SERAP Asks Tinubu to Order Independent Probe into Alleged AI-Generated Photos, Manipulation of INEC Voters’ Register

The Socio-Economic Rights and Accountability Project (SERAP) has urged President Bola Tinubu to direct the Nigeria Data Protection Commission (NDPC) to launch an independent investigation into alleged manipulation of the Independent National Electoral Commission (INEC) voters’ register, including the introduction of photographs suspected to have been generated using artificial intelligence (AI).

The organisation warned that the reported irregularities could compromise the integrity of Nigerians’ personal data, undermine confidence in the electoral process and expose eligible voters to wrongful exclusion ahead of the 2027 general elections.

SERAP, in a letter dated October 31, 2026, and signed by its Deputy Director, Kolawole Oluwadare, asked President Tinubu to direct the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, to conduct a prompt, thorough and independent investigation into the allegations.

The organisation specifically wants the commission to establish the nature and extent of the irregularities, determine whether personal data belonging to Nigerians have been unlawfully accessed or altered, identify those responsible and recommend appropriate sanctions where violations are established.

It also called for measures to enable affected Nigerians to verify and correct their voter-registration information without being unfairly prevented from participating in the electoral process.

The demand follows INEC's acknowledgement of concerns surrounding suspected AI-generated photographs and questionable registration records discovered during the nationwide display of the preliminary Register of Voters between October 9 and 15, 2026.

SERAP said the development raised fundamental questions about the security of the electoral database and the effectiveness of safeguards put in place to protect the personal information of millions of Nigerians.

According to the organisation, the security and accuracy of the voters’ register are not merely administrative issues but essential conditions for protecting citizens' constitutional rights to privacy and participation in public affairs.

"The reported irregularities raise serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voter register ahead of the 2027 general elections," SERAP stated.

It added that Nigerians should not have to worry that their personal information could be altered, manipulated or accessed without appropriate safeguards.

INEC's Acknowledgement Of Questionable Records

INEC had acknowledged public concerns following the appearance of photographs suspected to have been generated through artificial intelligence in the preliminary voters’ register published on its website.

In a statement issued on October 27, the electoral commission said that during the physical display of the register nationwide from October 9 to 15, a number of questionable registration records were identified and flagged for further examination.

The commission said it had commenced a review of the affected records and was taking appropriate corrective action.

INEC also explained that the online publication of the preliminary register did not reflect all the data-cleanup activities already in progress, adding that it was examining the circumstances surrounding the suspicious photographs, including possible technical or procedural lapses.

The commission, however, maintained that the preliminary register was not the final certified voters’ register.

It undertook to complete the necessary verification, adjudication and data-cleanup exercises before certifying the final Register of Voters on December 15, 2026.

SERAP said INEC's acknowledgement of the questionable records made an independent investigation particularly necessary, arguing that an internal review by the electoral commission could not replace the statutory responsibilities of the NDPC.

The organisation said the public deserved to know what happened, whether any laws were violated and what measures were being implemented to prevent a recurrence.

It also expressed concern over reports that some registration officers might have used their official access credentials to introduce irregular records, including photographs suspected to have been artificially generated.

According to SERAP, the reported involvement of personnel with authorised access to the database makes it imperative to investigate whether existing security arrangements were adequate and whether official access credentials were abused.

It stressed that possessing authorised access to a database does not automatically make every subsequent activity conducted with such credentials lawful.

NDPC Asked To Conduct Forensic Examination

Among its major demands, SERAP urged the NDPC to conduct an independent forensic examination of INEC's affected database and information technology systems.

The proposed examination, it said, should determine whether personal information was unlawfully accessed, altered or manipulated and whether the electoral commission complied with the provisions of the Nigeria Data Protection Act 2023.

It wants the investigation to establish the number of affected registration records, their geographical distribution, when and how the questionable records were created or altered, and the individuals or institutions responsible.

SERAP also asked the NDPC to determine whether the incidents amounted to a personal data breach under Section 65 of the Nigeria Data Protection Act 2023.

The provision defines a personal data breach to include a security breach resulting, or likely to result, in the unlawful alteration, loss, unauthorised disclosure of or access to personal data.

The organisation further drew attention to Sections 24 and 39 of the Act, which provide safeguards for the accuracy, integrity and security of personal data and protection against unlawful alteration, loss and unauthorised access.

