The Federal High Court in Lagos has dismissed a N100 million privacy breach lawsuit filed against First City Monument Bank (FCMB) over alleged unauthorized disclosure of a customer's financial information. The ruling, delivered on August 5, 2026, marks a significant legal precedent for data protection claims in Nigeria's banking sector.
Background of the Case
The plaintiff, a customer of FCMB, had instituted the suit alleging that the bank breached his right to privacy under the Nigeria Data Protection Regulation (NDPR) by disclosing his account details to a third party without consent. The customer sought N100 million in damages for what he described as a violation of his personal data rights.
According to court documents, the alleged breach occurred when FCMB shared the customer's financial records with a debt recovery agency in connection with an outstanding loan. The customer argued that this disclosure was not authorized and caused him psychological distress and reputational damage.
Court's Ruling
In his judgment, Justice Mohammed Idris held that the plaintiff failed to establish a prima facie case of privacy breach. The court found that FCMB's disclosure of the customer's information was justified under the loan agreement, which contained a clause permitting the bank to share customer data with third parties for debt collection purposes.
“The bank's action was lawful and in line with the provisions of the loan agreement signed by the plaintiff. The disclosure was necessary for the legitimate interest of the bank in recovering its funds,” Justice Idris stated. He further noted that the plaintiff could not claim damages when he had consented to such disclosure by signing the agreement.
Implications for Data Protection
Legal experts say the ruling clarifies the scope of data privacy rights under the NDPR, emphasizing that consent can be implied through contractual terms. “This judgment reinforces the principle that data protection is not absolute and must be balanced against legitimate business interests,” said data protection lawyer, Bola Adeyemi.
The case also highlights the growing importance of data privacy litigation in Nigeria, especially as the Nigeria Data Protection Act (NDPA) continues to evolve. The NDPA, signed into law in 2023, imposes stricter obligations on data controllers, but this ruling suggests that courts may still consider contractual consent as a valid defense.
Reactions from FCMB
Following the judgment, FCMB issued a statement expressing satisfaction with the court's decision. The bank reiterated its commitment to protecting customer data while also fulfilling its contractual obligations. “We are pleased with the court's ruling, which validates our data handling practices. We will continue to ensure that our operations comply with all applicable data protection laws,” the statement read.
Broader Context
This case comes amid increasing scrutiny of financial institutions' data handling practices. In recent years, several banks have faced lawsuits over alleged privacy breaches, with plaintiffs seeking damages for unauthorized disclosures. However, many of these suits have been dismissed due to lack of evidence or because the disclosures were contractually permitted.
For consumers, the ruling serves as a reminder to carefully review loan agreements and other contracts before signing, as they may contain clauses that permit data sharing. For banks, it reinforces the importance of ensuring that such clauses are clear and unambiguous to avoid future disputes.
