In a landmark ruling, the Federal High Court in Lagos upheld a new regulation by the Central Bank of Nigeria (CBN) requiring financial institutions to collect the social media handles of their customers as part of the standard Know-Your-Customer (KYC) procedures.
The decision, delivered on Thursday, May 16, by Justice Nnamdi Dimgba, has stirred significant discourse on privacy rights and regulatory compliance in Nigeria’s banking sector.
Justice Dimgba ruled that the CBN regulation does not breach the right to privacy of bank customers. He dismissed a suit filed by Lagos-based lawyer Chris Eke, who sought a declaration that Section 6(a)(iv) of the Central Bank of Nigeria (Customer Due Diligence) Regulations, 2023, was unconstitutional and invalid.
Tekedia Mini-MBA edition 16 (Feb 10 – May 3, 2025) opens registrations; register today for early bird discounts.
Tekedia AI in Business Masterclass opens registrations here.
Join Tekedia Capital Syndicate and invest in Africa’s finest startups here.
Eke argued that the regulation was undemocratic and inconsistent with Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended), which guarantees the privacy of citizens. He also requested a perpetual injunction to prevent the CBN from enforcing the regulation.
The CBN, in its defense, filed a notice of preliminary objection, challenging the competence of Eke’s suit. The apex bank contended that the regulation did not interfere with the private lives of customers as claimed.
In his judgment, Justice Dimgba held that the preliminary objection had merit and struck out the suit. He reasoned that the provision of a social media handle is akin to providing an email address or phone number—standard contact information used for due diligence.
“The essence of having a social media account is for one to be publicly visible communication-wise. It would be highly unreasonable to hold the CBN in breach of privacy for it,” Justice Dimgba held.
The judgment’s details.
Justice Dimgba elaborated on several key points. He held: “First, the Applicant claims that the requirements on the CBN Regulations for financial institutions to request and collect the social media handle of its customers as part of KYC infringes on his right to privacy. This claim is very ambitious and amounts to a very far throw. The said Regulations are directed to and apply to financial institutions. It does not apply to private individuals such as the Applicant.
“Even if, as appears to be argued, that the Regulations itself would inevitably affect the Applicant, this claim is speculative for the simple reason that in nowhere in the affidavit in support was it stated that the Applicant operates an account with a financial institution and that the said institution had demanded his social media handle.
“There is also no deposition to the effect that any financial institution had begun to implement this Regulation and that its implementation had begun to create disruptions and inconvenience against the general population, in which case one could infer that the suit should be legitimated as a public interest litigation.
“Assuming even that the banks had begun to implement these regulations, the applicant assuming he maintained any bank accounts or sought to open one, but is being hindered or irritated by the requirement of the Regulation to avail his social media handle as part of KYC, the Applicant still had a choice, which is to refuse to do business with any bank insisting on the information as part of its social media handle but to seek other alternatives.
“My view is that the provision of a social media handle is of the same genre as the provision of email addresses, phone numbers, and other means by which a potential customer of a bank can be contacted.
“I should even say that the essence of having a social media account was for one to be publicly visible communication-wise. It, therefore, appears quite ironic, though wryly, that one can suggest that asking for information about a social media handle with which the individual exposes and immerses himself or herself in the public, can amount to a violation of privacy rights.
“A social media handle is left at large for the world to see, being in the public space, everyone enjoys the liberty to have access to it whether or not consent was obtained. It would be highly unreasonable to hold the Respondent in breach of privacy for what other persons have access to.”
Dimgba concluded that the regulation aimed at providing alternative means for banks to contact customers and conduct due diligence did not infringe on the right to privacy. He noted that having a social media handle was inherently public and that concerns about privacy violations were speculative and unfounded.
“The apprehension of the Applicant of his social interactions being monitored is manifestly speculative in itself and rather incredulous to believe that the financial institutions have the luxury of time to concern itself with such frivolities. On the whole, if I did not sustain the NPO, I would have dismissed the suit for the reasons stated. But the NPO having been sustained, the suit is therefore hereby struck out,” he said.
This ruling reinforces the CBN’s regulatory authority and clarifies the scope of privacy rights in relation to banking procedures, setting a precedent for future cases involving data collection and privacy in Nigeria’s financial sector.