The Federal High Court sitting in Abuja has thrown out a N100 million lawsuit that accused First City Monument Bank (FCMB) of breaching a customer’s privacy rights, ruling that the applicant failed to provide sufficient evidence to support his claims.
Justice M.S. Liman delivered the judgment on July 14, 2026, in a case that tested the boundaries of Nigeria’s data protection framework as applied to the banking sector.
According to the Certified True Copy of the judgment, the court found that the applicant, Anyakora Onyedika Araka, had not met the evidentiary burden required to establish that FCMB acted deliberately or recklessly in handling his personal data.
Araka, represented by counsel Ahmed Ayomide, Esq., had sought a range of declaratory and injunctive reliefs alongside the N100 million damages claim, arguing that the bank processed his personal information, including his Bank Verification Number (BVN) and email address, to open an account in his name without his knowledge or consent.
FCMB, represented by Babatunde Ige, Esq., pushed back firmly against the allegations. The bank’s legal team maintained that once the complaint was received, FCMB triggered its internal complaint resolution process, launched an investigation, uncovered irregularities tied to the account, and moved swiftly to shut it down permanently.
Ige argued that this response demonstrated good faith and legal compliance, insisting the bank neither exploited Araka’s personal information for unlawful purposes nor profited from the disputed account in any way.
He also invoked Chapter IV of the 1999 Constitution and the Federal Competition and Consumer Protection Act (FCCPA) to argue that no breach of fair dealing had occurred.
In his judgment, Justice Liman laid out a clear standard for when courts should intervene in data privacy disputes. He noted that where evidence points to deliberate misuse of personal data, reckless disregard for statutory duty, repeated non-compliance, identity theft, unauthorized disclosure, or fraudulent processing causing real harm, courts will not shy away from granting constitutional and statutory remedies including substantial damages.
However, he was equally clear that outcomes must turn on the specific facts of each case. Here, the affidavit evidence showed a bank that acted responsibly the moment the complaint surfaced, investigating promptly and closing the account for good.
“The law cannot ignore such prompt remedial action,” Liman said, adding that courts must strike a balance: encouraging responsible corporate behavior while still holding institutions accountable when genuine violations occur.
Weighing the affidavit evidence, documentary exhibits, and legal submissions from both sides, the judge concluded that Araka had not established any legal or factual basis to justify the reliefs he sought, declaring the suit “devoid of merit” and dismissing it in its entirety, including the N100 million damages claim and any post-judgment interest.
Importantly, Justice Liman was careful to frame the dismissal narrowly. He stressed that the ruling should not be read as diminishing the significance of data privacy protections or loosening the obligations that the Nigeria Data Protection Act, 2023 places on financial institutions.
Araka, for his part, had argued that the unauthorized account opening exposed him to emotional distress, reputational harm, and fear of potential financial fraud harms, he said, that warranted both injunctive relief and compensation.
The case offers an early window into how Nigerian courts are applying the 2023 Data Protection Act to real-world banking disputes.
While this particular claim fell short, the judgment’s language suggests the courts are prepared to award significant damages in cases where financial institutions are shown to have acted with clear negligence, malice, or disregard for data protection obligations a signal worth watching as more such suits likely make their way through the system in the years ahead.
WHAT YOU SHOULD KNOW
The Federal High Court’s dismissal of the N100 million suit against FCMB turned on one decisive factor: swift corporate accountability. Because the bank acted promptly upon discovering the disputed account, investigating the complaint, and permanently closing it the court found no basis for damages, even though personal data had been processed without clear authorization.
Under Nigeria’s Data Protection Act, 2023, how an institution responds to a privacy complaint can matter as much as the breach itself.
Prompt remedial action can shield a company from liability, but the court was careful to note this doesn’t lower the bar for institutions that act negligently or in bad faith; those will still face serious consequences.