It also cited Section 40, which requires data controllers to notify the NDPC of a personal data breach likely to pose a risk to individuals' rights and freedoms within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to affected individuals, the law also requires communication of the incident to those individuals.

SERAP therefore wants the NDPC to determine whether INEC fulfilled its applicable notification and record-keeping obligations in connection with the reported irregularities.

The organisation maintained that where violations are established, the relevant authorities should impose appropriate corrective measures, strengthen security safeguards and ensure that affected voters have accessible procedures for verifying and correcting their records.

It further called on the data protection commission to publish its findings and recommendations, subject to lawful protections, and ensure accountability where wrongdoing is established.

Fears Over 2027 Elections

The controversy has assumed greater significance because the voters’ register is one of the most important instruments in the conduct of credible elections.

The register determines who is recognised as an eligible voter and provides the foundation upon which the electoral process is organised.

Any compromise of its accuracy or integrity could have serious implications for the credibility of elections, particularly where eligible citizens discover that their personal information has been altered, duplicated, replaced or otherwise compromised.

SERAP warned that any unlawful manipulation of the database could undermine public confidence in the electoral process and expose eligible voters to the risk of wrongful exclusion.

It argued that the reported irregularities must be treated with urgency because millions of Nigerians depend on the accuracy of the database to exercise their constitutional and democratic rights.

The organisation also invoked Section 37 of the 1999 Constitution, as amended, which guarantees the right to privacy.

It cited Article 13 of the African Charter on Human and Peoples' Rights and Article 25 of the International Covenant on Civil and Political Rights, which protect citizens' rights to participate freely in government and vote in genuine elections.

According to SERAP, these legal protections require public institutions to establish effective safeguards against arbitrary interference with citizens' personal information and political rights.

It maintained that the integrity of the voters’ register and the protection of personal data are interconnected responsibilities that cannot be treated as separate administrative concerns.

"The integrity and accuracy of the Register of Voters are indispensable to the effective exercise of the rights to participate in public affairs and to vote in genuine elections," the organisation said.

It warned that failure to address the reported irregularities transparently and effectively could further weaken public confidence in the electoral process.

SERAP Gives Tinubu Seven-Day Deadline

SERAP has requested that the measures outlined in its letter be implemented within seven days of its receipt or publication.

The organisation warned that it would consider appropriate legal action and other lawful measures to compel the Federal Government, NDPC, INEC and other relevant authorities to comply with its demands if no response was received within the stipulated period.

It insisted that the proposed investigation must be conducted independently and without delay, noting that the NDPC possesses statutory powers to investigate possible data protection violations, obtain relevant information and documents, and require compliance by data controllers and processors.

SERAP said the Federal Government has a responsibility to ensure that personal information held by INEC is adequately protected against unlawful access, alteration, manipulation and disclosure.

It further argued that the electoral commission's ongoing internal review, although necessary, should not be regarded as sufficient to resolve questions bordering on possible violations of the data protection law.

Final Voters' Register Expected December 15

With the 2027 general elections approaching, attention is increasingly focused on INEC's ability to complete the verification and data-cleanup exercise before the final certification of the voters’ register.

The commission has indicated that the preliminary register remains subject to verification, adjudication and correction before its scheduled certification on December 15, 2026.

The emerging controversy therefore presents an important test of the electoral commission's transparency, institutional accountability and capacity to protect the integrity of its registration systems.

For INEC, the challenge goes beyond identifying and removing questionable photographs. It must establish how the irregularities occurred, determine whether the registration process was compromised and demonstrate that the final register accurately reflects eligible voters.

For the NDPC, the demand by SERAP presents an opportunity to demonstrate the practical effectiveness of Nigeria's data protection framework, particularly where the personal information of millions of citizens is involved.

Ultimately, the credibility of the 2027 elections will depend not only on the conduct of voting and the collation of results but also on the reliability of the systems used to identify eligible voters.

As the December 15 certification deadline approaches, Nigerians will expect INEC to provide convincing assurances that the final register is accurate, secure and free from manipulation.

The challenge is to ensure that the controversy surrounding suspected AI-generated photographs does not become another source of distrust in an electoral system already facing considerable public scrutiny.

The central issue is that no eligible Nigerian should lose the opportunity to vote because someone unlawfully manipulated the database on which the country's democratic process depends.