NDPC determines whether the incidents constitute a personal data breach under section 65 of the Act and whether INEC has complied with its applicable notification and record-keeping obligations.”
“Where violations are established, appropriate corrective measures should be required, including stronger security safeguards and accessible procedures for affected voters to verify and correct their records without wrongful exclusion.”
“The NDPC should publish its findings and recommendations, subject to lawful protections, and ensure accountability where wrongdoing is established.”
“According to INEC’s statement of 27 October 2026, the Commission acknowledged public concerns regarding ‘suspected AI-generated photographs appearing in the Preliminary Register of Voters’ published on its website.”
“INEC stated that, during the physical display of the register nationwide from 9 to 15 October 2026, ‘a number of questionable registration records were identified and flagged for further examination’. The Commission said it had commenced a review and was taking ‘appropriate corrective action’.”
“INEC also acknowledged that the online publication ‘does not reflect all ongoing data-cleanup activities’ and that it was ‘examining the circumstances surrounding the suspicious photographs, including possible technical or procedural lapses’.”
“The Commission stated that the preliminary register was not the final certified register and undertook to complete the necessary verification, adjudication and data-cleanup processes before certifying the final Register of Voters on 15 December 2026.”
“INEC has reportedly acknowledged the existence of questionable voter-registration records and indicated that some registration officers may have used their official access credentials to introduce irregular records, including photographs suspected to have been generated using artificial intelligence.”
“While the Commission has indicated that it is reviewing the matter, an independent investigation by the NDPC is necessary to establish the full circumstances, determine the extent of the irregularities and ensure accountability.”
“An internal review by INEC cannot substitute for the NDPC’s independent exercise of its statutory data-protection mandate.”
“The reported irregularities in INEC’s voter-registration database are particularly concerning because the database contains the personal data of millions of Nigerians and is fundamental to the exercise of their constitutional and democratic rights.”
“Any unlawful alteration, manipulation or compromise of this information could undermine public confidence in the electoral process, compromise the accuracy and reliability of the voters’ register, and expose eligible voters to the risk of wrongful exclusion.”
“The Nigeria Data Protection Act 2023 gives the NDPC clear powers to investigate possible violations, obtain relevant information and documents, and require compliance by data controllers and processors. Sections 24 and 39 of the Act require personal data to be processed accurately and securely, and protected against unlawful alteration, loss or unauthorised access.”
“Section 65 of the Act defines a personal data breach to include a breach of security leading, or likely to lead, to the unlawful alteration, loss, unauthorised disclosure of or access to personal data.”
“Under section 40, data controllers must notify the NDPC of a breach likely to pose a risk to individuals’ rights and freedoms within 72 hours of becoming aware of it, and communicate the breach to affected individuals where it is likely to result in a high risk. The Act also requires the maintenance of records of personal data breaches.”
“Your government has a responsibility to ensure that the personal data of Nigerians held by INEC are adequately protected against unlawful access, alteration, manipulation and disclosure.”
“The reported involvement of registration officers with authorised access to the database makes it particularly important to establish whether adequate safeguards were in place and whether those safeguards were circumvented or misused. The use of authorised credentials does not, by itself, establish that subsequent access or processing was lawful or within the scope of the officer’s authority.”
“The reported irregularities also raise concerns about Nigerians’ constitutional and international human rights, including the rights to privacy and political participation.”
“Section 37 of the Nigerian Constitution 1999 (as amended) guarantees the right to privacy. Article 13 of the African Charter on Human and Peoples’ Rights and Article 25 of the International Covenant on Civil and Political Rights protect citizens’ rights to participate freely in government and to vote in genuine elections.”
“These rights require effective safeguards to ensure that eligible voters are not arbitrarily prevented from exercising their political rights.”
“The integrity and accuracy of the Register of Voters are indispensable to the effective exercise of the rights to participate in public affairs and to vote in genuine elections. The reported irregularities must be treated with the seriousness they deserve.”
“INEC has indicated that it will complete the necessary verification and data-cleanup exercises before certification of the final Register of Voters. It is therefore essential that the reported irregularities are independently investigated and effectively addressed before the register is finalised.”
“Nigerians must be able to trust that the register on which the 2027 general elections will be conducted is accurate, reliable and adequately protected against manipulation.”
“The protection of personal data, the integrity of electoral institutions and the effective exercise of political rights are mutually reinforcing obligations under the Nigerian Constitution and international human rights law.”
“A failure to address the reported irregularities transparently and effectively risks undermining public confidence in the electoral process and the rights of Nigerians to participate freely in public affairs.”
