The CBN Directive on Publication of Delinquent Bank Debtors: Some Data Privacy Ramifications

Sunday, December 06, 2020 / 09.57AM / OpEd ByOlubunmi Abayomi-Olukunle* / Header Image Credit: DebtorsAfrica

Can aBank legitimately disclose the names of individual debtors or obligors in thenewspapers as a naming and shaming strategy for debt recovery? Does the NDPRprovide any relief for such individual debtors or obligors?

Nigerianbanks are entering a phase of increased regulatory supervision from bothbanking and non-banking regulators. In particular regard to data privacycompliance, commercial banks in Nigeria may be exposed to an additional layerof legal liability under the Nigerian Data Privacy Regulations (the "NDPR"), ifthey continue to comply with the directive from the Central Bank of Nigeria (CBN)to publish the names of delinquent borrowers in the newspapers.

In2015, the CBN issued a directive to all banks and discount Houses (Banks) in Nigeriaasking Banks to (a) give the delinquent debtors 3 (three) months of grace toturn their accounts from non-performing to performing status (b) publish thelist of delinquent debtors that remain non-performing in at least threenational daily newspapers quarterly (the Directive).According to the Directive, the delinquent debtors are customers whose accountshave been classified lost and includes related persons, entities, directors,subsidiaries and other related parties. Nigerian Banks continue to publishthe names of delinquent borrowers in newspapers, in compliance with theDirective. Recently, Access Bank issued a notice here to its customers notifying delinquentdebtors of the Bank's decision to "publish our debtors' names in newspapers intwo weeks".

Ourconsidered view is that Banks and the CBN may be exposed to a claim for breachof personal data privacy and for monetary damages within the context of theNDPR. Here are some of the legal considerations [1]

Post-Script: For PublishingDebtors List - Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank - July 17, 2020

i) Although acompany's legal name does not constitute personal data under the NDPR, certainother debtor information, publically revealed by Banks constitutes personaldata under the NDPR. Some of these include names, location data, I.P.addresses, phone numbers, addresses, photographs, emails and bank details ofindividual promoters, directors, guarantors, or other obligors (IndividualObligors/Obligor) of such delinquent entities. Additionally, the fact ofindebtedness or the very existence of a debt, constitutes credit informationand is a form economic identity and by that measure will qualify as personaldata under the NDPR.

ii) The act ofdisclosure or dissemination of the personal data collected by a Bank during aloan application or credit evaluation process, to a newspaper/mediaorganization for publication, qualifies as processing activity as per thestatutory definition of "processing" under the NDPR.

iii) Based on 1 and 2 above, a Bank will generally stand inthe position of a data controller in relation to the personal data of Obligorsto the extent that an Individual Obligor is a natural person.

iv) In order toprocess the information of Individual Obligors in the manner contemplated bythe Directive (i.e. publication of a debtors' list in newspapers), aBank needs to discover the lawful basis for such processingactivity as per the provisions of the NDPR. That lawful basis could be "consent" aswould be the case where the Bank inserts data sharing consent clauses in acommitment or offer letter authorizing the Bank to make such third-partydisclosures in specific circumstances.

(v) Usingconsent in this instance is fraught with some challenges. We discuss somebelow

The insertion of data sharing consent clauses in commitment/offer letters is a relatively recent development in the standard debt financing documentation adapted by Banks, meaning that a Bank may be unable to claim the benefit of this clause in respect of some Individual Obligors, whose financing or security agreements did not bear those clauses
The model data sharing consent clauses in standard commitment/offer letters usually allows the Bank to share credit information only with licensed credit bureaus or with regulators and not in newspapers or on social media.
It is unusual for an Individual Obligor to consent to a publication of his/her name in the newspapers as a debt recovery mechanism. Even if this were possible, such consent could be vitiated as per provisions of the NDPR. It's important to note that the NDPR (as is the case with global data privacy regulations) sets a high standard for "consent" when used as a proxy for lawful basis. In order to justify processing based on "consent", a Bank would have to, amongst others, show that any such "consent" was expressly given in the form of a clear and specific statement of consent; further that the consent was obtained without fraud, coercion or undue influence. An Individual Obligor may be able to make a case of duress, if made to agree to an unbalanced data sharing clause.
Data sharing consent clauses are usually contained in offer letters and hardly in other standard financing or security agreements. In many cases, Individual Obligors who sign guarantee or indemnity agreements are not within the contemplation of the data consent sharing clauses contained in financing documents. The standard form of the security or indemnity agreements adapted by Banks do not typically contain these clauses.

