Stanbic IBTC logo Photo Business Journal
By Victory Oghene
Stanbic IBTC is currently swimming in troubled waters as the High Court of the Federal Capital Territory (FCT), sitting in Abuja, has slammed a N15 million fine on the bank for general damages to two former customers for unlawfully retaining and processing their personal data after they had terminated their banking relationship with the financial institution.
The judgment, delivered on July 29, 2026, by Justice Kayode Agunloye, also directed the bank to erase all personal data relating to the claimants that it is not legally required to retain, while restraining it from any further processing, retention, transmission or use of their personal information for marketing or any purpose not authorised by law or by their consent.
The court held that Stanbic IBTC violated the claimants’ rights under the Nigeria Data Protection Act (NDPA), 2023, their constitutional right to privacy guaranteed under Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended), and the Federal Competition and Consumer Protection Act (FCCPA), 2018.
The case was instituted on June 10, 2025, with suit number: CVI2190/25, by Mr. David Ogundipe and Mr. Salami Toluope Ibrahim, through their lawyers, seeking the court’s interpretation and enforcement of relevant provisions of the NDPA, FCCPA and the Constitution concerning the unlawful retention and processing of their personal information.
According to the claimants, they had opened a corporate account with Stanbic IBTC Bank but later instructed the bank to close the account following unresolved issues in their banking relationship.
The bank complied with the request and closed the account.
However, despite the termination of the banking relationship, the claimants stated that the bank continued sending promotional emails and text messages to both the corporate and personal email addresses as well as telephone numbers they had supplied during the account opening process.
In a bid to halt the unsolicited communications, the claimants, through their solicitors, formally demanded that the bank stop processing both their personal data and the company’s corporate data for marketing and promotional purposes.
Although Stanbic IBTC acknowledged the request and assured them that the promotional emails and text messages would cease, the claimants told the court that the communications continued weeks after the bank’s assurance, prompting them to seek judicial intervention.
In his judgment, Justice Agunloye held that the continued retention and processing of the claimants’ personal data after the termination of their banking relationship, without establishing any lawful basis under the Nigeria Data Protection Act, was unlawful.
The judge further held that the bank’s continued use of the claimants’ personal data for marketing and promotional communications after consent had been withdrawn amounted to a violation of their constitutional right to privacy.
According to the court, the continued processing of the personal data also constituted an unfair trade practice contrary to the provisions of the Federal Competition and Consumer Protection Act, 2018.
Justice Agunloye ruled that once the banking relationship had ended and consent had been withdrawn, Stanbic IBTC no longer had the legal basis to continue processing the claimants’ personal information for promotional purposes.
Consequently, the court ordered the bank to erase or delete all personal data relating to the claimants which it is not otherwise required by law to retain and to cease every form of processing of their personal data except where such processing is necessary to comply with existing statutory or regulatory obligations.
The court also granted a perpetual injunction restraining Stanbic IBTC, its servants, agents, privies and assigns from further processing, retaining, using or transmitting the claimants’ personal data for marketing, promotional or any other purpose not authorised by law or by the express consent of the claimants.
While the claimants had sought N250 million in damages, the court held that the amount was excessive.
Justice Agunloye, however, found that N15 million was appropriate compensation for the persistent unsolicited communications, the bank’s failure to meaningfully respond to requests for data erasure, and the inconvenience and invasion of privacy suffered by the claimants.
The court also awarded N500,000 as costs of the suit against Stanbic IBTC, rejecting the claimants’ request for N7 million in litigation costs on the ground that the amount claimed had not been strictly proved.
In addition, the judge awarded 10 per cent post-judgment interest per annum on all monetary awards from the date of judgment until full payment is made.
However, the court declined to order the wholesale deletion of all the claimants’ records, holding that financial institutions are under statutory obligations imposed by banking regulations, financial laws and anti-money laundering legislation to retain certain categories of customer records.
The court ruled that any deletion order must therefore remain subject to applicable statutory record-retention requirements.
Summarising the decision, Justice Agunloye held: “In the final analysis, the Claimants have succeeded in establishing their claims on the preponderance of evidence and are entitled to the reliefs sought, subject to minor variations.”
The court consequently made the following orders: “Declared that Stanbic IBTC’s continued retention and processing of the claimants’ personal data after termination of their banking relationship, without establishing a lawful basis under the Nigeria Data Protection Act, 2023.
“It is hereby declared that the Defendant’s continued processing and use of the Claimants’ personal data for marketing and promotional purposes after the withdrawal of consent and the termination of the banking relationship constitutes a violation of the Claimants’ constitutional right to privacy guaranteed under Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended).
“It is hereby declared that the Defendant’s continued use of the Claimants’ personal data for marketing and promotional communications in the circunstances of this case constitutes an unfair trade practice contrary to the provisions of the Federal Competition and Consumer Protection Act, 2018.
“An Order is hereby made directing the Defendant to erase or delete all personal data relating to the Claimants which it is not otherwise required by law to retain and to cease every form of processing of the Claimants’ personal data except as may be required for compliance with any extant statutory or regulatory obligation.
“An Order of Perpetual lnjunction is hereby granted restraining the Defendant, whether by itself, its servants, agents, privies or assigns, from further processing, retaining, using or transmitting the Claimants’ personal data for marketing. promotional or any other purpose not authorised by law or by the express consent of the Claimants.
“The Defendant shall pay the Claimants the sum of N15,000,000.00 (Fifteen Million Naira) as general damages for the infringement of the Clainnants’ statutory and constitutional rights.
“The Defendant shall further pay costs of this action assessed at N500,000.00 (Five Hundred Thousand Naira) in favour of the Claimants.”
Reacting to the judgment, lead counsel to the claimants, O.E. Oluwadamisi of Earnest Attorneys LP, described the ruling as a landmark decision that significantly strengthens the enforcement of data protection rights in Nigeria.
He stressed that organisations must respect customers’ rights even after the termination of their relationship with them.
“This judgment sends a clear message that compliance with the Nigeria Data Protection Act is not optional. Organisations that collect personal data owe a duty to process such information lawfully, fairly and transparently. The court has reaffirmed that once consent is withdrawn and there is no lawful basis for continued processing, organisations cannot continue using an individual’s personal data merely for commercial convenience or marketing purposes,” Oluwadamisi said.
One of the successful claimants, David Ogundipe, also welcomed the judgment, describing it as a victory not only for him and his co-claimant but for millions of Nigerians whose personal information is held by organisations.
“This judgment has reaffirmed that customers do not lose control of their personal information simply because they once had a relationship with a financial institution. We approached the court to vindicate our rights, and we are pleased that the court has upheld the principles of privacy, accountability and respect for the Nigeria Data Protection Act.
“We hope this decision will encourage organisations across the country to take their data protection obligations more seriously and to respect the wishes of individuals who withdraw consent for the processing of their personal data,” Ogundipe said.
