A recent audit report from the Office of the Auditor General for the Federation has revealed that personal data of Nigerians applying for or renewing their driver’s licenses under the National Drivers’ Licence Identity Management and Card Production System (NDLS) are being handled by third-party consultants instead of staff at the Federal Road Safety Corps (FRSC).
The report points to weaknesses in the FRSC’s internal control system, which have led to these anomalies.
As a result, the Corps faces the risk of not transferring essential knowledge to its own staff, potentially compromising the privacy and confidentiality of sensitive data.
The reliance on third parties also leads to higher operational costs for the agency.
This information is part of the Auditor General’s report on non-compliance and internal control weaknesses in government Ministries, Departments, and Agencies for the year ending December 31, 2021.
The report was signed by Auditor General Shaakaa Kanyitor Chira and submitted to the National Assembly on December 15, 2024.
It said that Clause 2.1.7 of the contract agreement between the Federal Road Safety Corps (FRSC) and Messrs. SW Global (SWG) on the National Drivers’ Licence Identity Management and Card Production System (NDLS) provides that the “FRSC shall carry out the demographic and biometric capture of applicants for Drivers’ Licence”, while Clause 2.2.6 states, “SWG shall provide technical and management training to FRSC staff on the use of the systems and solutions for the NDLS project.”
According to the report said that the requests to run SQL scripts on the National Drivers Licence System Data Base made available to the CITO, that would have enabled the team to assess the integrity of the NDLS Data Base was not satisfied as the staff of the FRSC on the project have no access to the NDLS Data Base.
In addition, it said the Roles and Responsibilities definition in pages 4 and 5 of the FRSC Information/Communication Technology Policy does not include that of a Data Base Administrator (DBA), implying that FRSC has no DBA to manage the huge data being generated from the applicants for the Drivers’ Licence, adding that these data are being managed by the staff of the consultant, which is a third party to NDLS project.
According to the audit report, the anomalies could be attributed to weaknesses in the internal control system at the Federal Road Safety Corps (FRSC), while the Corps run the risk of the knowledge not being transferred to its staff, leading to loss of privacy and confidentiality of sensitive applicants’ data and running at a higher cost to the agency.
Responding to the issue, the FRSC management said drew attention to Clause 2.1.8 of the new contractual agreement, saying FRSC staff currently carry out all the demographic and Biometric capture of applicants at the various DLC where they are assigned the roles of Operators and supervisors as log in credentials on the NDL portal.
It also said FRSC DBA Staff under the System Admin Unit at the Print farm Kado has considerable access to some tables on both Demographic and Biometric database where they can run limited query, view records and spool reports from the database, adding that “as stipulated in clause 13.8 of the new contract “all data obtained under or in pursuance of this Agreement, belongs solely to FRSC and FRSC has exclusive right to use, share or transfer to a third party through electronic application provided such use or transmission of data by the FRSC does not circumvent any of SWG’s contractual rights”
It said the contractors, SWG have commenced the training and capacity building of the FRSC staff as part of the deliverables of the contract on the NDL project, but the Office of the Auditor General said the Management’s response to the issue raised but not satisfactory, adding that the findings remain valid until the Management implements the recommendations.
The Auditor General said the Corps Marshal should ensure the immediate hand over of the Data Base to staff of the Corps, with the staff of Messrs. SW Global only providing the required technical support and enforce the provisions of Sections 13.3 and 13.5.1 of the contract agreement.
The report also said that at the time of the audit, there exist no Third-Party Data Processing Contract between the FRSC and Messrs. SW Global on the NLDS project despite the quantum of Personally Identifiable Information (PII) being generated from the applicants of the Drivers’ License and being managed by them with no justification provided for the absence.
This, it said can lead to loss of confidentiality of the Personally Identifiable Information, while the Corp’s Management may suffer the penalty spelt out in Section 2.10 (PENALTY FOR DEFAULT) of the NDPR.
While also responding to the query, the management said the Corps has developed and gazetted a Data Protection Policy within the FRSC Information/Communication Technology Policy, adding that clause 13.1.1 of the Contract agreement restricts SWG from using data from the database without the consent of FRSC, saying the Corps Legal Adviser may be directed to draft a copy of the third-party agreement between FRSC and SWG including other third parties on information usage.
