In a recent judical decision (Chris. vs CBN), a Nigerian Court upheld a new central banking regulation requiring banks to collect customers’ social media account details as part of standard Know Your Customer (KYC) procedures (“Regulation 6a“). Additionally, the Court offered some side remarks on the data privacy rights of bank customers in relation to social media handles, raising concerns about the validity of these observations. This legal update assesses those obiter remarks within the framework of data privacy and constitutional law.
- The court held that a social media handle is of the same genre as an email address, and a phone number.
In data privacy law, there is a significant distinction between sensitive personal data and non-sensitive personal data. Sensitive personal data refers to information that reveals an individual’s racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, among other things. This information is subject to special protection because its collection and use may infringe upon fundamental human rights such as freedom of thought, conscience, religion, expression, assembly, association, and protection from discrimination[1]. An email address or phone number does not typically disclose sensitive personal information, unlike social media handles, which can potentially reveal details about an individual’s racial or ethnic background, political views, religious beliefs, or philosophical perspectives. Consequently, a social media handle and an email address or a phone number are not of the same genus, in data privacy law.
The sensitive nature of the personal information accessible through a bank customer’s social media account was underscored by a recent case involving a prominent UK bank closing the account of well-known political commentator, Nigel Farage. Mr. Farage later obtained a report from the bank revealing that his political views had been considered in the decision to close his account, leading to the resignation of the bank’s chief executive officer. Another popular celebrity, Kanye West, was also allegedly debanked on the basis of his political views expressed online.
2.A bank customer cannot be heard to be seeking privacy rights in connection with his/her social media handle since that bank customer has (a) by himself put his/her information in public domain; (b) by opening a social media account, wishes for his opinions/personal information to be visible to all.
The position is debatable, as a constitutional matter and as a data protection matter. A key component of the constitutional right to privacy under the Nigerian Constitution, is the right to private life. To illustrate, if a Respondent picked up an Applicant’s passport photograph from a social media website or other public domain and then used the Applicant’s photograph on its business calendar without the Applicant’s consent, the Resondent’s use of the photograph can be said to have infringed the Applicant’s right to private life[2]. Therefore, an individual does not, by virtue of putting their information in public domain, lose the right to privacy, in respect that information. As a matter of data privacy law, the public nature of information is not generally relevant as the primary question is often whether there is a lawful basis for processing personal data, notwithstanding that the specific category of personal data is in the public domain.
Final Comments
It is important to highlight that the court’s comments regarding the data privacy rights of bank customers were made as obiter dicta and are not part of the court’s binding decision in this case. The court’s actual ruling focused on the legality of the Central Bank’s directive for banks to collect their customers’ social media handles, concluding that this requirement was lawful as there was no evidence of bad faith on the part of the Central Bank in issuing Regulation 6a.
We have provided some commentary on the banking law and policy issues, raised in this decision, here
[1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/
[2] P.P. (Nig.) Ltd vs Olaghere (2019) 2 NWLR (Pt. 1657) 541. See also: PJS v News Group Newspapers Ltd [2016] UKSC 26
