By Opeyemi Adelakun
The Federal Capital Territory High Court has ordered Stanbic IBTC Bank Limited to pay N15 million in damages to two former customers after ruling that the lender unlawfully retained and processed their personal information even after they had terminated their banking relationship with the institution.
In a judgment regarded by legal observers as a major milestone for data privacy enforcement in Nigeria, Justice Kayode Agunloye also directed the bank to delete every category of the claimants’ personal data that it is not legally required to retain and barred it from further processing or using such information without lawful authority or the customers’ consent.
Delivering judgment on July 29, 2026, the court held that the bank breached the Nigeria Data Protection Act (NDPA), 2023, violated the claimants’ constitutional right to privacy under Section 37 of the 1999 Constitution (as amended) and contravened provisions of the Federal Competition and Consumer Protection Act (FCCPA), 2018.
The suit, marked CV/2190/25, was filed on June 10, 2025, by David Ogundipe and Salami Tolulope Ibrahim, who asked the court to determine whether Stanbic IBTC acted unlawfully by continuing to retain and process their personal data after they had closed their account.
The claimants told the court that although the bank complied with their request to shut the corporate account they maintained with it, it continued sending promotional emails and text messages to their personal and corporate email addresses as well as telephone numbers.
According to them, their solicitors later wrote to the bank demanding that it immediately stop processing their personal information for marketing purposes. While the bank acknowledged the request and assured them the unsolicited messages would cease, the promotional communications allegedly continued, prompting the legal action.
Justice Agunloye ruled that once the banking relationship had ended and the customers had withdrawn their consent, Stanbic IBTC no longer had any lawful basis to process their personal information for marketing or promotional activities.
The judge held that the continued use of the claimants’ data amounted to a violation of their constitutional right to privacy and constituted an unfair trade practice under the FCCPA.
The court consequently ordered the bank to erase all personal data relating to the claimants that it is not statutorily required to retain and to stop every form of processing of their information except where such processing is mandated by law or regulatory obligations.
It also granted a perpetual injunction restraining Stanbic IBTC, its agents and representatives from retaining, processing, transmitting or using the claimants’ personal information for marketing, promotional or any other unauthorised purpose.
Although the claimants sought N250 million in damages, the court awarded N15 million as general damages, describing the sum as adequate compensation for the persistent unsolicited communications, the bank’s failure to honour requests for data erasure and the resulting invasion of privacy.
Justice Agunloye further awarded N500,000 as the cost of the suit, while rejecting the claimants’ request for N7 million as litigation expenses on the grounds that it was not sufficiently proved.
The court also ruled that all monetary awards would attract 10 per cent post-judgment interest per annum until fully paid.
However, the judge declined to order the complete deletion of every record relating to the claimants, noting that financial institutions remain legally obliged under banking regulations, financial laws and anti-money laundering statutes to preserve specific categories of customer records.
Reacting to the judgment, counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the decision as a landmark victory for data protection rights, saying it reinforces that compliance with the Nigeria Data Protection Act is mandatory and that organisations cannot continue processing personal information after consent has been withdrawn without a lawful basis.
One of the successful claimants, David Ogundipe, welcomed the ruling, saying it represents a victory not only for the two litigants but for millions of Nigerians whose personal information is held by organisations.
According to him, the judgment affirms that individuals do not surrender control of their personal data simply because they once maintained a relationship with a financial institution and should encourage stronger compliance with Nigeria’s data protection laws.
Leave a Reply