A High Court of the Federal Capital Territory has ordered Stanbic IBTC Bank to pay N15 million in damages for unlawfully retaining and processing the personal data of two former customers after they terminated their banking relationship.
The judgment, delivered on July 29, 2026, by Justice Kayode Agunloye, also directed the bank to erase all personal data relating to the claimants that it is not legally required to retain and restrained it from further processing or using their information for marketing purposes.
The suit, marked CV/2190/25, was instituted on June 10, 2025, by David Ogundipe and Salami Tolulope Ibrahim, who sought enforcement of their rights under the Nigeria Data Protection Act (NDPA) 2023, Section 37 of the 1999 Constitution, and the Federal Competition and Consumer Protection Act (FCCPA) 2018.
According to court documents, the claimants had operated a corporate account with Stanbic IBTC before instructing the bank to close it over unresolved issues. Although the bank complied with the closure request, it allegedly continued sending promotional emails and text messages to their corporate and personal contacts.
The claimants, through their solicitors, formally demanded that the bank stop processing their personal data for marketing purposes. Despite acknowledging the request and assuring them that the messages would cease, the communications reportedly continued, prompting the legal action.
In his judgment, Justice Agunloye held that the bank had no lawful basis under the NDPA to continue processing the claimants’ personal data after the banking relationship had ended and consent had been withdrawn.
He ruled that the continued retention and processing of the claimants’ data violated the Nigeria Data Protection Act and infringed on their constitutional right to privacy. The court further held that the bank’s use of the data for marketing constituted an unfair trade practice under the FCCPA.
The court ordered Stanbic IBTC to delete all personal data relating to the claimants that it is not legally required to retain and issued a perpetual injunction restraining the bank, its agents and assigns from further processing, using or transmitting the claimants’ information for marketing or any other unauthorised purpose.
While the claimants had sought N250 million in damages, the court described the amount as excessive and instead awarded N15 million as general damages for the persistent unsolicited communications, failure to adequately respond to requests for data erasure, and the invasion of the claimants’ privacy.
Justice Agunloye also awarded N500,000 as the cost of the suit and ordered 10 per cent post-judgment interest per annum until the judgment sum is fully paid.
However, the court declined to order the wholesale deletion of all customer records, noting that banks are legally required under banking regulations and anti-money laundering laws to retain certain records for statutory purposes.
Reacting to the judgment, lead counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the ruling as a landmark decision that reinforces the enforcement of data protection rights in Nigeria.
One of the claimants, David Ogundipe, said the judgment affirmed that customers do not lose control of their personal information simply because they previously maintained a banking relationship with a financial institution.
The ruling is expected to serve as an important precedent for financial institutions and other organisations on compliance with the Nigeria Data Protection Act 2023, particularly regarding the handling of customers’ personal data after account closure.
