The High Court of the Federal Capital Territory, Abuja, has ordered Stanbic IBTC Bank Limited to pay N15 million in damages to two former customers for unlawfully retaining and processing their personal data after they had ended their banking relationship with the financial institution.
In what legal experts have described as a significant ruling on data privacy in Nigeria, the court also directed the bank to delete all personal data belonging to the claimants that it is not legally required to retain and restrained it from further processing or using such information without lawful authority or the customers’ consent.
Justice Kayode Agunloye, who delivered the judgment on July 29, 2026, held that the bank violated the provisions of the Nigeria Data Protection Act (NDPA), 2023, the claimants’ constitutional right to privacy under Section 37 of the 1999 Constitution (as amended), and the Federal Competition and Consumer Protection Act (FCCPA), 2018.
The suit, marked CV/2190/25, was instituted on June 10, 2025, by David Ogundipe and Salami Tolulope Ibrahim, through their lawyers, seeking judicial interpretation and enforcement of provisions of the NDPA, FCCPA and the Constitution over what they described as the unlawful retention and processing of their personal information.
The claimants told the court that they had opened a corporate account with Stanbic IBTC but later requested its closure following unresolved issues in their relationship with the bank.
Although the bank honoured the request and closed the account, the claimants alleged that it continued sending promotional emails and text messages to their personal and corporate email addresses as well as their telephone numbers.
According to them, their solicitors subsequently wrote to the bank, demanding that it cease processing their personal and corporate data for marketing and promotional purposes.
They said the bank acknowledged the request and assured them that the unsolicited messages would stop.
However, the promotional communications allegedly continued several weeks after the assurance, prompting them to approach the court for redress.
In his judgment, Justice Agunloye ruled that once the banking relationship had ended and the customers had withdrawn their consent, the bank no longer had any lawful basis to continue processing their personal data for marketing purposes.
The court held that the continued use of the claimants’ personal information amounted to an infringement of their constitutional right to privacy and constituted an unfair trade practice under the FCCPA.
Consequently, the court ordered Stanbic IBTC to erase all personal data relating to the claimants that it is not statutorily required to retain and to stop every form of processing of their information except where required by law or regulatory obligations.
The judge also granted a perpetual injunction restraining the bank, its agents and representatives from further retaining, processing, transmitting or using the claimants’ personal data for marketing, promotional or any other unauthorised purpose.
While the claimants had sought N250 million in damages, the court awarded N15 million as general damages, describing it as adequate compensation for the persistent unsolicited communications, the bank’s failure to meaningfully respond to requests for data erasure and the invasion of the claimants’ privacy.
Justice Agunloye further awarded N500,000 as the cost of the suit against the bank, rejecting the claimants’ request for N7 million in litigation expenses on the grounds that it was not strictly proved.
The court also ordered that all monetary awards would attract 10 per cent post-judgment interest per annum until fully paid.
However, the judge declined to order the complete deletion of all records relating to the claimants, holding that financial institutions are legally required under banking regulations, financial laws and anti-money laundering statutes to retain certain categories of customer records.
He ruled that any order for data deletion must therefore remain subject to existing statutory record-retention obligations.
Reacting to the judgment, counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the verdict as a landmark decision that strengthens the enforcement of data protection rights in Nigeria.
He said the ruling sends a clear message that compliance with the Nigeria Data Protection Act is mandatory and that organisations cannot continue processing customers’ personal information after consent has been withdrawn without a lawful basis.
One of the successful claimants, Ogundipe, also hailed the judgment, describing it as a victory not only for him and his co-claimant but for millions of Nigerians whose personal information is held by organisations.
According to him, the ruling reinforces the principle that individuals do not lose control over their personal information simply because they once maintained a relationship with a financial institution.
He expressed hope that the judgment would compel organisations across the country to strengthen compliance with Nigeria’s data protection laws and respect customers’ privacy rights.
'
'Do you want to share a story with us? Do you want to advertise with us? Do you need publicity for a product, service, or event? Contact us on WhatsApp +2348183319097 Email: platformtimes@gmail.com
We are committed to impactful investigative journalism for human interest and social justice. Your donation will help us tell more stories. Kindly donate any amount HERE
