A Federal High Court sitting in Lagos has declared that Creating a Bank Account in a Customer’s name without his Consent Violates Data Privacy.
In a well-considered judgment delivered by His Lordship, Hon. Justice A. O. Faji in the suit with No: FHC/L/ CS/2625/2023, filed by one Miss Folasade Molehin against United Bank for Africa Plc, the Court dismissed the preliminary objection raised by the bank and agreed with the counsel’s position that data privacy rights as contained in the NDPR are rights subsumed under the right to privacy guaranteed under Section 37 of the Constitution, and as such, are cognizable and enforceable under the FREP rules His Lordship also agreed with the Plaintiff that the creation of a domiciliary account for her by the Bank amounts to wrongful processing of her personal data, as her consent was not sought howsoever. Consequently, the court awarded the sum of Seven Million Five Hundred Thousand Naira (N7,500,000) as damages in favour of the Plaintiff.
The Plaintiff’s case is that sometime in April 2023, she received an SMS alert on her phone from the Bank stating that the sum of $250, which she was expecting a naira equivalent of in her savings account with the bank, has been deposited in a domiciliary account unilaterally opened for her by the Bank. It thus appeared to our client that the bank, without seeking her consent, created a domiciliary account in her name and deposited the sum into the said new account. To clarify her concerns, she approached the Bank to seek clarifications on this development.
It was indeed confirmed to her by the bank that a domiciliary account had been created for her. The Plaintiff further demanded that the bank close the said account, but the bank failed to accede to her modest requests, keeping the account active and operative.
The Plaintiff then instituted a Fundamental Rights Enforcement suit, challenging the bank’s action as a contravention of our client’s right to data privacy which is a right subsumed under the right to privacy of citizens guaranteed under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended) (“the Constitution”) and Article 2.2 of the National Data Protection Regulation (NDPR), and the CBN’s Consumer Protection Regulation. In response, the bank contended that its actions were in the Plaintiff’s best interest in line with the existing bankercustomer relationship and did not amount to a violation of our client’s right to data privacy. Additionally, the bank challenged the competence of the suit on the ground that the Plaintiffs principal claim is one that borders on alleged breach of fiduciary duty by the Bank in a Banker-customer relationship, and such, the suit as it was then constituted was not cognizable or enforceable under the Fundamental Rights (Enforcement Procedure) Rules 2009 (“FREP Rules”).
The CTC of the judgment as obtained by the Plaintiff’s Counsel FOLEGAL is attached herewith
