Nigeria's Joint Admissions and Matriculation Board (JAMB) plans to verify university entrance candidates by live face match. According to Legit.ng's report on JAMB's weekly bulletin, obtained on 31 August 2026 and published on 1 September, cameras at computer-based test centres would capture each candidate's face. The image goes to the National Identity Management Commission (NIMC) through a dedicated application, which returns a confirmation code. The plan is a sensible response to a documented problem. It is also the kind of project that tests whether Nigeria's data protection law has teeth.
The strongest case for the plan
Impersonation is a genuine threat to exam integrity, and the current fix is poor. JAMB says dirty, wet or worn fingers cause scanner errors, delays, candidate anxiety and rescheduled sittings. A candidate who cannot be verified by fingerprint is not a cheat, but gets treated like one. Facial matching is contactless, needs no new hardware beyond standard cameras, and JAMB says it takes under a second in good conditions. The report says the 10-fingerprint system will run alongside it in the short term. Over two to three years, face matching could replace OTPs and phase out fingerprints. Used alongside fingerprints, which fail for some candidates, it is a clear improvement for honest test-takers.
There is also a legitimate legal anchor. On 26 June 2026, President Tinubu signed the NIMC Act 2026, which the State House says replaces the obsolete 2007 Act. It aims to speed up harmonisation of identity databases, strengthen the integrity of the National Identification Number (NIN) and build capacity against identity theft and financial crime. JAMB is not improvising a database. It is querying one that Parliament has just placed on a modern statutory footing.
Where the risk sits
The risk is not the exam hall but the architecture around it. A face match is a query against a national biometric register. Each query tells a central authority who sat which exam, where and when. The State House announcement shows how the same register is described for security use. The Interior Minister said linked identity databases helped arrest seven known Boko Haram and ISWAP commanders at Katsina airport, crediting the NIN's connection to immigration and Interpol systems. That is a government claim, not independently verified in the release. It does show that the NIN database is meant to serve policing as well as administration.
So the question is purpose limitation. A system built to confirm that a 17-year-old is the person registered should not quietly become a log of citizens' movements. Mission creep in identity systems is rarely announced; it arrives as a new integration. The Electronic Frontier Foundation's September 2026 analysis, Cops Play Hide and Seek About Using Spy Tech, is about US police. Its lesson travels: surveillance tools adopted for narrow reasons tend to expand when disclosure obligations are weak and oversight is thin.
What the Data Protection Act already requires
Nigeria does not need new law to discipline this project. The Nigeria Data Protection Act 2023, which the Nigeria Data Protection Commission (NDPC) lists among its resources, is the operative framework. As summarised by the Future of Privacy Forum, the Act treats biometric data used to uniquely identify a person as sensitive. Processing is prohibited unless a listed condition applies, such as consent under section 30(1)(a) or substantial public interest on the basis of a law under section 30(1)(f). The Act does not define "substantial public interest." Section 28 requires a data protection impact assessment (DPIA) before processing likely to pose high risk to data subjects' rights. It covers necessity, proportionality, risks and mitigations.
A national exam face-matching system is high-risk processing by any reasonable reading. Candidates are overwhelmingly young, and they cannot meaningfully refuse, since consent is hard to call free when the exam is the gateway to university. So JAMB and NIMC will likely lean on the public-interest basis. That makes the undefined term the decisive gap, and it argues for the controllers to fill it voluntarily and visibly.
A proportionate path
Good policy here is concrete and cheap. It would not mean abandoning the project.
- Publish the DPIA. JAMB and NIMC should release a summary before the rollout widens, covering what is matched, what is retained and who can query the logs.
- Keep fingerprints as an alternative. The reported design runs both checks side by side at first. Candidates with a working fingerprint should keep that option while the system proves its error rates, and any mismatch should lead to human review, not automatic exclusion.
- Limit retention and use. Match results and images should be deleted on a short schedule, with the statute or NDPC directive stating that exam-verification queries cannot be reused for law-enforcement lookups without a legal process.
- Publish accuracy data by group. The possible two-to-three-year horizon leaves time to measure false rejection rates and publish them before fingerprints are retired.
- Let the NDPC audit. The regulator should have a clear role in checking the system, which matters because the NIMC is itself a government body and a controller.
The bottom line
Opponents of any biometric database will say the whole idea should be rejected. That overreaches. Fingerprint failures are real, impersonation is real, and a contactless check can reduce friction for honest candidates. But the legitimacy of Nigeria's wider build-out of face matching on the NIMC database will depend on whether the NDPC's oversight is exercised in the first deployment, not the fifth. A published DPIA, a hard purpose limit and a human appeals route would let the system work for candidates and the public. Without them, a reasonable fix for dirty fingers becomes the base of a surveillance infrastructure that no statute was designed to approve.