SERAP Demands Independent Probe Of AI-Generated Images, Altered Records In INEC Voter Register

Firdaus Obiremi

The Socio-Economic Rights and Accountability Project has called for an independent investigation into alleged manipulation of voters’ personal data and the insertion of suspected artificial intelligence-generated photographs into the Independent National Electoral Commission’s preliminary Register of Voters ahead of the 2027 general elections.

The organisation urged President Bola Tinubu to direct the National Commissioner and Chief Executive Officer of the Nigeria Data Protection Commission, Dr Vincent Olatunji, to investigate the allegations, establish the extent of the suspected irregularities and identify those responsible.

SERAP warned that failure to independently investigate the matter could undermine the credibility of the electoral register, expose millions of Nigerians’ personal information to potential abuse and jeopardise the voting rights of eligible citizens.

The organisation made the demands in an open letter dated October 31, 2026, and signed by its Deputy Director, Kolawole Oluwadare.

It argued that the allegations raised serious questions about the security, accuracy and integrity of the country’s voter-registration database, insisting that INEC’s internal investigation should not replace an independent inquiry by the data protection regulator.

The development follows INEC’s October 27 acknowledgement of concerns surrounding suspected AI-generated photographs discovered in its preliminary voters’ register.

The electoral commission had disclosed that questionable registration records were identified during the nationwide display of the preliminary register between October 9 and 15, 2026.

INEC said some of the records had been flagged for further examination and that investigations were ongoing to establish the circumstances surrounding the appearance of the suspicious photographs, including possible technical and procedural lapses.

The commission also maintained that the online preliminary register did not reflect all its ongoing data-cleaning activities, stressing that the document was not the final certified register.

It said verification, adjudication and other corrective exercises would be concluded before the final Register of Voters is certified on December 15, 2026.

However, SERAP insisted that the commission’s internal review was insufficient to address the broader implications of the alleged manipulation, particularly the possible violation of Nigerians’ data protection and constitutional rights.

The organisation called on the NDPC to conduct a comprehensive forensic examination of INEC’s voter-registration database and related information technology systems to establish the nature, scale and geographical spread of the suspected irregularities.

It also urged the commission to determine when and how the questionable records were created or altered and identify the individuals or officials responsible.

SERAP specifically called for an investigation into whether registration officers or other personnel misused their authorised access credentials to introduce suspicious photographs or manipulate voters’ personal information.

It stressed that possession of official access credentials did not automatically make every action carried out with them lawful.

The organisation further asked the NDPC to establish whether personal data belonging to Nigerians had been unlawfully accessed, altered, processed or exposed and whether INEC complied with the provisions of the Nigeria Data Protection Act 2023.

Citing Sections 24 and 39 of the Act, SERAP said data controllers were legally required to ensure the accuracy, integrity and security of personal information in their custody and protect such information against unlawful alteration, loss and unauthorised access.

It also referenced Section 65, which defines a personal data breach to include a security incident resulting, or likely to result, in the unlawful alteration, loss, disclosure of or access to personal information.

According to the organisation, Section 40 of the Act requires data controllers to notify the NDPC within 72 hours of becoming aware of a breach likely to pose risks to the rights and freedoms of individuals.