A High Court of the Federal Capital Territory has ordered Stanbic IBTC Bank Plc to pay ₦15 million in general damages to two former customers for unlawfully retaining and processing their personal data after the termination of their banking relationship.
In a judgment delivered on July 29, 2026, Justice Kayode Agunloye ruled that the bank breached the provisions of the Nigeria Data Protection Act (NDPA) 2023 by continuing to process the claimants' personal information for marketing purposes despite the closure of their account and withdrawal of consent.
The court also directed the bank to erase all personal data relating to the claimants that it is not legally required to retain and issued a perpetual injunction restraining the bank from further processing, transmitting or using their information for marketing or any other unauthorised purpose.
The suit, marked CV/2190/25, was filed on June 10, 2025, by David Ogundipe and Salami Tolulope Ibrahim, who sought the enforcement of their rights under the NDPA 2023, Section 37 of the 1999 Constitution, and the Federal Competition and Consumer Protection Act (FCCPA) 2018.
According to the claimants, they had maintained a corporate account with Stanbic IBTC before requesting its closure due to unresolved issues. Although the bank closed the account as instructed, it allegedly continued sending promotional emails and text messages to both their corporate and personal contact details.
The claimants said they subsequently instructed the bank, through their legal representatives, to stop processing their personal data for marketing purposes. Despite the bank acknowledging the request and assuring them that the communications would cease, the unsolicited messages reportedly continued, prompting them to institute legal proceedings.
In his decision, Justice Agunloye held that the bank no longer had a lawful basis to retain and process the claimants' personal information once the banking relationship had ended and consent had been withdrawn.
The judge ruled that the continued use of the data violated the Nigeria Data Protection Act and infringed on the claimants' constitutional right to privacy. He further held that using the information for marketing purposes amounted to an unfair trade practice under the FCCPA.
Beyond awarding damages, the court ordered Stanbic IBTC to delete every item of the claimants' personal data that it is not legally obligated to retain under existing laws and regulations.
While the claimants had sought ₦250 million in damages, the court considered the amount excessive and instead awarded ₦15 million in general damages, citing the persistent unsolicited marketing communications, the bank's failure to adequately respond to requests for data erasure, and the resulting violation of the claimants' privacy rights.
Justice Agunloye also awarded ₦500,000 as the cost of the suit and directed that the judgment sum should attract 10 per cent post-judgment interest annually until it is fully paid.
However, the court declined to order the complete deletion of all records relating to the claimants, noting that financial institutions are legally required under banking regulations and anti-money laundering laws to retain certain customer information for statutory compliance.
Reacting to the judgment, counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the ruling as a significant milestone for the enforcement of data protection rights in Nigeria, saying it strengthens accountability for organisations handling personal information.
One of the claimants, David Ogundipe, welcomed the judgment, stating that it reaffirmed the principle that customers retain control over their personal data even after ending their relationship with a financial institution.
The decision is expected to serve as an important judicial precedent for banks and other organisations, reinforcing the need for strict compliance with the Nigeria Data Protection Act 2023, particularly in the handling, retention and deletion of customers' personal information after account closure.
Comments
Join the conversation and share your thoughts.
Login Required
Please login to join the conversation and post a comment.
No comments yet
Be the first to share your thoughts on this story.