Court orders GTBank to pay customer N5m over conflicting account statements, data breach

The Lagos State High Court has ordered Guaranty Trust Bank Plc (GTBank) to pay ₦5 million in general damages to a customer, Rebecca Bonje, for issuing contradictory account statements and breaching her data privacy rights under the Nigeria Data Protection Act (NDPA) 2023.

The case, Rebecca Bonje v. Guaranty Trust Bank Plc (Suit No: LD/18590MFHR/2024), was filed by the law firm Olumide Babalola LP. Bonje accused GTBank of providing her with two inconsistent account statements, removing certain transaction entries without explanation, and failing to correct the discrepancies despite repeated requests.

In her application, Bonje sought several declarations, stating that: “The issuance of conflicting statements was unfair, non-transparent, and in breach of Section 24(1)(e) of the NDPA 2023.

“The refusal to correct discrepancies violated her right to rectification of personal data under Section 34(1)(c).

“The removal of transaction entries constituted a personal data breach contrary to Section 65 of the Act.”

She also demanded general damages for what she described as the bank’s violation of her data protection rights.

Delivering judgment on September 18, 2025, Justice O.A. Oresanya ruled that GTBank failed to meet its statutory obligations in handling the customer’s personal financial data.

The court found that the bank’s actions amounted to a breach of Bonje’s rights under the NDPA and awarded ₦5,000,000 as general damages in her favour.

Justice Oresanya also granted all four declaratory reliefs sought by the applicant, affirming that issuing conflicting statements and refusing to correct them violated both the NDPA and the constitutional right to privacy.