Plateau State Public Complaints Commission (PCC), an agency of the state established to investigate complaints of abuse of office, administrative injustice and other forms of official misconduct is allegedly collecting personal information from members of the public through its website with no privacy policy.

According to investigation by Foundation for Investigative Journalism (FIJ), PCC is falling short of a key transparency requirement under Nigeria’s data protection laws.

FIJ found on Tuesday that PCC collects personal information from members of the public through its website despite providing no privacy policy explaining how that information is collected, processed, stored or protected.

The commission serves as the state’s ombudsman, receiving complaints free of charge against public institutions and private organisations on issues including wrongful dismissal, victimisation and administrative negligence.

Yet, while its online complaint portal requests personal information such as names, phone numbers, email addresses, subject lines and complaint details, visitors are given no privacy notice explaining what becomes of that information after it is submitted.

The omission means visitors are not told why their information is being collected, how long it will be retained, the legal basis for processing it or the rights available to them as data subjects.

WHAT IS THE POSITION OF THE LAW?

The guidelines issued by the National Information Technology Development Agency (NITDA) are explicit: every government website is required to have a privacy policy.

Section 10.4 (i, ii) of the NITDA guidelines mandates all government websites to exercise diligence when collecting personal details or information about visitors on their websites.

The requirement is intended to ensure transparency and accountability in the handling of personal information, allowing visitors to understand why their data is collected, how it will be used and the safeguards in place to protect it.

Similarly, the Nigeria Data Protection Act (NDPA) 2023 requires data controllers to provide privacy notices to individuals before, or at the point of, collecting their personal information.

Such notices are expected to disclose, among other things, the purpose for collecting the data, the legal basis for processing it, the period for which it will be retained and the rights available to data subjects.

Section 27 of the NDPA states:

(1) Before a data controller collects personal data directly from a data subject, the data controller shall inform the data subject of the – (a) identity, residence or place of business of, and means of communication with the data controller and its representatives, where necessary;

(b) specific lawful basis of processing under section 25(1) or 30(1) of this Act, and the purposes of the processing for which the personal data are intended;

(c) recipients or categories of recipients of the personal data, if any;

(d) existence of the rights of the data subject under Part VI;

(e) retention period for the personal data;

(f) right to lodge a complaint with the Commission in accordance with section 46 (1) of this Act; and

(g) existence of automated decision-making, including profiling, the significance and envisaged consequences of such processing for the data subject, and the right to object to and challenge such processing.

Without a privacy policy, visitors have no way of knowing the commission’s data-handling practices or the safeguards, if any, in place to protect the personal information they submit through the website.

At press time, the Plateau State Public Complaints Commission’s website had no privacy policy.

Federal government has directed key digital regulators to suspend the implementation of new rules affecting internet platforms and online intermediaries while it develops a unified national regulatory framework.

Dr Bosun Tijani, minister of Communications, Innovation and Digital Economy

The directive was issued on Tuesday by Dr Bosun Tijani, minister of Communications, Innovation and Digital Economy, after chairing a strategic meeting with the leadership of the Nigerian Communications Commission (NCC), the National Information Technology Development Agency (NITDA), and the Nigeria Data Protection Commission (NDPC).

The minister in a statement, said that the rapid growth of the digital economy has created areas where the responsibilities of the three regulators increasingly overlap, particularly in artificial intelligence, online safety, and data protection.

He said that a coordinated approach is needed to provide regulatory clarity, protect investor confidence, and support innovation.

Dr Tijani noted that as part of the directive, the agencies will temporarily halt the implementation of recently introduced guidelines in these overlapping areas.

However, the Minister said that they will continue to carry out their statutory responsibilities within their respective legal mandates.

Dr Tijani said that a Joint Technical Coordination Committee will now be established to work with industry players, academics, and civil society on a single, coherent regulatory framework.

The minister added that the move is designed to improve coordination across government, create a more predictable business environment, and strengthen Nigeria’s position as a leading destination for digital investment in Africa.

Kaspersky’s Global Research and Analysis Team (GReAT) has conducted a major review of the GitHub Actions workflows within top-starred repositories. Leveraging newly introduced Kaspersky Container Security capability, the researchers have discovered 8 repositories with critical misconfigurations that could lead to supply chain compromise.

Open-source components are now indispensable to modern software engineering. However, they also introduce hidden vectors for supply-chain attacks, such as the prominent Mini Shai-Hulud campaign conducted by TeamPCP in May 2026.

This attack exploited weaknesses in GitHub Actions build pipelines and led to the compromise of more than 170 npm and PyPI packages, affecting projects such as TanStack, Mistral AI, and OpenSearch.

In general, misconfigured GitHub Actions workflows can transform trusted development pipelines into dangerous entry points, allowing attackers to compromise automated workflows, introduce malicious code into production environments, or access critical infrastructure keys.

Kaspersky GReAT experts have completed the assessment of GitHub Actions workflows, analysing more than 130,000 pipelines across 30,000 of the platform’s top starred repositories.

Utilising the specialised scanning ruleset introduced in the latest Kaspersky Container Security update, the researchers identified over 250,000 potential misconfigurations in continuous‑integration/continuous‑delivery (CI/CD) processes, underscoring the widespread adoption of insecure configuration practices. Only 10% of the analysed repositories triggered no alerts at all.

Among the discovered issues 59.8 % are classified as low‑risk, 39.8 % as medium‑risk, and 0.4 % fall into the high‑risk category according to Kaspersky taxonomy.

The most frequent issues involve implicitly granted or overly broad access permissions, missing version pinning for dependencies and workflow‑level settings. Fewer repositories expose top-level secrets, use unsafe run conditions, or process external data insecurely, potentially leading to more severe compromises.

Among 200 repositories identified as high-risk, the team discovered 8 repositories with critical flaws that could lead to supply chain compromise. The affected repositories spanned a wide range of use cases, including AI integration in enterprise environments, developer and automation services and security testing tools. The identified critical issues were reported to the respective developer.

“Over the past year, we have observed serious supply-chain attacks, that could have been prevented by following secure CI/CD configuration guidelines,” said Leonid Bezvershenko, senior security researcher at Kaspersky GReAT. “While the uncovered issues do not automatically indicate exploitable vulnerabilities, they point to areas where developers should verify and strengthen configurations.

“By identifying these weaknesses early, organisations can build more resilient pipelines and reduce the likelihood of supply-chain compromise. The rules developed for our container security solution provide a practical framework to identify and remediate these gaps before they can be exploited.”

To detect and mitigate potential security issues caused by misconfigurations, Kaspersky Container Security users can leverage GitHub repository scanning, whether embedded directly into CI/CD pipelines or operated in standalone mode.