The High Court of the Federal Capital Territory (FCT) in Abuja has ordered Stanbic IBTC Bank Limited to pay ₦15 million in general damages to two former customers for unlawfully retaining and processing their personal data after they had ended their banking relationship with the bank.
In a judgment delivered on July 29, 2026, Justice Kayode Agunloye ruled that the bank violated the claimants’ rights under the Nigeria Data Protection Act (NDPA) 2023, their constitutional right to privacy, and the Federal Competition and Consumer Protection Act (FCCPA).
The suit, filed on June 10, 2025, by David Ogundipe and Salami Toluope Ibrahim, challenged the bank’s continued use of their personal information for promotional purposes despite the closure of their corporate account and the withdrawal of consent.
According to the claimants, they instructed Stanbic IBTC to close their corporate account following unresolved issues in their banking relationship. Although the account was closed, they alleged that the bank continued sending promotional emails and text messages to their personal and corporate contacts.
The former customers, through their lawyers, formally requested the bank to stop processing their personal and corporate data for marketing. While Stanbic IBTC acknowledged the request and assured them that the communications would cease, the claimants told the court that the unsolicited messages continued, prompting them to seek legal redress.
Justice Agunloye held that once the banking relationship ended and consent was withdrawn, the bank no longer had a lawful basis to process the claimants’ personal data for marketing purposes.
The court ruled that the continued processing of their information amounted to an infringement of their constitutional right to privacy and constituted an unfair trade practice under the FCCPA.
As part of the judgment, the court directed Stanbic IBTC to erase all personal data relating to the claimants that it is not legally required to retain and to stop processing their information except where retention is necessary to comply with statutory or regulatory obligations.
The court also granted a perpetual injunction restraining the bank, its agents and representatives from retaining, processing, using or transmitting the claimants’ personal data for marketing or any purpose not authorised by law or by the claimants’ consent.
Although the claimants sought ₦250 million in damages, the court awarded ₦15 million, describing the amount as adequate compensation for the invasion of privacy, persistent unsolicited communications and the bank’s failure to honour requests for data erasure.
Justice Agunloye further awarded ₦500,000 as the cost of the suit and ordered that all monetary awards attract 10 per cent annual post-judgment interest until fully paid.
However, the court declined to order the complete deletion of all records relating to the claimants, noting that financial institutions are legally required to retain certain customer records under banking, financial and anti-money laundering regulations.
Reacting to the judgment, lead counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the ruling as a landmark decision that reinforces data protection rights in Nigeria. He said organisations must respect customers’ privacy and cannot continue processing personal information once consent has been withdrawn without a lawful basis.
One of the successful claimants, David Ogundipe, hailed the judgment as a victory for millions of Nigerians, saying it affirms that customers retain control over their personal information even after ending their relationship with financial institutions. He expressed hope that the decision would encourage organisations to comply strictly with Nigeria’s data protection laws and respect individuals’ privacy rights.