vi) Anotheroption open to a Bank would be to rely on legitimate interest asa lawful basis for complying with the Directive. The doctrine of legitimateinterest effectively allows data controllers, (the Bank, in this case) toprocess personal data without the necessity of the consent of a data subject(an Individual Obligor, in this case), where such processing is necessaryto protect the personal interest of a Data Controller or that of a third party.Such personal interest can broadly include commercial interests of the Bank orother broader societal interests. However, we note with some concern that thereis no categorical provision in the NDPR which identifies legitimateinterest as a lawful basis for processing personal data under theNDPR. This means that technically, Banks may not be able to rely on legitimateinterest as a lawful basis for processing debtor information in themanner contemplated by the Directive.

vii) A Bank may also consider relying on legalobligation as a basis for processing debtor information in the mannercontemplated by the Directive. This principle allows the Bank to processpersonal data without the necessity of the consent of an Individual Obligor,where such processing is necessary to comply with a legal obligation.To the extent that the publication of an Obligor's personal information in thenewspaper is in furtherance a directive from the CBN, a Bank may seek to rely "legal obligation" as a lawful basis. Although relying on legalobligation may appear to be a more convincing "lawful basis", theimportant point to note is that the determination of the lawfulbasis of an intended or an actual processing activity, requirescritical thought as there may be different considerations for differentcategories of data, for the same processing activity and in the same datacontroller organization. There could also be other legal considerations that goto the root of data privacy activities carried out by regulated entities. Forinstance, in this case, the author of the Directive, the CBN, is itself subjectto the NDPR and to regulatory supervision by NITDA on data privacy issues. Onthat basis, the legality of the Directive can be challenged with a reasonableprospect of success. In that event, public interest, a legaldoctrine also recognized as a lawful basis for processing anObligor's personal data in the absence of consent will likelydetermine where legal liability rests as well as the provisions of the CBN Actand BOFIA [2]. TheCBN may have to demonstrate that the publication of the personal data ofIndividual Obligors serves a public interest, notwithstanding the fact that theBanks have the benefit of security.

ThirdParty Liabilities?

Yes.Newspapers or other media organizations who publish the personal data ofIndividual Obligors may also be exposed to legal liability under the NDPR bypublishing the personal data of Individual Obligors. It's particularlyimportant to note that the NDPR does not provide a specific journalisticexemption for media publishers and their journalist employees. The practicalimplication of this exclusion is that media organizations may not be able torely successfully on the premise that such publication was done in the"public interest or in the exercise of press freedom, when faced with a legalaction from Nigerian claimants who claim that their personal rights havebeen infringed by a media company orjournalist.

Inclosing

The resolution of some of these issues are notpossible without definite administrative guidance from NITDA or a judicialdetermination on the merits. It is particularly important to note there mayalso be constitutional law implications. The NDPR specifically made provisionsmandating the interpretation of the NDPR in accordance withconstitutionally guaranteed principles and enforcement of fundamental rights.This is significant for Banks and other data controllers for two primaryreasons; Firstly, this provision effectively changes the character of a dataprivacy claim and subjects defendants in a data privacy litigation matter to ahigher legal standard in the form of a constitutional obligation.

In a sense, provides Nigerian courts with a newcanvass for analysing privacy rights as relates to the use and collection ofpersonal data by corporate entities. Secondly, Nigerian courts take fundamentalhuman rights issues very seriously and treat those issues speedily based onspecial enforcement procedure and evidence rules. In practice, a great majorityof fundamental human right breach cases succeed in Nigerian courts.

Ithelps to contemplate and resolve these issues early on.

About Author

OlubunmiAbayomi-Olukunle is a partner and Lead Counsel at the Private Equity, VentureCapital & Emerging Companies sector-focused, specialist investment &finance law firm of Balogun Harold - www.balogunharold.com orvia e-mail: [email protected]

The above article was written on May 21, 2020 and titled "Re: The CBN Directive to Nigerian Banks on the Publication of the Namesof Delinquent Bank Debtors in the Dailies: Some Data Privacy Ramifications". Since then, we have published this judgment delivered by the courts - For PublishingDebtors List - Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank - July 17, 2020