Inaccurate or misleading financial records by banks constitute a breach of customers’ data privacy rights

REBECCA TEMITOPE BONJE v. GUARANTY TRUST BANK PLC

HIGH COURT (LAGOS)

Rebecca Temitope Bonje (the “Applicant”) is a customer of Guaranty Trust Bank Plc. (the “Respondent”). On 26 May 2023, the Applicant initiated a transfer of the sum of ₦5,600,000 through the Respondent’s mobile banking platform to the account of Haven Global Resources Limited as part-payment for the purchase of a landed property. Although the transaction reflected on her mobile application as successful, the intended beneficiary consistently denied receiving the funds. Concerned by this development, the Applicant approached the Respondent for clarification. In response, the Respondent sent her a statement of account for May 2023 from its automated email address, which showed the entry for the disputed transfer.

Despite this, the beneficiary still did not receive the funds, and after several months of waiting, the property transaction was terminated, causing the Applicant to lose the investment and the opportunity to acquire the property. Following a formal request by the Applicant’s Solicitors, the Respondent issued a second statement of account, this time forwarded from the email address of one of its employees. Upon comparing this new statement with the initial one, the Applicant discovered several discrepancies. Specifically, all transactions carried out on 8 May 2023 were missing from the first statement, and the entries relating to 26 and 28 May 2023, including the transfer of ₦5,600,000, appeared inconsistent and unreliable across the two documents.

Aggrieved by the actions of the Respondent, the Applicant instituted an action by way of Originating Motion on 4 November 2024. One of the issues for determination was: Whether or not the Respondent’s alteration, distortion and/or deletion of the Applicant’s statement of account is misleading, inaccurate and violated the provision of Section 24(1) (e) of the Nigeria Data Protection Act 2023.

Learned counsel for the Applicant submitted that, in the realm of data protection, a person’s bank statement constitutes personal data because the information it contains directly relates to and identifies the individual and his financial transactions. This data counsel argued, forms part of the individual’s economic identity, and any manipulation or inaccuracy in such records affects the integrity of that identity. Counsel further argued that the principle of fairness in data processing requires that personal data must not be handled in a manner that prejudices the data subject. He maintained that fairness demands that individuals be fully aware of how their data is being processed and that such processing must align with their reasonable expectations. Counsel submitted that the Applicant reasonably expected her financial records to be accurately maintained and transparently presented by the Respondent. The issuance of conflicting and inconsistent statements of account, therefore, fell short of this standard and amounted to unfair processing of the Applicant’s personal data.

It was also the position of Counsel that the law guarantees the right of every data subject to demand the correction or, where correction is impracticable, the deletion of any personal data that is inaccurate, incomplete, or misleading. He maintained that the Applicant exercised this right when she requested the Respondent to rectify the discrepancies in her statement of account but the Respondent failed and refused to do so. Counsel argued that this refusal amounted to a violation of the Applicant’s legally protected right to the accuracy and integrity of her personal data. As a consequence of this violation, the Applicant suffered substantial losses, including the collapse of a major financial transaction and the attendant emotional and reputational injury.

In addressing the issue of data breaches, Counsel drew an analogy to environmental pollution, contending that just as pollution contaminates natural ecosystems, a data breach compromises the integrity of personal information. Counsel submitted that an unlawful alteration, deletion, or distortion of personal data disrupts the delicate balance of trust inherent in data processing relationships and exposes the data subject to harmful consequences. A breach of this nature undermines confidentiality, distorts accuracy, and violates the core principles that data protection laws are designed to safeguard. Counsel concluded that the Respondent’s conduct constituted a breach of the Applicant’s personal data rights. Such conduct interfered with the Applicant’s financial autonomy, caused economic loss, and violated her broader right to privacy.

In response, Counsel for the Respondent submitted that the Applicant did not have sufficient funds in her account on the date she claimed to have made the disputed transfer. According to the Respondent, its internal records showed no inflow that could have enabled the transaction on the date alleged by the Applicant. The Respondent maintained that the only transfer matching the amount in question occurred several months later, after the Applicant received funds from third parties, and not on the date stated in her affidavit. Counsel maintained that the transaction receipt submitted by the Applicant contained an incorrect account reference, which, in its view, suggested that the documents relied upon by the Applicant were inaccurate or manipulated. In conclusion, counsel contended that there were no discrepancies in its authentic records and denied altering or deleting any transaction entries belonging to the Applicant and argued that the Respondent was not liable for any financial loss, reputational damage, anxiety, or emotional distress allegedly suffered by the Applicant.

Learned counsel also argued that the subject matter of this suit does not fall within the ambit of fundamental rights enforcement. He argued that the issues raised by the Applicant, at best, relate to the bank’s contractual duty to its customer and therefore should lie in negligence or breach of banking obligations. According to counsel, where the principal claim does not seek the enforcement of a fundamental right, the action cannot properly be brought under the Fundamental Rights (Enforcement Procedure) Rules, regardless of whether ancillary claims touching on constitutional rights are incidentally mentioned. The Court was urged to hold that the suit was wrongly commenced and falls outside the scope of fundamental rights jurisdiction.

In resolving this issue, the High Court held that: Where a bank issues inconsistent, misleading, or incorrect entries in a customer’s financial records, such conduct constitutes a breach of the customer’s personal data rights, which forms part of the customer’s fundamental right to privacy guaranteed by the Constitution. The Court explained that the banker–customer relationship between the parties was incidental, and the Applicant’s complaint was essentially about the breach of her data rights. These rights flow directly from her constitutional right to privacy and are therefore properly enforceable under fundamental rights provisions.

The Court further held that the Respondent neither genuinely nor effectively denied the alleged breach of the Applicant’s personal data rights and failed to provide any documentary evidence capable of refuting her claims. In the absence of any evidential challenge, the Court found the Applicant’s account credible, noting that the evidence clearly demonstrated inconsistent, misleading, and incorrect entries in her financial records, and consequently granted the reliefs sought, awarding Five Million Naira in damages with costs.

Issue resolved in favour of the Applicant.

Olumide Babalola with A. I. Offiong for the Applicant. Wonuola Ademuson for the Defendant.

This summary is fully reported at (2025) 12 CLRN in association with ALP NG & Co. See www.clrndirect.com ; www.alp.company.

Join BusinessDay whatsapp Channel, to stay up to date