Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Tokunbo Olatokun sued Polaris Bank for breaching his right to privacy by sending unsolicited marketing emails after he closed his account and instructed them to stop. Polaris Bank argued they were permitted to send marketing emails under CBN guidelines. The court ruled in favour of Olatokun, stating that Polaris Bank violated his right to privacy under the Nigerian Constitution and Data Protection Act, awarding him damages.

Facts

The applicant, Tokunbo Olatokun, was a customer of the respondent, Polaris Bank Limited, with account number 2080008102. On 13 March 2024, Olatokun instructed Polaris Bank to close his account and requested a letter of instruction. Polaris Bank acknowledged his request and asked for a handwritten instruction for closing his credit card account. Olatokun sent a handwritten instruction to close his account and requested that the bank stop sending him emails. Despite this request, Polaris Bank continued to send him marketing emails, which Olatokun found offensive. He claimed that Polaris Bank’s failure to close his account and their continued sending of marketing emails constituted a breach of his right to privacy. He also alleged that Polaris Bank’s privacy policy wasn’t compliant with the Nigeria Data Protection Act, 2023.

Polaris Bank admitted that Olatokun was a customer and that he had requested to close his account. They claimed that Olatokun furnished the bank with his personal details during the period he operated his account. Polaris Bank argued that the Central Bank of Nigeria’s (CBN) guidelines allow financial institutions to send unsolicited advertisements via emails, text messages, and other channels. The bank claimed that the emails sent to Olatokun were generic promotional messages and not individually targeted. They also argued that Olatokun consented to receive such information at some point.

The court found that Polaris Bank breached Olatokun’s fundamental right to privacy by sending him unsolicited emails after he requested them to stop and to expunge his details from their database.

Legal provisions Reviewed

The court reviewed the following legal provisions in reaching its judgment:

• Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended) guarantees the right to privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications.
• Section 46 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended) allows any person alleging a violation of provisions under this chapter to seek redress in a High Court.
• Sections 24 (1) (a), 27 (1), 34 (1) & (c), and 36 (1) and (2) of the Nigeria Data Protection Act, 2023 protect data subjects' rights regarding how their data is processed and used. The court determined whether Polaris Bank violated these sections by continuing to send marketing emails to Olatokun after he requested them to stop and close his account.
• Section 24 (1) of the Nigeria Data Protection Regulation 2019 details requirements for lawful data processing, and the court considered if the respondent's actions were compliant.
• CBN Consumer Protection Framework Guidelines on Disclosure and Transparency were reviewed as the respondent bank argued it permitted the sending of marketing emails to customers. The court found that this provision couldn’t override the data protection rights of the applicant under the Nigeria Data Protection Act.

The court relied on these provisions to determine whether the respondent, Polaris Bank, infringed on the applicant's, Tokunbo Olatokun's, fundamental right to privacy and data protection rights by sending unsolicited marketing emails after being instructed to stop.