By Seun Ibiyemi
The Federal Capital Territory High Court has ordered Stanbic IBTC Bank Limited to pay ₦15 million in damages to two former customers after ruling that the bank unlawfully retained and processed their personal information after they had ended their banking relationship.
In a judgment delivered on July 29, Justice Kayode Agunloye also directed the bank to erase all personal data belonging to the claimants that it is not legally required to retain and restrained it from further processing or using such information without lawful authority or the customers’ consent.
The court held that the bank breached the Nigeria Data Protection Act 2023, the claimants’ constitutional right to privacy under Section 37 of the 1999 Constitution (as amended), and provisions of the Federal Competition and Consumer Protection Act.
The suit, marked CV/2190/25, was instituted by David Ogundipe and Salami Tolulope Ibrahim, who alleged that Stanbic IBTC continued processing their personal data for marketing purposes after they had closed their corporate account with the bank.
According to the claimants, the account was closed following unresolved issues with the bank. Despite terminating the banking relationship, they alleged that the bank continued sending promotional emails and text messages to their personal and corporate email addresses as well as their telephone numbers.
They said their solicitors subsequently wrote to the bank requesting that all marketing communications cease and that their personal information should no longer be processed for promotional purposes.
Although the bank reportedly acknowledged the request and assured them that the communications would stop, the unsolicited messages allegedly persisted, prompting them to seek judicial intervention.
In his ruling, Justice Agunloye held that once the banking relationship ended and the customers withdrew their consent, the bank no longer had any lawful basis to continue processing their personal data for marketing purposes.
READ ALSO:Dangote, Sinoma seal $800m deal to transform Itori into major cement export hub
The judge ruled that the continued use of the claimants’ information violated their constitutional right to privacy and amounted to an unfair trade practice under the Federal Competition and Consumer Protection Act.
The court consequently ordered Stanbic IBTC to delete all personal information relating to the claimants that it is not legally required to retain and to cease all forms of data processing except where permitted by law or regulatory obligations.
It also granted a perpetual injunction restraining the bank, its officers and agents from retaining, processing, transmitting or using the claimants’ personal data for marketing, promotional or any other unauthorised purpose.
While the claimants had sought ₦250 million in damages, the court awarded ₦15 million as general damages, holding that the amount adequately compensated them for the persistent unsolicited communications, the bank’s failure to honour requests for data erasure and the infringement of their privacy rights.
The bank was further ordered to pay ₦500,000 as the cost of the suit, while the claim for ₦7 million as litigation expenses was dismissed for lack of sufficient proof.
Justice Agunloye also ruled that all monetary awards would attract 10 per cent annual post-judgment interest until fully paid.
However, the court declined to order the complete deletion of all records relating to the claimants, holding that banks are under statutory obligations to retain certain customer records in compliance with financial regulations and anti-money laundering laws.
Reacting to the judgment, counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the ruling as a landmark victory for data protection in Nigeria, saying it reinforces the mandatory nature of compliance with the Nigeria Data Protection Act.
One of the successful claimants, David Ogundipe, welcomed the judgment, describing it as a victory not only for the litigants but also for millions of Nigerians whose personal data are held by corporate organisations.
He expressed hope that the decision would encourage institutions to strengthen compliance with data protection laws and accord greater respect to customers’ privacy rights.
