The High Court of Lagos State has ordered Guaranty Trust Bank (GTBank) PLC to pay N5 million in damages to customer Rebecca Temtope Bonje for altering, distorting, and deleting entries in her bank statements, in violation of her privacy rights and the Nigeria Data Protection Act 2023.
Justice Oluwakunle A. Oresanya, presiding at Court 58 in the Lagos Judicial Division, delivered the judgment on Thursday, September 18, 2025, in suit number LD/18590MFHR/2024. The ruling, which granted all reliefs sought by Bonje in her originating motion filed on November 4, 2024, underscores the growing enforcement of digital privacy laws amid rising concerns over financial institutions’ handling of customer data.
Bonje, who initiated the suit under Sections 37, 31(1)(c), and 40 of the 1999 Constitution of the Federal Republic of Nigeria (as amended), as well as Orders 1 and 2 of the Fundamental Rights (Enforcement Procedure) Rules 2009, accused GTBank of issuing two conflicting statements of account that misrepresented her transactions. She claimed these discrepancies led to the loss of a critical property investment worth over N6 million, causing substantial reputational harm, anxiety, and emotional distress.
According to court documents, Bonje transferred N5,600,000 (part of a N6,000,000 property purchase price) via GTBank’s mobile banking platform on May 26 and 28, 2023, to Haven Global Resources Limited. However, subsequent bank statements she received—first via automated email in May 2023 and later manually—omitted key entries, including inflows and outflows related to the transaction. This, she argued, not only violated Section 24(1)(e) of the NDPA 2023, which prohibits misleading or inaccurate processing of personal data, but also interfered with her constitutional right to privacy under Section 37.
The applicant further alleged that GTBank’s refusal to rectify the discrepancies upon request breached her right to correction under Section 34(1)(c) of the NDPA, constituting a personal data breach as defined in Section 65. She detailed how the altered records disrupted her ability to make informed financial decisions, resulting in the forfeiture of the property deal and broader professional setbacks.
In her 19-paragraph affidavit, filed by her lawyers Olumide Babalola and A. I. Offiong for the applicant, and Wonuola Ademuson for the defendant, dated November 29, 2024, and supported by nine exhibits, Bonje highlighted the bank’s issuance of “unfair, non-transparent” statements, which she said exposed her to undue scrutiny and undermined trust in financial services. Her counsel raised five key issues, including whether the alterations constituted interference with privacy and violated data fairness principles.
GTBank, in response, filed a 25-paragraph counter-affidavit dated April 7, 2025, by account officer Sodiq Jimoh, denying the allegations. The bank claimed Bonje’s account had insufficient funds for the alleged transfer at the time and provided internal audit logs showing the transaction occurred later, on November 10, 2023, after receiving inflows from another customer. It argued the suit was an abuse of court process and sought dismissal, citing lack of evidence and jurisdictional issues under fundamental rights enforcement rules.
However, Justice Oresanya dismissed GTBank’s preliminary objection, ruling that data protection rights are subsumed under the constitutional right to privacy. The court held that personal data, including bank statements, falls within protected economic identity and status, and any distortion breaches confidentiality and integrity principles.
“The right to privacy implies a right to protect one’s thought, conscience, or religious belief and practice from coercive and unjustified intrusion… unless a clear and compelling overriding state interest justifies the contrary,” the judge quoted from the Supreme Court’s decision in Medical and Dental Practitioners Disciplinary Tribunal v Dr. John Okonkwo [2001] 7 NWLR (Pt. 711) 206.
Finding no documentary evidence from GTBank to challenge Bonje’s claims, the court deemed her averments credible. It declared:
The judgment emphasized that banks, as data controllers, must process customer information with fairness and transparency, aligning with Central Bank of Nigeria guidelines on consumer protection. It also overruled GTBank’s notice of preliminary objection dated April 4, 2025, affirming the court’s jurisdiction.
