The Socio-Economic Rights and Accountability Project (SERAP) has urged President Bola Tinubu to direct the Nigeria Data Protection Commission (NDPC) to investigate suspected artificial intelligence (AI)-generated photographs and alleged alterations to personal data in the preliminary Register of Voters published by the Independent National Electoral Commission (INEC).
SERAP also called for an independent investigation to establish the extent of the reported irregularities, identify those responsible and ensure that affected Nigerians can verify and correct their records without being unfairly excluded from the electoral process.
Politics Nigeria reports that the organisation made the demands in a letter dated October 31, 2026, and signed by its deputy director, Kolawole Oluwadare.
The letter followed INEC’s acknowledgement of suspected AI-generated photographs and questionable registration records identified during the nationwide display of the preliminary register between October 9 and 15, 2026.
SERAP urged Tinubu to direct Dr Vincent Olatunji, the National Commissioner and Chief Executive Officer of the NDPC, to investigate the matter and determine whether any personal data breach occurred under the Nigeria Data Protection Act 2023.
“The reported irregularities raise serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voter register ahead of the 2027 general elections,” SERAP said.
It added that the security and accuracy of the voters’ register were fundamental to protecting Nigerians’ personal data and their right to participate in public affairs.
“Nigerians should not have to worry that their personal information could be altered, manipulated or accessed without proper safeguards,” the organisation stated.
SERAP further called on the NDPC to conduct an independent forensic examination of INEC’s affected database and systems to establish whether personal data were unlawfully accessed or altered.
It also urged the commission to determine whether the incidents constituted a personal data breach under Section 65 of the Nigeria Data Protection Act 2023 and whether INEC fulfilled its notification and record-keeping obligations.
The organisation said the investigation should establish the number and geographical distribution of affected records, when and how they were created or altered, and the individuals or institutions responsible.
“An internal review by INEC cannot substitute for the NDPC’s independent exercise of its statutory data-protection mandate,” SERAP stated.
It expressed concern that the irregularities might involve unlawful alteration or processing of personal data, possible misuse of authorised access credentials and failures to protect information held by INEC.
SERAP also noted that Sections 24 and 39 of the Nigeria Data Protection Act 2023 require personal data to be processed accurately and securely and protected against unlawful alteration, loss or unauthorised access.
It further cited Section 40 of the Act, which requires data controllers to notify the NDPC of a breach likely to pose a risk to individuals’ rights and freedoms within 72 hours of becoming aware of it.
The organisation said the reported involvement of registration officers with authorised access to INEC’s database made it necessary to establish whether adequate safeguards were in place and whether they were circumvented or misused.
“The use of authorised credentials does not, by itself, establish that subsequent access or processing was lawful or within the scope of the officer’s authority,” it said.
SERAP also raised concerns about the implications of the irregularities for Nigerians’ constitutional and international human rights, particularly the rights to privacy and political participation.
It cited Section 37 of the 1999 Constitution, as amended, alongside Article 13 of the African Charter on Human and Peoples’ Rights and Article 25 of the International Covenant on Civil and Political Rights.
According to the organisation, any unlawful alteration or compromise of voters’ personal information could undermine public confidence in the electoral process and expose eligible voters to wrongful exclusion.
SERAP urged the NDPC to publish its findings and recommendations, subject to lawful protections, and ensure accountability where wrongdoing was established.
It also called for stronger security safeguards and accessible procedures that would allow affected voters to verify and correct their records without being unfairly excluded.
The organisation recalled that INEC, in a statement issued on October 27, acknowledged public concerns over suspected AI-generated photographs appearing in the preliminary register published on its website.
The electoral commission had said that during the nationwide physical display of the register, several questionable registration records were identified and flagged for further examination.
INEC also disclosed that it had commenced a review and was taking appropriate corrective action, while examining the circumstances surrounding the suspicious photographs, including possible technical or procedural lapses.
The commission maintained that the online publication did not reflect all ongoing data-cleanup activities and clarified that the preliminary register was not the final certified register.
It promised to complete the necessary verification, adjudication and data-cleanup processes before certifying the final Register of Voters on December 15, 2026.
SERAP, however, maintained that an independent investigation was necessary to establish the full circumstances surrounding the irregularities before the register was finalised.
It warned that failure to address the matter transparently could undermine public confidence in the electoral process and Nigerians’ right to participate freely in public affairs.
The organisation requested that the measures be implemented within seven days of the receipt or publication of its letter.
It threatened to consider legal action and other lawful measures against the Federal Government, NDPC, INEC and other relevant authorities if its demands were not addressed within the stipulated period.