The Auditor General said he response of the management was not satisfactory and wants the Corps Marshal to provide evidence of adherence to the requirements of the NDPR with particular attention to Part Two, Sections 2.1 to 2.10, including the development of a Data Privacy Policy for the FRSC (as in Section 2.5) and the Third-Party Data Processing Contracts between the FRSC and ALL its third parties (Section 2.7), to the Public Accounts Committees of the National Assembly.
Its emphasis the Corps could not account for its investment in its assets, saying “the Corps’ IT Assets Register made available for examination did not have most of the vital information required for full accountability and decision making.
“The Date of Acquisition and the Cost of Acquisition of the assets were not stated in the registers, and It was difficult to ascertain the Corps’ investment on these assets, especially at the Print Farm where substantial investment was made to acquire both hardware and software assets required for the NDLS”.
According to the report, this has made it difficult to understand the value of the Corps’ Assets, with an attendant risk of loss/pilferage of these assets.
It requested the Corps Marshal to provide to the Public Account Committees of the National Assembly, evidence that the IT Assets Register has been re populated to include ALL relevant information from the date of acquisition, distinctly separating between the Hardware and Software components.
The report further said that in 2020, the FRSC failed to account for about 52,714 National Drivers Licence valued at N316.284 million attributing it to weaknesses in the internal control system at the Federal Road Safety Corps (FRSC) in Abuja, leading to under remittance of revenue and loss of government funds.
But the management of the FRSC said the Audit report did not take cognizance of the 29,921 cards included which was the closing balance for the year ended 31st December 2020, adding that the total 46,948 cards reported to have been discarded by the printing machine into the reject bin (damaged) was formally reported to SW Global Limited.
It requested the Corps Marshal to account to the Public Accounts Committees of the National Assembly, the 52,714 cards amounting to N316.284 million, recover the amount and remit same to government treasury.
It alleged violation of Paragraph 4.27 of the Treasury Circular Ref. No. TRY A9 & B9/2015 OAGF/CAD/026/V. 11/332 on “Guidelines on the Implementation of Treasury Single Accounts (TSA)/e Collection”, saying revenue collected were not paid directly to the FRSC TSA, while deposits were diverted to the partners’ commercial banks accounts with only part of the collections later paid to FRSC’s TSA Account.
It also said that not all payments were made from the FRSC TSA Accounts directly to partners, saying “for instance, partner’s portion of the revenue were not transferred to the partners’ accounts from the FRSC TSA Account, instead their share was removed before transferring the balance to the FRSC TSA account.
In addition, it said that revenue from these firms never specified the number of cards paid for on which the revenue was remitted, the class of driver’s license paid for (whether motor vehicle/motor cycle and whether 3 years or 5 years, as well as the unit price at which these remittances were made, etc.
In their response, the FRSC management said: “The initial agreement entered into provided for SW Global Ltd to provide payment platform for collection of payment for licences. FRSC could not go back on the agreement to avoid breach and consequent penalties. However, the new agreement has modified this. The process of complete migration to Remita platform is on”.
The Corps Marshal, it said should be requested provide to the Public Accounts Committees of the National Assembly, the breakdown of the collections by the firms for which the sum of N3,599,352,300.13 was remitted to FRSC.
It also alleged that the FRSC violated the With Holding Tax law by deducting only 5% WHT from fees paid to National Drivers Licence consultants instead of statutory 10% WHT on consultancy service by the limited companies, adding that the two consultants were overpaid by the sum of N90.579 million.
It also alleged that while the Corps paid VAT, WHT and Stamp duty deducted from the Government Integrated Financial (Information Management System (GIFMIS) Capital and Overhead and the Treasury Single Account (TSA) Stamp Duty to dedicated CBN accounts, it paid TSA (VAT and WHT) deductions into a commercial Bank.
It said that the TSA statements showed that the sums of N194,584,233.86 for WHT and N270,831,137.49 for VAT, amounting to N465,415,371.35 in total were paid into the above account without evidence of remittance to FIRS designated account with the CBN.
However, in its response, the FRSC said WEMA Bank Plc. was duly authorised to collect Value Added Tax on behalf of the Corps, but said nothing about the With Holding Tax.
It said that fifty-four (54) unserviceable vehicles, ambulances and Power Bikes worth over N98,508,850.00 were abandoned at the various Commands of the Corps and its headquarters in Abuja, while no reason was provided for the vehicles not being auctioned.
