The High Court’s analysis focused on the lack of a lawful basis for data retention once a customer has explicitly requested the closure of their accounts and the deletion of their records. This determination arrived in July 2026, when Justice Kayode Agunloye penalized Stanbic IBTC for mishandling personal information. The case, initiated in 2025 by David Ogundipe and Salami Tolulope Ibrahim, highlights a risky practice in the financial sector: using former client details for marketing. Despite formal requests to purge their data, the claimants were subjected to persistent promotional emails and texts. This behavior continued even after legal demands from solicitors were ignored, forcing a judicial review of how banks manage digital footprints. The ruling emphasizes that corporate entities cannot treat personal data as a permanent asset to be exploited. It marks a turning point for data privacy enforcement, signaling that customers retain control over their digital identities after a relationship ends.
Judicial Scrutiny of Corporate Data Practices
Legal Violations: Transgressing the Nigeria Data Protection Act
During the proceedings, the court found that the bank’s continued processing of the claimants’ personal data was a direct violation of the 1999 Constitution and the Nigeria Data Protection Act. Justice Agunloye emphasized that when an individual withdraws consent, the justification for holding and using that data evaporates unless a specific statutory exemption applies. The bank failed to provide a compelling argument for why it ignored multiple requests to cease marketing communications, leading the court to conclude that the institution had operated with a disregard for established privacy safeguards. This ruling clarifies that corporate entities must treat personal data as a borrowed privilege that terminates alongside the service agreement. The decision effectively shifts the burden of proof to the data controller, requiring them to demonstrate a valid legal ground for every instance of processing. It reinforces the idea that consent is a revocable license for corporations.
The court expanded its critique to include the Federal Competition and Consumer Protection Act, characterizing the bank’s unauthorized marketing as an unfair trade practice. By utilizing the claimants’ contacts for unsolicited promotional messages, the bank engaged in a strategy that prioritized corporate visibility over consumer rights. This synthesis of consumer protection law and data privacy provides a robust framework for addressing grievances in the digital economy. The judgment serves as a warning that marketing departments cannot operate in a vacuum, isolated from the legal constraints of data sovereignty. It acknowledges that unwanted digital solicitations constitute a form of harassment. Furthermore, the court awarded N15 million in damages to address the invasion of privacy, signaling that financial institutions must re-evaluate their automated marketing triggers. This ensures that outreach efforts remain synchronized with the current legal status of former account holders.
Retention Dilemmas: Reconciling Privacy With Regulatory Mandates
While the ruling was a victory for the claimants, the court maintained a balanced perspective regarding financial oversight and anti-money laundering regulations. Justice Agunloye declined the request for a wholesale deletion of all records, acknowledging that banks are legally obligated to retain certain transaction histories for specific periods. This distinction is crucial for the banking industry, as it prevents a scenario where data privacy laws could be used to circumvent regulatory audits or investigations. The court clarified that the duty to erase data applies primarily to marketing lists and secondary processing activities not mandated by governing bodies. This creates a dual-tier system where institutions must separate marketing databases from regulatory archives. Consequently, the bank was ordered to purge only the information that lacked a statutory retention requirement. This ensured that the right to be forgotten was respected without compromising the necessary transparency.
Financial organizations should have implemented automated protocols that linked account closure procedures directly to the scrubbing of marketing databases. This judgment demonstrated that manual oversight was no longer sufficient to meet modern standards, necessitating the adoption of privacy-by-design architectures that prioritized user consent. Companies should have conducted comprehensive audits of their third-party data processors to ensure that requests for erasure were propagated through the entire digital supply chain. Legal departments were advised to establish clearer communication channels with dissatisfied customers to resolve data disputes before they escalated into litigation. The outcome suggested that the era of aggressive data persistence had ended, replaced by a climate where data minimization became an operational necessity. By aligning internal policies with the requirements of the NDPA and the FCCPA, businesses could have mitigated the risk of heavy financial penalties.
