High Court reinforces customer privacy protections against unlawful bank disclosures

In Esther Agboola v. Fidelity Bank PLC (12 February 2025), the court delivered a decisive ruling on the limits of automated loan recovery mechanisms and the lawful processing of personal data within the banking sector. The Applicant, a student, discovered that her bank account had been completely depleted through an “automatic loan recovery” under the Global Standing Instruction (GSI) framework, allegedly for a microfinance debt she maintained she never incurred.

Although the bank argued that it was merely acting on instructions from the Nigeria Inter-Bank Settlement System (NIBSS) in relation to a third-party facility, the court rejected this defence. The judgment affirms that reliance on inter-bank systems does not absolve financial institutions of their independent legal and fiduciary obligations to verify the lawful basis for processing customer data.

Led by Olumide Babalola, a leading authority in data protection law, the firm successfully argued that the bank’s disclosure and processing of the Applicant’s account information, without a verified and lawful foundation, violated Section 37 of the 1999 Constitution (right to privacy) and the Nigeria Data Protection Act (NDPA 2023). The court held that processing personal data in a manner that prejudices a data subject, particularly where it results in the depletion of funds for an unsubstantiated debt, fails the statutory tests of fairness, transparency, and lawfulness.

Advisory Team

Olumide Babalola LP

Olumide Babalola