Federal Capital Territory High Court has ordered Stanbic IBTC Bank Limited to pay N15 million in damages to two former customers after finding that the bank unlawfully retained and processed their personal information after they had terminated their banking relationship.
In a judgment delivered on July 29, Justice Kayode Agunloye also directed the bank to erase all personal data belonging to the claimants that it is not legally required to retain and restrained it from further processing or using such information without lawful authority or the customers’ consent.
The court held that the bank breached the Nigeria Data Protection Act (NDPA) 2023, the claimants’ constitutional right to privacy under Section 37 of the 1999 Constitution (as amended), and provisions of the Federal Competition and Consumer Protection Act (FCCPA).
The suit, marked CV/2190/25, was filed by David Ogundipe and Salami Tolulope Ibrahim, who argued that Stanbic IBTC continued to process their personal data for marketing purposes even after they had closed their corporate account with the bank.
According to the claimants, the account was shut following unresolved issues with the bank.
Despite the closure, they alleged that Stanbic IBTC continued sending promotional emails and text messages to their personal and corporate email addresses as well as their telephone numbers.
The customers said their solicitors later wrote to the bank demanding that all marketing communications cease and that their personal data should no longer be processed for promotional purposes.
Although the bank reportedly acknowledged the request and assured them that the messages would stop, the unsolicited communications allegedly continued, prompting them to seek judicial intervention.
In his ruling, Justice Agunloye held that once the banking relationship had ended and the customers had withdrawn their consent, the bank no longer had any lawful basis to process their personal data for marketing activities.
The judge ruled that the continued use of the claimants’ information amounted to an infringement of their constitutional right to privacy and constituted an unfair trade practice under the FCCPA.
The court consequently ordered Stanbic IBTC to delete all personal information relating to the claimants that it is not legally required to retain and to cease every form of data processing except where permitted by law or regulatory obligations.
Justice Agunloye also granted a perpetual injunction restraining the bank, its officers and agents from retaining, processing, transmitting or using the claimants’ personal data for marketing, promotional or any other unauthorised purpose.
While the claimants sought N250 million as damages, the court awarded N15 million as general damages, describing the amount as adequate compensation for the persistent unsolicited communications, the bank’s failure to honour requests for data erasure and the violation of the customers’ privacy rights.
The bank was further ordered to pay N500,000 as the cost of the suit, while the claim for N7 million as litigation expenses was dismissed for lack of sufficient proof.
Justice Agunloye directed that all monetary awards would attract 10 per cent post-judgment interest annually until fully settled.
However, the court declined to order the complete deletion of every record relating to the claimants, holding that banks remain under statutory obligations to retain certain customer records in compliance with financial regulations and anti-money laundering laws.
Reacting to the verdict, counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the decision as a landmark judgment for data protection in Nigeria.
He said the ruling reinforces the mandatory nature of compliance with the Nigeria Data Protection Act and makes it clear that organisations cannot continue processing customers’ personal information after consent has been withdrawn unless authorised by law.
One of the successful claimants, David Ogundipe, welcomed the judgment, saying it represented a victory not only for the litigants but also for millions of Nigerians whose personal information is held by corporate organisations.
He expressed hope that the ruling would encourage institutions across the country to strengthen compliance with data protection laws and place greater respect on customers’ privacy rights.
