Stanbic IBTC Privacy Ruling: N15m Damages for Marketing to Former Customers

The Federal Capital Territory High Court has ordered Stanbic IBTC Bank to pay N15 million in general damages to two former customers for continuing to process their personal data and sending marketing messages after their accounts were closed. The judgment, delivered on 29 July 2026 by Justice Kayode Agunloye, marks a shift from regulator-led enforcement to judicially enforced individual privacy rights in Nigeria.

David Ogundipe and Salami Tolulope Ibrahim took the bank to court after it kept emailing and texting them on both corporate and personal contacts with promotional content, even though they had closed a corporate account and withdrawn consent. The bank acknowledged the complaint and promised to stop, but did not. The court found that continued processing was a breach of the Nigeria Data Protection Act 2023, an infringement of the constitutional right to privacy under Section 37, and an unfair trade practice under the FCCPA 2018.

What the court said about consent

Justice Agunloye ruled that consent and lawful basis are not permanent once granted. They expire when the purpose they were given for ends. The banking relationship ended, so the lawful basis for marketing communications ended with it. Continued processing after that point was not a grey area.

The court did not order blanket deletion of the claimants' records. It recognised that banks have independent statutory retention obligations under anti-money laundering and banking regulation. The order was narrower, delete what you have no legal basis to keep, and stop using what remains for marketing. That distinction is the key compliance takeaway.

Why this differs from a regulatory fine

This case did not start at the Nigeria Data Protection Commission. It came from two individuals using private counsel and the courts directly. That is a different threat model for organisations to plan around.

It also arrives in an active enforcement season. The NDPC recently fined MultiChoice Nigeria reportedly around ₦766.2 million, Fidelity Bank around ₦555 million, and Meta Platforms Inc. $32.8m in a settled out-of-court case, alongside actions against other businesses for NDPA violations. With this judgment, organisations holding Nigerian customer data now face two live enforcement tracks: NDPC regulatory action and individual civil suits running in parallel.

PR and compliance lesson

Marketing databases are now legal liabilities, not just growth assets. Every re-engagement campaign, dormant-customer mailing list, and retargeting segment built from former customers carries the same exposure Stanbic IBTC just discovered. The court specifically cited the bank's failure to respond adequately to requests for data erasure. A good-faith apology after the fact is not a defence.

For Nigerian businesses, the ruling means data hygiene is no longer a back-office matter. Audit marketing databases against active relationships, not historical ones. If the customer relationship has ended, the lawful basis for marketing communications needs independent justification, not inherited consent. The reputational damage lands before the legal outcome does, and trust-based brands are most exposed.