Our Dispute Resolution Team is pleased to have acted as counsel and secured a landmark victory in a data privacy suit between Miss Folasade Molehin (“Our Client”) and United Bank for Africa Plc (“the bank”) in Suit No: FHC/L/CS/2625/2023, over the wrongful processing of our client’s personal data.
The brief facts of the case as presented before the court were that sometime in April 2023, our client received an SMS alert on her phone from the Bank stating that the sum of $250, which she was expecting a naira equivalent of in her savings account with the bank, has been deposited in a domiciliary account unilaterally opened for her by the Bank. It thus appeared to our client that the bank, without seeking her consent, created a domiciliary account in her name and deposited the sum into the said new account. To clarify her concerns, our client approached the Bank to seek clarifications on this development. It was indeed confirmed to her by the bank that a domiciliary account had been created for her. Our client further demanded that the bank close the said account, but the bank failed to accede to her modest requests, keeping the account active and operative.
Resultantly, our client briefed the firm, which led our team to institute a Fundamental Rights Enforcement suit, challenging the bank’s action as a contravention of our client’s right to data privacy which is a right subsumed under the right to privacy of citizens guaranteed under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended) (“the Constitution”) and Article 2.2 of the National Data Protection Regulation (NDPR), and the CBN’s Consumer Protection Regulation.
In response, the bank contended that its actions were in our client’s best interest in line with the existing banker-customer relationship and did not amount to a violation of our client’s right to data privacy. Additionally, the bank challenged the competence of the suit on the ground that our client’s principal claim is one that borders on alleged breach of fiduciary duty by the Bank in a Banker-customer relationship, and such, the suit as it was then constituted was not cognizable or enforceable under the Fundamental Rights (Enforcement Procedure) Rules 2009 (“FREP Rules”).
In a well-considered judgment delivered by His Lordship, Hon. Justice A. O. Faji on 13th May 2024, the Court in dismissing the preliminary objection raised by the bank agreed with our client’s position that data privacy rights as contained in the NDPR are rights subsumed under the right to privacy guaranteed under Section 37 of the Constitution, and as such, are cognizable and enforceable under the FREP rules. His Lordship also agreed with our client that the creation of a domiciliary account for her by the Bank amounts to wrongful processing of her personal data, as her consent was not sought howsoever. Consequently, the court awarded the sum of Seven Million Five Hundred Thousand Naira (N7,500,000) as damages in favour of our client.
We welcome this significant judgment as it further contributes to the growing jurisprudence on privacy and data protection in Nigeria.