Probe alleged AI-generated photos, manipulation of INEC voter register, SERAP tells Tinubu

The Socio-Economic Rights and Accountability Project (SERAP) has urged President Bola Tinubu “to direct Dr Vincent Olatunji, National Commissioner/Chief Executive Officer of the Nigeria Data Protection Commission (NDPC) to promptly, thoroughly, independently and effectively investigate the reported introduction of suspected artificial intelligence (AI)-generated photographs, alleged alterations to personal data and other questionable records in the preliminary Register of Voters published by the Independent National Electoral Commission (INEC).” SERAP’s letter follows INEC’s publication of the preliminary Register of Voters and its subsequent acknowledgement of suspected AI-generated photographs and questionable registration records identified during the nationwide display of the register from 9 to 15 October 2026.

SERAP urged him “to ensure that the NDPC establishes the nature and extent of the reported irregularities, determines whether any personal data breach has occurred under the Nigeria Data Protection Act 2023, identifies those responsible, and ensures that affected Nigerians can verify and correct their records without being unfairly excluded from the electoral process.” In the letter dated 31 October 2026 and signed by SERAP deputy director Kolawole Oluwadare, the organisation said: “The reported irregularities raise serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voter register ahead of the 2027 general elections.” SERAP said: “The security and accuracy of the voter register are fundamental to the protection of Nigerians’ personal data and their right to participate in public affairs.

Nigerians should not have to worry that their personal information could be altered, manipulated or accessed without proper safeguards.” The letter, read in part: “INEC’s acknowledgement of questionable records and suspected AI-generated photographs makes an independent investigation particularly important. The public needs to know what happened, whether the law was breached and what measures are being taken to prevent a recurrence.” “The NDPC should exercise its statutory powers independently and without delay.

Any investigation must establish the facts, protect affected voters and ensure that those responsible for any unlawful conduct are held accountable.” “We would be grateful if the requested measures are taken within seven days of the receipt and/or publication of this letter. If we have not heard from you by then, SERAP shall consider appropriate legal actions and other lawful measures to compel your government, the NDPC, INEC and other relevant authorities to comply with our requests in the public interest.” “The proposed investigation should establish the nature and extent of the reported irregularities, including the number and geographical distribution of affected records, when and how they were created or altered, and the persons or institutions responsible.” “The introduction of questionable records, including photographs suspected to have been artificially generated, raises legitimate concerns about the accuracy and reliability of the register and the safeguards protecting its integrity.” “SERAP is concerned that the reported irregularities may involve the unlawful alteration or processing of personal data, possible misuse of authorised access credentials and failures to ensure the accuracy, integrity and security of personal data held and processed by INEC.” “SERAP urges you to ensure that the NDPC conducts an independent forensic examination of the affected database and systems to determine whether personal data were unlawfully accessed or altered and whether INEC complied with the Nigeria Data Protection Act 2023.” “SERAP further urges you to ensure that the NDPC determines whether the incidents constitute a personal data breach under section 65 of the Act and whether INEC has complied with its applicable notification and record-keeping obligations.” “Where violations are established, appropriate corrective measures should be required, including stronger security safeguards and accessible procedures for affected voters to verify and correct their records without wrongful exclusion.” “The NDPC should publish its findings and recommendations, subject to lawful protections, and ensure accountability where wrongdoing is established.” “According to INEC’s statement of 27 October 2026, the Commission acknowledged public concerns regarding ‘suspected AI-generated photographs appearing in the Preliminary Register of Voters’ published on its website.” “INEC stated that, during the physical display of the register nationwide from 9 to 15 October 2026, ‘a number of questionable registration records were identified and flagged for further examination’.

The Commission said it had commenced a review and was taking ‘appropriate corrective action’.” “INEC also acknowledged that the online publication ‘does not reflect all ongoing data-cleanup activities’ and